IEEE Technology and Society Magazine - Spring 2013 - 68

There will be services that cannot
be easily migrated to the cloud in
the short and medium term.
technologies [4]. For example, one
benefit might be social interaction business models where work
is performed with the help of the
public. For public organizations
this makes it easier to implement
new service models that give
users more control and encourage
greater participation. An example
is eyeonearth.eu, featuring applications where the data are supplied
directly by users who can interact
easily with the systems, making
them more transparent to citizens
and less expensive for the public
organization to maintain.

Cloud and Data
Sensitivity of Data
The main factor when deciding
whether to use cloud storage services is usually the type of data
that will be stored. personally
identifiable information (pII) presents higher risks when using cloud
services, especially public cloud
services because of data protection laws. It is important to know
whether data records can identify
specific persons. This applies to
the use of big data and open data.
It implies that public organizations
need to anonymize data before
sending it to the cloud for processing or sharing.
Big Data
Most public organizations generate
huge quantities of data [5], like logs
of users' behavior when using their
websites, social network comments
and software that tracks internal
processes. Statistical and data mining tools can be used to discover
useful patterns (e.g., Google flu
trends from search requests). Storing data is easy and cheap these
days, but processing this data
68

|

quickly in order to find interesting patterns requires huge computer clusters and specific software
(like Apache Hadoop). This has a
cost that some public organizations cannot afford, especially if
it is not required on a day-to-day
basis. However, cloud computing
technologies that are only paid for
when used make this possible for
many organizations.
As an example the U.S. National
Science Foundation has an agreement with IBM and Google to use
these types of services. There is
big potential in the use of cloud
facilities for this type of services,
not only because of reduced cost,
but because in most cases pII is not
present in big data.
Open Data
Open Data initiatives like data.gov
and data.gov.uk represent another
possible use of cloud services by government organizations [6]. Big data
sets of non-pII data are provided by
governmental organizations to anyone who wants to use it. Access to
public data and/or services is made
easier, so external organizations or
even individuals can create value
added systems using the software
and data available. For example,
Matthew Somerville has built a
website using Microsoft Azure
cloud that shows live Underground
train positions, using Transport for
London's data.

Security and
Availability Issues
Security
Security and legal regulations
are probably the most important
issues for public organizations.
The same principles apply as for
other non-cloud systems, but the

main differences are the lack of
control of the cloud services and
the secrecy of how these systems
are managed by the cloud providers. In the cloud model, the data
owner is still the public organization, but the custodian is the cloud
provider. The provider has the
responsibility of ensuring the data
owner's security requirements are
always met.
Normally the auditing and compliance requirements of public
organizations will be more difficult to achieve in a cloud environment. Access to log files and
other auditing information may be
difficult. In the cloud, some of the
traditional controls are managed
through contracts and SLAs. The
level of security will depend on the
type of cloud model used; it will be
more similar to the traditional systems in the case of Infrastructure
as a Service (IaaS), where there is
more control, with less control in
the Software as a Service (SaaS)
model. A proper information security risk assessment has to be done,
whatever the model, to identify and
manage all substantial risks. Even
if it is possible to transfer liability
using specific contracts, accountability will still be with the public organization. A clear policy
for dealing with security incidents
should be in the contracts and
SLAs with the vendors.
physical security normally is not
an issue, because cloud providers'
data centers are usually better
protected and prepared than those
owned by public organizations.
Vulnerability detection and patch
management are difficult to manage
than when using in-house systems.
It is not easy to use vulnerability
discovery tools to assess parts of
the systems and this should only
be done in cases where the cloud
provider's Acceptable Use policy
permits. Other matters to consider
include managing the backup and
restoration of data and controlling the proper disposal of data
and equipment. It may be possible

IEEE TECHNOLOGY AND SOCIETY MAGAZINE

|

SprING 2013
http://www.eyeonearth.eu http://www.data.gov http://data.gov.uk
Table of Contents for the Digital Edition of IEEE Technology and Society Magazine - Spring 2013
