While there are benefits, there are privacy and security concerns too. Data is travelling over the Internet and is stored in remote locations. In addition, cloud providers often serve multiple customers simultaneously. All of this may raise the scale of exposure to possible breaches, both accidental and deliberate. It is needed to ensure that the personal information is appropriate handled [12]. Security concerns may be magnified by the dynamic nature of the cloud environment. One of the cloud key advantages is the speed with which the cloud vendors can adjust, develop and change their offerings. There is a tradeoff between this speed and flexibility requirements and the security level.
Cloud computing poses several data protection risks for cloud customers and providers. In some cases, it may be difficult for the cloud customer (in its role as data controller) to effectively check the data handling practices of the cloud provider and thus to be sure that the data is handled in a lawful way. This problem increases in cases of multiple transfers of data, e.g., between federated clouds.
Privacy, including the need to protect identity information, is a core issue in the success of cloud computing deployment. Many organizations do not feel comfortable storing their data and applications on systems that reside outside of their on-premise data centers. The risk of exposure or unauthorized access of sensitive data increases when workloads migrate to a shared infrastructure.
Concerns have been raised by many that cloud computing may lead to “function creep” — uses of data by cloud providers that were not anticipated when the information was originally collected and for which consent has typically not been obtained. When a request to delete a cloud resource is made, as with most operating systems, this may not result in true wiping of the data. Adequate or timely data deletion may also be impossible (or undesirable from a customer perspective), either because extra copies of data are stored but are not available, or because the disk to be destroyed also stores data from other clients. In the case of multiple tenancies and the reuse of hardware resources, this represents a higher risk to the customer than with dedicated hardware. Given how inexpensive it is to keep data, there is little incentive to remove the information from the cloud and more reasons to find other things to do with it
Cloud service providers must assure their customers and provide a high degree of transparency into their operations and privacy assurance. Privacy-protection mechanisms must be embedded in all security solutions.