Private cloud computing environments are much more suited to the needs of government bodies than their public cloud equivalents, despite the latter offering higher service availability and improved cost benefits, according to the latest report from the European Network and Information Security Agency (Enisa).
The Security and Resilience in Governmental Clouds report presents senior management with a decision-making model with which to appraise the cloud solution which provides the best fit with their organisation.
Enisa concluded that, although cloud computing could theoretically offer better value, improved availability and stronger security than traditional environments, there are many weaknesses and threats "mainly linked to the lack of governance and control over IT operations and the potential lack of compliance with laws and regulations".
Public clouds are said to be the most risky from this standpoint because they can be owned by non-EU companies, and provide inadequate transparency about security and resilience measures and potential breaches.
The report also warns that internet connectivity may not be adequate in several member states to support such models.
"For sensitive applications, private and community clouds appear to be the solutions that currently best fit the needs of public administrations since they offer the highest level of governance, control and visibility," the report stated.
"Although, when planning a community or private cloud, special regard should be given to the scale of the infrastructure as most of the resilience and security benefits of the cloud model will not be realised if the necessary infrastructural critical mass is not reached."
Public clouds, on the other hand, should be used only for non-sensitive or non-critical apps and with a clear exit strategy, according to Enisa.
Government IT managers moving to the cloud need to establish a metrics framework including key performance indicators, and should test business continuity plans and carry out due diligence, the report concluded.
Also important is ensuring that security, resilience and legal requirements are detailed in service level agreements, and taking national cloud strategies into account, said Enisa.