Based on several new reports, as well as conversations I’ve had with CIOs recently, the cloud is either a “haven for cybercriminals” as one news service claimed, or cloud security is no different from other networking platforms and fears are overblown. Two extremely opposite views, I’d say. So which is accurate?

I hope I will find some answers at our upcoming Smart Enterprise Exchange event on the topic of cloud security. It will be a great opportunity to meet some of our New York-area members and to hear our expert panelists. But also, I admit that the topic itself is becoming more enigmatic to me.

In many circles, the main knock against public cloud services — that they are too risky for sensitive corporate data — seems to be losing steam. For instance, Joseph Puglisi, a veteran CIO and a co-founder of the Cloud Computing Consortium at Stevens Institute in New Jersey, suggests that large service providers can offer as much — or probably better — security than most businesses can.[Joe also spoke at our conference, read more here.]

Industry publications go even further and claim IT execs can quit worrying, and reputable blogs, like one by Irwin Lazar, VP at Nemertes Research, are practically proclaiming that the issue is resolved. Lazar writes: “By leveraging the positioning of security services outside of your network, you can identify and stop DoS attacks before you feel the impact.”

Can it be that simple?

It seems like only yesterday that IT executives were wringing their hands about the risks cloud models — along with mobile devices and social media — pose for their businesses. Just this week, the NASDAQ stock exchange reported that hackers had tampered with its systems.

Beyond that, risk analysis experts, such as Drew Bartkiewicz, Founder and CEO of CyberRiskPartners, warn that SLAs alone can’t prevent every possible occurrence. “Reliance on the premise that clouds are better at security than their customers does not equate to evaporated financial risk,” he writes in a current article posted on Cloudbook.net.

Meanwhile, industrywide standards and government regulations continue to unfold, including a new U.S. federal standard known as the Federal Risk and Authorization Management Program. FedRAMP was released to supplement the widely used Federal Information Security Management Act (FISMA) requirement for vendors doing business with government agencies. Many experts, including Gartner in this report, have outlined steps to protect data in the cloud.

As usual, I suspect that the cloud security issue is not as black-or-white as some may suggest. I have blogged previously about the complications of IT security, and on this Smart Enterprise Exchange community site last year, experts, such as Nils Puhlmann, co-founder of the Cloud Security Alliance, said that “some of the worries are unfounded.” Yahoo CIO Michael Kirwan also claimed that the biggest risk for his company would be not adopting the cloud at all. And our webcast panel in November debated the topic, as I noted in this blog.

On balance, this assessment seems sound: “Cloud computing has weaknesses, but it also offers the opportunity to aggregate and automate cyberdefense,” according to the Center for Strategic and International Studies. The report, "Cybersecurity Two Years Later," is a follow-up to "Securing Cyberspace for the 44th Presidency," which the group issued in 2008.

Amid all of these conflicting reports, CIOs face a dilemma: They need to act quickly to cut costs, increase agility and provide on-demand services to business users. Therefore, they would like the security “bugaboo” to disappear. “We must push the envelope,” James Williams, CIO at NASA’s Ames Research Center, was quoted as saying recently. His group is developing an Infrastructure-as-a-Service offering for the entire agency. “It’s not so much about making the cloud secure, but about using the cloud to leverage best practices in security across an enterprise,” he said.

Enough said. Maybe it is time to put the debate on hold and let the cloud rollouts begin. Then, each business can decide where to beef up security and where it is “good enough.” Do you agree? Where do you draw the line on cloud security risks? I will report back after our March 1 event, meanwhile, please share your thoughts …

Take the poll here and compare your thinking with your peers.

Entrepreneurs go against the grain to passionately achieve business goals. They take risks and hope to win big. At least that’s the stereotype: Think dot-coms, venture-capital investment firms and garage start-ups.

How, then, is it possible to be entrepreneurial as a CIO — particularly at a major, global enterprise? It’s a question we’re considering here at Smart Enterprise Exchange. My view is that you can be entrepreneurial in any organization, but you’ll be spinning your wheels unless you have a supportive corporate culture and executive backing.

In a January report entitled, “The Business Impact of the Entrepreneurial CIO,” Gartner claimed that the distinctive feature of the entrepreneurial CIO is “the proactive willingness and courage to take the high-level risks also undertaken by the business, to provide new or breakaway competitive advantages that translate directly into revenue, financial results and market share.”

Not very realistic in the current economy, is it? And how does that differ from all of the innovations and business alignment CIOs have focused on for the past decade?

I prefer the more balanced view put forth by Clark G. Gilbert and Matthew J. Eyring in a May Harvard Business Review article, “Beating the Odds When You Launch a New Venture.” To summarize, Gilbert, who is President and CEO of Deseret Digital Media, and Eyring, President of Innosight, a consulting and investment company, say that “despite the popular image of entrepreneurs as risk-loving cowboys, the reality is that great entrepreneurs don't take risks -- they manage them.” These leaders decide which risks to tackle first and which ones to set aside.

We think that Clif Triplett, who became Baker Hughes’ first CIO 18 months ago, is on the right track as an entrepreneurial CIO. Surely, he’s not as free as a solo venture capitalist to follow his dreams and invest in long-shot ideas; he works within business objectives and funding. At the same time, as he explains in our Professional Development article this month, he does have latitude to choose projects, establish partnerships and collaborate inside and outside the firm’s global borders — all with corporate buy-in. In return, he’s accountable to those same corporate executives to demonstrate ROI and generate business revenue.

We’d like to hear about other examples of entrepreneurship by CIOs. Do you operate IT as a business-within-the business — with your own P&L, staff and agenda? What are the risks if your ideas don’t deliver as expected? Is your corporate culture one that accepts failure as the price of innovation? Let us know here or begin a discussion with your peers.

Paula Klein
Editor and Community Manager
Smart Enterprise Exchange