Access to enough IT staff with security expertise may be particularly tricky for organizations of all sizes. CompTIA says 41% of organizations reported moderate or significant deficiencies in security expertise among IT staff. On average, CompTIA says organizations were about 30% short of their headcount devoted to security. According to the Bureau of Labor Statistics (BLS), which adds the category of Information Security Analyst in 2011, unemployment for people employed in the category stands at 0%.
Christopher Primault, co-founder and managing director of GetApp.com, a business software marketplace that vets cloud-based apps and organizes information about them for small businesses, says that cloud services help organizations get around this problem because they provide professionals dedicated to safeguarding your information.
"Your data is probably safer with the vast majority of vendors than if you keep it on your premises," Primault says. "I really believe it's true."
He adds, "We only use cloud services, so we were born in the cloud. The cost for me to keep data in-house and protect that data would be high. Frankly, by having my data in the cloud, I feel more secure."
Primault is not alone. According to CompTIA, 85% of organizations using cloud services are confident or very confident in their cloud service provider when it comes to security. But those same organizations are reluctant to put certain types of data or applications in the cloud.
"There is a slight paradox among users of the cloud right now," says Tim Herbert, research vice president with CompTIA. "They convey very strong confidence in cloud service provider security. At the same time, many companies are very reluctant to put certain types of data or applications into a cloud environment. Companies have moved some of the non-critical systems into the cloud, but they are not there yet in terms of moving their most critical systems to the cloud."
Firms are especially reluctant to put confidential company financial data and credit card data in the cloud. CompTIA found 49% of small firms, 55% of medium firms and 56% of large firms were unwilling to put confidential company financial data in the cloud. When it came to credit card data, 50% of small firms, 50% of medium firms and 53% of large firms were reluctant.
Cloud Security Assessment Shortcomings
Even as organizations struggle between confidence in the security measures of cloud service providers and reluctance to place sensitive data in the cloud, they are also on the whole overlooking critical elements of cloud security when evaluating service providers' security policies, Herbert says. In particular, regulatory compliance, geolocation of data and the credentials of the provider are often glossed over.