Security (or lack thereof) in the Cloud

The case of sensitive Twitter documents being exposed due to a breach of an email account and access to the Google Documents application adds fuel the already discussion that is already approaching inferno status.  I’ve heard two very different points of view on whether moving applications to the cloud will help or hinder security.

One side of the debate says that moving applications and data to the cloud is an extremely dangerous proposition.  This group contends that putting applications and data in the cloud make it more accessible to the bad guys while assembling data from multiple organizations all in one place.

I absolutely see the point that moving to the cloud has certain risks and could create efficiencies for the bad guys  (attacking one place instead of many). 

My main worry with keeping data and applications out of the cloud is this: Having an individual instance of each organization’s data and applications sitting within each organization’s data center means the security and protection of those data and applications falls to the security employee/team of each organization.  There are now millions of people/teams worldwide with the charter to protect the applications and data of their organizations.  While almost all of these people are brilliant at what they do, I see a nightmare of keeping all of them up to date on best practices, system patches and updates, etc.

Taking the cloud scenario to its extreme, we see a type of efficiency that can be gained.  When many organizations data and applications are all stored in one place, that place will absolutely have to be an expert at protecting that data and those applications, but it seems like it would be easier to protect a lot of things under one protocol than protecting many things, each in their own disparate environs. 

My preference on this point may have something to do with my being  control freak.  When I think of all of the data and applications that need protecting, it’s easier for me to understand how to protect them if they are all in one place.

The debate on security of the cloud is currently raging.  It would be great to hear some other viewpoints on this topic and see where my logic is flawed.