How the CSA is working to solve Cloud security problems

That's where the non-profit Cloud Security Alliance comes in. Formed in 2009, the group today has 20,000 members and is regularly cited as a leading voice in the move to bring security to cloud computing. As Jerry Archer, a CSA board member and CSO for Sallie Mae explains, the organization doesn't aspire to be a standards body, nevertheless instead looks for ways to promote best practices around which users, IT auditors, cloud and security solutions providers can agree.

You've said that the CSA doesn't intend to create so-called hard standards like SAS 70 or PCI. Why is that, and how do you perceive your contribution to the cloud computing industry?

We feel like industry standards should be created by the groups, like ISO and others, that are good at it. We often work with the existing standards organizations to provide counsel and guidance, nevertheless we feel we can be more agile if we're not tied to any specific standards. We have formal alliances with both the ISO and the International Telecommunications Union -- the ITU. We in fact provide our technology and resources to them on an ongoing basis to help with their work. We're as well working with NIST, and we're open to creating partnerships with other standards organizations.

The foundational components for cloud computing

Most of our focus is all in all building the foundational components for cloud computing. However thought leaders can help influence the tactical side of building the foundation so it's transferable, so we don't have to tear the foundation apart and rebuild it each time we get through another cycle in the cloud.

In terms of the future, I think anybody who tells you they can see furthermore than two years into the future of the cloud, then, that's naive. Everything is changing, and we can't begin to predict the consequences of all that change. It is as different, otherwise more different, than going from mainframe to distributed systems - the cloud will change everything about computing.