New EU Agency Report on Governmental Cloud Computing Security in EU

BRUSSELS and HERAKLION, Greece, January 17, 2011 - The EU's 'cyber security' Agency ENISA has launched a new report on
Govermental Cloud Computing. The report is targeted at senior managers of
public bodies who have to make a security and resilience decision about how
to 'go cloud', if at all. The main goal of the report is to support
governmental bodies in taking informed risk based decisions regarding
security of data, resilience of service and legal compliance on their way to
the cloud. It highlights also security and resilience pros and cons of
community, private and public cloud computing services for public bodies.

"The new report presents a decision-making model for senior management to
determine the best cloud solution from a security and resilience point of
view", says Mr. Daniele Catteddu, author of the report. The report details
and explains the different steps of the decision-making model, and applies
the model to four sample services (electronic healthcare services, electronic
administrative procedures, email, and human resources applications). Analysis
and conclusions are mainly based on three scenarios, which describe the
migration to cloud computing of a Healthcare Authority, a local public
administration and the creation of governmental cloud infrastructure.

The Agency concludes that private and community clouds appear to be the
solutions that best fit the needs of public administrations if they need to
achieve the highest level of data governance. If a private or community cloud
infrastructure does not reach the necessary critical mass, most of the
resilience and security benefits of the cloud model will not be realised.

The Executive Director Prof. Udo Helmbrecht comments: "Public cloud
offers a very high level of service availability, and is the most
cost-effective. Yet, currently its adoption should be limited to
non-sensitive or non critical applications, in the context of a well-defined
cloud adaptation strategy with a clear exit strategy."

The report makes several recommendations to governments and public
bodies, including:

    - National governments and the EU institutions should investigate the
    concept of an EU Governmental cloud.

    - Cloud computing will soon serve a significant portion of EU citizens,
    SMEs and public administrations. National governments should thus
    prepare a cloud computing strategy and study the role that cloud
    computing will play for critical information infrastructure protection
    (CIIP).

    - A national cloud computing strategy should address the effects of
    national/supra-national interoperability and interdependencies, cascading
    failures, and include cloud providers into the reporting schemes of
    articles 4 and 13 of the new Telecom Framework Directive (
    europa.eu/legislation_summaries/internal_market/single_market_services/l24216a_en.htm).

Read the full report and all recommendations:
www.enisa.europa.eu/act/rm/emerging-and-future-risk/deliverables/security-and-resilience-in-governmental-clouds/

(Due to the length of these URLs, it may be necessary to copy and paste
these hyperlinks into your Internet browser's URL address field. Remove the
space if one exists.)

The original and valid version of this release is the English.
Translations are for the purpose of media distribution only, the English
takes precedence over them in every detail.

For interviews: Ulf Bergstrom, Spokesman, ENISA, press at enisa.europa.eu,
Mobile: +30-6948-460143, or for further information on the report: Daniele
Catteddu, Expert, daniele.catteddu at enisa.europa.eu