Skip to Content

A Silver Lining for the Government’s Cloud

Cloud computing solutions might improve the overall security of government software.
September 21, 2009

Cloud computing received a strong push last week when the U.S. government’s Chief Information Officer Vivek Kundra announced, a website that lets government agencies find and buy access to cloud-computing tools and services.

Experts have previously warned that cloud computing can introduce new security, privacy, and reliability risks, but some say that the technologies on offer could actually help improve the government’s information-security record.

Kundra noted in a blog post last week that cloud computing can help “lower the cost of government operations while driving innovation.” The federal government currently spends about $75 billion a year on information technology infrastructure and other resources. However, although many companies have quickly turned to cloud computing to save money, the move has been harder for government agencies to make.

“We will need to address various issues related to security, privacy, information management and procurement to expand our cloud computing services,” Kundra wrote.

On top of the maze of regulations that agencies have to navigate in order to adopt new software, many officials in government agencies are especially worried about security and reliability, says Deniece Peterson, principal analyst for INPUT, a consulting company based in Reston, VA, that specializes in government business. “ gives them an easier way to acquire apps and educate themselves about cloud computing,” she says.

In a way, is just the most visible part of a trend that has already come to government., for example, which dominates the list of applications available on the new site in several categories, already provides cloud-computing services to about half of all cabinet agencies in the federal government, according to Daniel Burton, senior vice president of global public policy for the company.

The key change with, Burton says, is that the site streamlines the process of setting up a new cloud service. Instead of each agency having to work out a new agreement with, the site provides standardized, approved agreements that agencies can adopt, so they can get access to the services more quickly.

Jeremiah Grossman, founder and chief technology officer of White Hat Security, in Santa Clara, CA, says that a security audit should be part of the approval process, and government agencies should pay attention to what types of data are being handled by each cloud service. Grossman notes that it’s a good idea to check any Web application against common attacks used on the Internet, such as cross-site scripting.

With that in mind, Grossman says, “From just general business and competition dynamics, I think cloud computing can advance Web security like nothing else before.” When one customer demands certain security features of a cloud service, those features are automatically delivered to other customers of the same service, he says.

Fluffy security: Cloud-computing tools and services available at could mean better security for government agencies, some experts say.

“If a big customer demands certain security controls,” Grossman says, “you become the beneficiary of that work by the service provider and customer.” This means that the centralized approach of will help all government agencies get better security from popular providers.

Google hopes its experience will attract government customers. “Our technology is really built to withstand the most sophisticated attacks,” says David Mihalchik, business development manager on Google’s federal team. “We are the honeypot for hackers in many respects. We are constantly being attacked, and we have a team of some of the top security experts in the world that make sure we are fending off those attacks on and on our other properties.”

Google is in the process of getting its public cloud certified according to federal government standards for information security. It hopes to be approved to handle information deemed moderately sensitive. Once that rating has been attained, Google plans to build a dedicated government cloud that exceeds that standard to address individual government agency needs.

“These companies have huge incentives to provide good security,” says Ted Schadler, an analyst at Forrester Research specializing in cloud-based collaboration. He compares security problems in cloud computing to plane crashes – they’re high-profile events that generate a lot of attention and embarrassment for the companies involved.

But INPUT’s Peterson says that there’s still room for concern. “Security is a two-part thing – technology and people,” she says. In order for cloud-computing services to work effectively and securely, the agencies using them need to understand how to handle the technology responsibly.

Peterson still sees as a careful step into cloud computing. The first go-round, she says, is focused on applications that won’t have access to large amounts of government data. If this initial phase goes well, she expects to see cloud-computing services penetrating more deeply into government agencies, handling more mission-critical tasks, and taking on heavier roles as essential infrastructure.

Forrester’s Schadler says that fits into the Obama administration’s agenda of pushing the government forward in its IT sophistication. The visibility of could encourage more businesses to set aside their hesitations and try cloud computing, he says. Schadler expects that constituents may pressure government agencies to adopt the new technologies when they see the cost savings.

Keep Reading

Most Popular

wet market selling fish
wet market selling fish

This scientist now believes covid started in Wuhan’s wet market. Here’s why.

How a veteran virologist found fresh evidence to back up the theory that covid jumped from animals to humans in a notorious Chinese market—rather than emerged from a lab leak.

light and shadow on floor
light and shadow on floor

How Facebook and Google fund global misinformation

The tech giants are paying millions of dollars to the operators of clickbait pages, bankrolling the deterioration of information ecosystems around the world.

masked travellers at Heathrow airport
masked travellers at Heathrow airport

We still don’t know enough about the omicron variant to panic

The variant has caused alarm and immediate border shutdowns—but we still don't know how it will respond to vaccines.

egasus' fortune after macron hack
egasus' fortune after macron hack

NSO was about to sell hacking tools to France. Now it’s in crisis.

French officials were close to buying controversial surveillance tool Pegasus from NSO earlier this year. Now the US has sanctioned the Israeli company, and insiders say it’s on the ropes.

Stay connected

Illustration by Rose WongIllustration by Rose Wong

Get the latest updates from
MIT Technology Review

Discover special offers, top stories, upcoming events, and more.

Thank you for submitting your email!

Explore more newsletters

It looks like something went wrong.

We’re having trouble saving your preferences. Try refreshing this page and updating them one more time. If you continue to get this message, reach out to us at with a list of newsletters you’d like to receive.