Gartner Blog Network

Unknown unknowns in the Cloud

by Jay Heiser  |  April 8, 2014  |  5 Comments

Its too bad that Dick Cheney’s awkward little epistemological speech has been so thoroughly politicized, turning an important risk management principle into an opportunity for derision.  Intelligence analysts, and IT analysts, need to be acutely aware of the limits of their knowledge, especially when making decisions about the how to take advantage of public cloud services.

Anybody making risk decisions about public clouds needs a strong understanding of the degree to which they can trust the information they have about those services.  To apply this particular Theory of Knowledge principle to Public Cloud Services:

1) Known Knowns: If data is encrypted before it is uploaded, we know that it is encrypted.  If the data is not encrypted, we know that it can be read by anyone who accesses it, which leads to the second category.

2) Known Unknows: If our clear text data is in someone else’s site, we know that it is vulnerable.  What we cannot ever know for certain is whether an unauthorized person takes advantage of that vulnerability.  Its a level of ambiguity, but an understood one.

3) Unknown Unknowns: If there were some sort of vulnerability that we had never conceived of, it would be in this final categority. The fact that you haven’t even thought it might exist, means that you don’t know what to look for to ensure that it is controlled.  An example might be a cloud service provider that exposes your email boxes to external surveillance in order to conduct load balancing and facilitate service continuity.

In retrospect, if a cloud service provider claims to be spreading your data across multiple locations (which virtually all of them do), before storing your data in that service, it would make sense to ask them what mechanism they use to transmit your data between those locations, and how they protect it in transit.  I see a lot of cloud service provider questionnaires, but I don’t ever remember this particular issue coming up.

An example has recently come to light of an ongoing confidentiality failure involving a CSP copying customer data between their data centers.  For many cloud buyers the news of this unexpected form of exposure has moved this particular risk from category 3, into category 2. Now we all know that we don’t know how our data is protected when it is being replicated between CSP data centers.

We can only hope that not every virtual backend is flapping open in a packet storm.

Category: cloud-computing  it-governance  risk-management  security  

Jay Heiser
Research VP
6 years at Gartner
24 years IT industry

Jay Heiser is a research vice president specializing in the areas of IT risk management and compliance, security policy and organization, forensics, and investigation. Current research areas include cloud and SaaS computing risk and control, technologies and processes for the secure sharing of data… Read Full Bio

Thoughts on Unknown unknowns in the Cloud

  1. French Caldwell says:

    Jay — Cheney has been more quoted on that principle than any risk manager ever. Don’t let your politics get in the way of giving the man some credit.

  2. Michael de la Torre says:

    The quote was not from Dick Cheney, but from Donald Rumsfeld who made the speech.

Comments are closed

Comments or opinions expressed on this blog are those of the individual contributors only, and do not necessarily represent the views of Gartner, Inc. or its management. Readers may copy and redistribute blog postings on other blogs, or otherwise for private, non-commercial or journalistic purposes, with attribution to Gartner. This content may not be used for any other purposes in any other formats or media. The content on this blog is provided on an "as-is" basis. Gartner shall not be liable for any damages whatsoever arising out of the content or use of this blog.