3. Infrastructure as a Service (IaaS) – With IaaS, the enterprise controls most of the stack including operating systems, storage, and deployed applications. Examples include Amazon EC2, RackSpace Cloud Servers and IBM SmartCloud Enterprise. Enterprises typically have direct control over security components such as data encryption, host firewalls and activity monitoring.

In addition, enterprises can also deploy Private Clouds in order to have more complete control over security capabilities (whether hosted onsite or off-premises). With private clouds, your enterprise controls the entire software stack as well as the underlying virtualization platform, self-service provisioning and metering tools and hardware infrastructure – plus the people resources required to administer the entire environment. In fact, many enterprises have already started down this path by deploying virtualized infrastructures in their data centers. Virtualization forms the basis of most cloud offerings and offers some of the key benefits of cloud computing, such as more efficient utilization of compute and storage resources, while also offering more control over how security controls are implemented in the infrastructure.


One of the most talked about problems surrounding cloud computing has been trust. The malicious insider threat is something that no software can protect from, and when a company puts its confidential data in the cloud, and that data is to some degree accessible by a third-party, countless problems come to mind. What controls can be put in place to positively eliminate this type of threat?

Insider threats pose an interesting and growing challenge for organizations. According to a recent U.S. Chamber of Commerce study, disgruntled employees or employees transitioning out of a position have cost companies tens of millions. The definition of insiders is also evolving to include outsourced personnel, contractors and partners. Also, a recent Verizon Business data breach study reports that the number of insider threat incidents investigated nearly doubled compared to last year.

As with most IT challenges, the key to effectively managing insider threats includes a combination of people, process and technology. Here are some examples of best practices in this area: