According to IBM’s Institute for Business Value 2010 Global IT Risk Study, cloud computing raised serious concerns among respondents about the use, access and control of data: 77 percent of respondents believe that adopting cloud computing makes protecting privacy more difficult; 50 percent are concerned about a data breach or loss; and 23 percent indicate that weakening of corporate network security is a concern.  As the study illustrates, businesses see the promise of the cloud model, but security remains an inhibitor to adoption.

While an information technology (IT) foundation pertains to all cloud computing, providers and users do not generally rely on one generic model for data security. Both cloud providers and users should consider a variety of factors, including the kind of work a client wants to do in the cloud and the mechanisms and controls used. For example, clients who have collaboration tools and email work in the cloud should think about access and policy controls, while clients focused on healthcare in the cloud should be concerned with data isolation and encryption.

To help meet these specific needs, IBM’s cloud security experts work closely with clients to address their individual concerns and provide the appropriate services and offerings. This process includes evaluations of the security positioning of planned or existing cloud implementations as well as recommendations for various security strategies.

“IBM understands the ‘one size fits all’ cloud security strategy will not work for most businesses,” said Steve Robinson, general manager, IBM Security Solutions. “Our enterprise clients are looking for a trusted advisor to provide the right mix of security consulting services and offerings to match. By offering these new services and innovations, we aim to help clients create tailored solutions that will allow them to get the most out of their cloud environments.”

Additionally, IBM has a team of security professionals around the world and holds a number of security and risk management patents, which can be used to help clients solve their toughest cloud problems. As the cloud computing model evolves with the changing needs of a client’s business, IBM researchers are designing new technologies to ensure the integrity of data in the cloud regardless of the business or industry scenario.

New IBM Cloud Security Infrastructure and Services

IBM is using its expertise to outline a two-pronged approach for clients seeking to dramatically improve cloud security:

1. Plan and Assess the Security Strategy for the Cloud

• IBM Cloud Security Strategy Roadmap – For clients who are embarking on a cloud strategy as either a provider or subscriber, the new roadmap is designed to help organizations understand, establish and outline the steps for realizing their security goals in relation to their cloud computing strategy. IBM security experts conduct an onsite working session with clients to help define the cloud computing initiative and goals, identify associated security and privacy concerns, determine appropriate vulnerability mitigation strategies and develop a high-level security strategy roadmap designed to achieve their cloud security objectives.
• IBM Cloud Security Assessment – For clients with cloud infrastructure in place or planning their cloud environment, the new assessment is designed to help provide an in-depth understanding of the current state of a current or planned cloud solution’s security controls, mechanisms and architecture. IBM assessment professionals help compare the cloud solution’s security program against industry best practices and the client’s own cloud security objectives, then identifies steps to help improve the overall security environment.
• IBM Application Security Services for Cloud – The new offering allows CIOs to have a clear picture of how and where sensitive data will circulate in a cloud environment. It assesses current or proposed cloud application environments to help ensure that the appropriate information, security, and privacy controls are in place for a client’s specific business requirements. By identifying and prioritizing cloud-specific security vulnerabilities, internally and within their service providers, the offering can help clients determine the right balance of internal control and service provider autonomy required to maintain efficiency and service level requirements before implementing the solution.

2. Obtain Security Services from the Cloud

• IBM Managed Security Services Hosted Security Event and Log Management – This enhanced offering is a cloud-based solution for security incident and event management  that consolidates the security event and log data of operating systems, applications and infrastructure equipment, providing a seamless platform from which to assess and respond to real-time and historical traffic. It dramatically improves the speed of security investigations and compliance initiatives, offering the full life cycle of security information and event management, and provides options to outsource these tasks to security experts located in IBM’s worldwide Security Operation Centers.
• IBM Managed Security Services Hosted Vulnerability Management – This enhanced cloud-based scanning service helps companies to identify vulnerabilities across network devices, servers, web applications and databases to help manage concerns and reduce the cost of security operations. This service is available to companies of all sizes who want to quickly and more easily address compliance mandates.

“We needed a remote scanning solution that can help us identify critical vulnerabilities throughout our infrastructure and assist us in meeting external audit requirements,” said Henrique Matiole, IT supervisor, ArcelorMittal Sistemas S.A. of Brazil. “The enhanced hosted vulnerability management scanning solution carries advanced scanning capabilities for complicated security challenges and provides strong reporting capabilities through a web-based portal that helps us easily satisfy our audit requirements.”

Top Security Experts Develop Next Generation of Solutions to Secure Cloud

Researchers at the IBM Watson and Zurich research labs are working on a variety of projects that examine new ways to bolster cloud security by enabling enhanced data integrity, recovery, privacy, and customer isolation in a public cloud environment.

For example, as part of the Integrated Trusted Virtual Data Center (iTVDc) project, IBM researchers have developed mechanisms that enhance cloud security by providing “infrastructure hardening,” or stronger isolation between different workloads. These mechanisms verify the integrity and correct configuration of infrastructure components such as hypervisors to help prevent low-level attacks such as spoofing, or deceiving computer systems or other computer users by hiding or imitating one’s Internet identity. IBM recently added some of these security capabilities to the IBM Smart Business Test and Development cloud. Some of these security mechanisms are also currently offered in the IBM Systems Director VMControl™.

Another example of IBM’s ability to rapidly take advantage of new cloud security techniques pioneered by its researchers is the integration of “introspection monitoring” in the IBM Virtual Protection System. This capability enables a kind of “virtual doorman,” in the cloud environment, which detects potential malware attacks from outside the virtual machine and scans the operating systems inside to confirm they are running properly. The capability will then determine whether or not they contain malicious code, such as root-kits, which are software programs designed to provide a user with administrator access to a computer without being detected. This level of security isn’t available from conventional introspection solutions that can only communicate and check inside the virtual machine. The rootkit-detection system is currently offered as part of IBM Virtual Server Protection system.

IBM’s Institute for Business Value 2010 Global IT Risk Study

IBM’s Institute for Business Value 2010 Global IT Risk Study was commissioned to understand how information technology (IT) managers are working to mitigate risk.  Core objectives of the study included evaluating the manner in which innovations like cloud and mobile computing are influencing overall IT risk strategies and exploring how the role of the IT Manager is changing in relation to these innovations.  The survey included 556 respondents from all geographies, representing companies with revenues of less than $500M to more than $10B.  Respondents worked across a diverse set of industries and sectors including finance, healthcare, biotechnology, manufacturing, government and information technology services.

For more information on the IBM 2010 Global IT Risk Study please see: www.ibm.com/services/riskstudy

IBM Security Solutions include an extensive portfolio of hardware, software solutions, professional and managed services offerings covering the spectrum of IT and business security risks, including: people and identity, data and information, application and process, network, server and endpoint and physical infrastructure. IBM Security Solutions empowers clients to innovate and operate their businesses on highly secure infrastructure platforms.

For more information on IBM Security Solutions, visit: www.ibm.com/security.