Opinions vary on whether cloud databases are more or less secure than in-house hosted databases. Some experts claim that cloud databases from reputable vendors such as Microsoft, Amazon, and Oracle are far more secure than in-house hosted ones. Others claim that the risk of mismanagement by a cloud vendor is too high; organizations should store critical and confidential data only in-house.

Take a position on this issue by answering three of the following questions:

1. Search the Internet for ISO 27001. Explain the purpose of this standard.
2. Does compliance with ISO 27001 mean that a data center is secure? Does it mean that no security threat against compliant data centers will be successful? What does it mean?
3. Search the Internet for evidence that Microsoft Azure complies with ISO 27001. Summarize your findings.
4. Search the Internet for evidence that Amazon's EC2 complies with ISO 27001. Summarize your findings.
5. SAS 70 is an auditing standard that provides guidance for an auditor issuing a report about internal controls implemented by a cloud services provider. To assess the adequacy of data center controls, it is necessary to read and analyze the report that was prepared in accordance with SAS 70. Search the Internet for evidence that Microsoft's auditors have issued a report in accordance with SAS 70. Summarize your findings.
6. Search the Internet for evidence that Amazon's auditors have issued a report in accordance with SAS 70. Summarize your findings.
7. Compare and contrast your answers to questions 3/4 and 5/6. Does your comparison cause you to believe that there are significant differences with regard to security and control between Azure and EC2?
8. Many small businesses operate with local servers running in broom closets or the like. Explain what using a cloud vendor that is compliant with these standards and statements means to such companies.
9. Suppose a publicly traded large organization operates its own Web farm and has certifications indicating that it has complied with ISO 27001 and has issued a statement of controls in accordance with SAS 70 that indicates controls are at least adequate. Is there any reason to believe that the organization's data assets on that Web farm are more or less secure than they would be if stored in Azure or EC2? Explain your answer.
10. Based on your answers to these questions, create a general statement as to the desirability, considering only data security, of storing data on Azure and EC2 as compared with storing it on servers managed in-house.