I wish I had a dollar for each time I've heard a small business owner object to cloud computing on the basis of "security concerns". I always listen carefully because I want to be certain to understand their security requirements so that I can guide them appropriately if those concerns are valid.
Valid -that's the key word.
So my job, as a trusted IT advisor to small business owners, is to try to determine if their objections are based on valid security concerns or are derived from some unfounded fear. Quite frankly, I have identified a whole slew of "unfounded fears" and very, very few "valid security concerns".
It seems that most of my small business customers believe that if they can walk into the server room (and I use the term server room very, very loosely) and hear a hum and see a flashing light or two, their data is secure.
Ok, so for argument's sake let's say for that moment, the data is "secure", but is the environment in which those servers reside more secure than a distributed series of Google Data Centers? Are the people maintaining those on-site servers following security practices even approaching that of Google's? Has that small business passed a SAS70 Type II security audit? Are world class environmental, physical access, and data backup controls in place? Of course there aren't! So, why do these small business owners think their on-site servers provide a more secure environment for their data? (Oh...and let me just go on record right here as saying I am using the term server very loosely, as well.)
I think the answer is primarily one of a) perceived control and b) inexperience with cloud hosted services. In my role as an IT service provider to small business, my job is to convince the IT decision maker (frequently the business owner) that cloud based services will meet or exceed their needs. And, that the ability to walk up to a server and reboot it does not qualify as control, perceived or otherwise.
It is a constant struggle to convince small business owners that their data is many, many times more secure in a Google Data Center than it is on their own servers. Just take a look at the picture accompanying this article (and these servers are maintained very well on a relative scale). Where would you want your data?