# SMEs' Perception of Cloud Computing: Potential and Security

Reza Sahandi, Adel Alkhalil, Justice Opara-Martins

► To cite this version:

Reza Sahandi, Adel Alkhalil, Justice Opara-Martins. SMEs' Perception of Cloud Computing: Potential and Security. 13th Working Confeence on Virtual Enterpries (PROVE), Oct 2012, Bournemouth, United Kingdom. pp.186-195, 10.1007/978-3-642-32775-9_19. hal-01520466

HAL Id: hal-01520466

https://inria.hal.science/hal-01520466

Submitted on 10 May 2017

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>

Distributed under a Creative Commons Attribution 4.0 International License
# SMEs' Perception of Cloud Computing: Potential and Security

Reza Sahandi¹, Adel Alkhalil², and Justice Opara-Martins³

¹Associate Dean - Head of Creative Technology

²PhD Student, ³Masters Student

School of Design, Engineering & Computing, Bournemouth University, Bournemouth, UK

rsahandi@bournemouth.ac.uk, aalkhalil@bournemouth.ac.uk

**Abstract.** Cloud computing is a new paradigm for emerging technology in the computing and IT industries. Cloud computing offers a new pathway for business agility and supports a faster time to market by offering ready-to-consume cloud-based IT services. SMEs can wisely take advantage of the cloud computing services, without the need for upfront costs. The perception of cloud computing from an SME stance is explored. The potential and concerns surrounding the adoption of cloud computing are discussed. A survey of SMEs conducted in the UK by the authors shows SMEs interests in exploiting the cloud computing services, but there are still some concerns with regards to security and vendor lock-in. This could have affected the speed of cloud computing being adopted.

**Keywords:** Cloud computing security, cloud computing services, SMEs

## 1 Introduction

The dynamic force in the contemporary business market is rapidly eroding competitiveness, thereby causing products and skills to become obsolete [1]. Organisations are under pressure to find and implement new strategic ideas at an even faster pace to gain the competitive edge over their rivals within the global market. In order to increase competitiveness, organisations need to rationalise output to reduce costs, enhance process innovation and incorporate new technologies. Organisations in search of this competitive edge are continually putting pressure on their IT departments to provide new solutions that are deemed to be more flexible, efficient and cost-effective, enabling even faster time to market. This process is often referred to as realising "business agility". A flexible IT infrastructure can remove some of the barriers to global competition and allow smaller businesses to be efficient, competitive and also provide a degree of flexibility. Cloud computing has the potential to play a major role in addressing inefficiencies and make a fundamental contribution to the growth and competitiveness of organisations.

Small and Medium-sized Enterprises (SMEs) play a vital role in the European economy by fostering competitiveness and employment. SMEs are often confronted with difficulties in obtaining capital for the early start-up phases due to their small size [2] which may restrict their access to new technologies or innovations. By adopting cloud computing service models, SMEs will be able to avoid large up-front costs on IT resources for their production needs and business model of innovation.
Much of the research on cloud computing has concentrated on two broad issues: i) business agility and ii) catalysts for more innovation. However, difficulties still exist in deciding on the approach for implementing cloud computing service offerings for SMEs. To assist SMEs to adopt cloud computing services, this study aims to answer the research question: "How do SMEs perceive 'Cloud Computing'?". The findings of this research are expected to assist smaller companies in their adoption of cloud computing services; they may also inform service providers with respect to end-users' concerns. A survey of SMEs was conducted to explore the views and concerns they had for the adoption of cloud computing and results analysed (see section 3). This is followed by some discussion on how to rectify the shortcomings and concerns, particularly in the areas of security and vendor lock-in.

The paper is organized as follows. Section 2 presents the concept of cloud computing in a wider context. Section 3 presents a survey that explored the views and concerns of cloud computing services. Section 4 discusses the main issues hindering cloud computing adoption. The conclusions drawn from the research and survey analysis are presented in Section 5.

## 2 The Concept of Cloud Computing

Cloud computing is an all-embracing and rapidly evolving concept; hence the understanding of cloud computing by SMEs can assist in their approaches for cloud computing services utilisation [3]. The idea behind cloud computing is based on a set of many pre-existing and well researched concepts such as distributed and grid computing and virtualization. Although many of the concepts do not appear to be new, the real innovation of cloud computing lies in the way it provides computing services to customers [4]. The National Institute of Standards and Technology (NIST) has provided a commonly agreed definition of cloud computing that is “a model for enabling convenient, on-demand network access to a shared pool of configurable computing resources that can be rapidly provisioned and released with minimal management effort or service provider interaction” [5].

However, organisations and enterprises are often being confronted by conflicting and exaggerated claims of how cloud computing will dramatically transform their industries. Therefore, it should be mentioned that the marketing hype and meagre analyses from many vendors, IT analysts and users have an impact on the obscurity of the cloud capability and incumbent issues. Nevertheless according to the survey conducted in this paper (see section 3), just over half of the surveyed SMEs (51.5%) claimed to know what cloud computing is, whereas 25.1% were not sure about its term and 23.4% have no knowledge about it. A survey conducted by ACCA [6] also paints a similar picture with just over 50% of respondents saying that SMEs have very limited or no understanding of cloud computing.

In spite of the ambiguity of understanding of the cloud computing concept, industry research giants including Gartner, Forrester and other industry research analysts predicted that a substantial number of the world's top enterprises would have migrated their IT needs to the cloud offerings by 2011 [7]. Moreover, a recent study
conducted by Craig shows that there is an increase of 14% of SMEs in understanding cloud computing [8].

## 3 Cloud Computing From SMEs Perspective (the survey)

The survey attempted to explore the requirements of SMEs and their concerns in respect of cloud computing services. The study investigated the driving factors that encouraged SMEs to move to cloud computing services or hindering their adoption. The methodology employed was based on a quantitative online survey questionnaire approach. The target population consisted of SMEs situated within the United Kingdom. Participants varied between IT decision-makers and managers within their respective business enterprise. The group incorporated participants from organisations of different sizes and from diverse industry sectors. 300 SMEs were invited to participate in the survey. A total of 169 SMEs responded by completing the questionnaire. This gives a satisfactory response rate of 56% for this type of survey where response rates below 15% become questionable [9]. Table 1 provides a socio-demographic profile of the organisations and participates in the survey. The sample was slightly dominated by SMEs sized between 51 to 250 employees.

<table><caption>Table 1 – Socio-Demographic Profile of Participant Organisation</caption><thead><tr><th>Organisation Size</th><th>Percentage</th></tr></thead><tbody><tr><td>1 – 24</td><td>20.5%</td></tr><tr><td>25 – 50</td><td>19.3%</td></tr><tr><td>51 – 250</td><td>41.0%</td></tr><tr><td>More than 250</td><td>19.3%</td></tr><tr><td>Total:</td><td>100%</td></tr></tbody><thead><tr><th>Organization Sector</th><th>Percentage</th></tr></thead><tbody><tr><td>Manufacturing and industrial market</td><td>15.6%</td></tr><tr><td>Financial services</td><td>3.0%</td></tr><tr><td>Public sector & healthcare</td><td>11.6%</td></tr><tr><td>Business sector</td><td>22.3%</td></tr><tr><td>ICT services</td><td>15.0%</td></tr><tr><td>Trading sector</td><td>7.8%</td></tr><tr><td>Other</td><td>24.7%</td></tr><tr><td>Total:</td><td>100%</td></tr></tbody></table>

### 3.1 Why Should SMEs Adopt Cloud Computing Services?

Cloud computing offers a new pathway to business agility and supports a faster time to market by offering ready-to-consume cloud enabled resources such as IT infrastructure as a service, software platforms, and business applications. These services can all be accessed on-demand and provide support to new business requirement far faster than acquiring, installing, configuring and operating IT resources in house [10]. Clearly, this is an attractive proposition to the organisations
where upfront spending for Information and Communication Technology (ICT) is an issue, especially SMEs.

Business agility is the key to commercial success and the current economic downturn has heightened its importance for SMEs. To survive, SMEs need to decrease time-to-market. Therefore, if “the cloud” is used appropriately within an overall IT strategy, it can provide a real competitive advantage, improve business performance and control the cost of IT resources for the organisation [11]. Cloud computing can also provide the IT resources required for a scalable business growth. The cloud is capable of providing a degree of flexibility for IT resources which would allow organisations to adapt to changing demands of their business needs. In addition, the cloud comes with high speed of implementation and ease of upgrading. Cloud services would also eliminate the need for expensive equipments to be located at the company’s site. Furthermore, cloud computing can enable SMEs to focus on innovation and creation of new business, thereby enhancing productivity without requiring frequent updates of IT resources, servers and software licenses.

In order to observe the motivations of SMEs for adopting cloud-based services, the survey raised the question of “what were the reasons behind using cloud computing”. Figure 1 shows the analysis of the reasons that the SMEs provided.

<figure><img src="image_2.png" /><figcaption>Fig. 1: Drivers for Cloud Computing Adoption by UK SMEs.</figcaption></figure>

As can be seen in Figure 1, cost reduction (45.5%), mobility and convenience in accessing applications (44.9%) appear to be the key reasons behind SMEs adopting cloud computing services. This signifies that SMEs find cloud computing a strategic idea for reducing the cost of IT infrastructures and operation. In agreement with this finding, a recent study conducted by Craig [8] concluded that cost reduction is still the top priority for SMEs. The ability for cloud users gaining convenient access from anywhere and at any time were also found to be a key reason for adopting cloud computing. This indicates that SMEs are interested in access to applications and data from anywhere, on-demand, through cloud computing. Therefore, the cloud is
remarkably an ideal IT solution for businesses whose employees require on-demand
remote access to tools and data.

SMEs find ubiquity and flexibility in the cloud fascinating too (38.9%). This indicates the need for innovative solutions that would enable SMEs to gain the competitive advantage over their rivals. Increasing computing capacity and providing greater IT efficiency were also found to be important reasons for using Cloud computing services (32.9%) and (31.7%) respectively.

## 3.2 Concerns for Adopting Cloud Computing

Despite the enormous advantages that the cloud can offer, cloud computing adoption has been at a slower rate from what had been expected [12]. In order to determine which issues mostly affect the adoption of cloud computing, the study further explored SMEs' concerns of cloud-based services. Figure 2 illustrates issues raised by participants hindering the cloud computing adoption rate. Security and vender lock-in were raised by SMEs as their major concerns. Moreover, SMEs have also shown concern of other aspects regarding the adoption of cloud computing. These concerns were not found as significant as security and vender lock-in; therefore they are not included in the discussion.

Figure 2 shows that 54.6% (the second largest percentage response to any question asked in the research) of the surveyed SMEs indicated data protection and privacy as the number one reason for not considering cloud-based IT as a service. In contrast to the traditional provision of onsite IT resources, the multi-tenant nature of cloud computing usually raises the question in respect of privacy, confidentiality and data integrity. Cloud computing presents its own set of security issues coupled with the risk and threats inherent in traditional IT computing. The fact that consumers can tap into cloud services using Web browsers, shows the benefits of mobility and convenience on the one hand, but on the other, it has raised issues concerning data privacy and security

Moreover, about half of the surveyed SMEs consider vender lock-in as a major concern for adopting cloud computing. Cloud computing users are concerned about losing control of their data that could be locked-in by a cloud provider. Although the cloud providers implement up-to-time and a secure IT infrastructure; consumers continue suffering from the loss of control and lack of trust problems [13]. To further substantiate on this matter in agreement with StarUK [14], "for many people, the issue is one of control: many IT managers believe that if something is not under their direct oversight, then they cannot know if it is secure until it has been compromised: which is sometimes the hallmark of a put upon, reactive, service-based culture". The subsequent section provides further considerations with respect to these key issues.
<figure><img src="image_3.png" /><figcaption>Fig. 2: Barriers to Cloud Computing Adoption in UK</figcaption></figure>

# 4. Discussion of the Main Issues

## 4.1 Security and Data Privacy

Security and data privacy are often presented as the key risks when outsourcing IT services that may include critical data. These risks have made data privacy and security the main issues delaying cloud computing adoption [15]. The fact that before data can get into the cloud, it has to progress outside a company's firewall via an access network and can be prone to attacks. For example, the most common way of accessing the cloud is through a web browser. Therefore, cloud services may share much vulnerability as any website, such as SQL injection or cross-site scripting (XSS) [16]. The cloud also relies on virtual machines (VMs), which mean any compromises in the set up of the software used could cause unauthorised access to sensitive data.

Normally, cloud computing providers have multiple data centres at different geographical locations in order to optimally serve consumers' needs around the world. In most cloud service scenarios, consumers have no idea of where there data is stored. Therefore, legal and regulatory issues arise which require careful consideration because the physical location of data centres determines the set of laws that can govern the management of data.
Cloud computing comprises of different deployment models, nevertheless each service comes with its own security issues. Thus, to guarantee the security of corporate data in the cloud is difficult, if not impossible [17]. In Infrastructure as a Service (IaaS) model, for example, the security responsibility of the underlying infrastructure and abstraction layers belong to the cloud service provider, while the remainder of the stack is the consumer's responsibility. Organisations, before moving applications outside their corporate firewalls, should be aware of the data intrusion risks associated with such an environment. IaaS cloud models are prone to attacks like XML Signature Element Wrapping [18] – this is a well-known attack on protocols using XML Signature such as SOAP (that stands for Simple Object Access Protocol) messages. These protocols are used to provide authentication for messaging through the web.

With Platform as a Service (PaaS) model, the security of the platform used for development is the service provider's responsibility, but the security of the applications developed is the responsibility of the consumers. Concerns about cloud service integrity and binding issues with PaaS' cloud models should be given further consideration. PaaS models are prone to cloud malware injection attacks and metadata spoofing attack as described by Jensen [19].

In Software-as-a-Service (SaaS) model, the service provider is responsible for, not only providing physical and environmental security capabilities, but also addresses the security control on the infrastructure, applications and data. According to a Forrester research, security concerns are the most commonly cited reason why enterprises are not interested in SaaS [20]. A major concern of SaaS is unauthorised access due to data being transferred to a remote server thought the internet. This might allow adversaries to obtain passwords, inspect data, and modify or damage the data. This would be more harmful in case of unauthorised access to sensitive information such as payments details and information on human resources. Denial of service attacks and network failure present the availability concern of SaaS.

There are a number of security measures which can be developed and implemented to tackle the above security issues. For example, implementing a robust authentication mechanism, encrypted protocols, secure backup applications and secure physical resources could improve security. Access control can be enhanced by incorporating security measures to the network layers. Web Services Security (WSS) is a security technique that can be incorporated to SOAP messages to assure the integrity and confidentiality by signing and encrypting their context [21]. The confidentiality and integrity can also be improved by incorporating cryptographic protocols such as (TLS) Transport Layer Security, and (SSL) Secure Socket Layer to the transport layer. Moreover, it is highly recommended that cloud providers protect the integrity of consumers' data by complying with relevant standards including Payment Card Industry – Data Security Standards [22]. In [23] it is also recommended to adopt the standards for identifying and accessing management such as SPML, SAML, OAuth, and XACML. These standards could increase the security of the identity federation among different cloud platforms. Securing the VMs is critically important to avoid unauthorised access, so it is vital to consider security practices that may include enabling perimeter defence on VMs. Other security practises maybe considered such as implementing file integrity checks and maintaining backups. On the other hand, SMEs should ensure the security aspects of
their side that include firewall configurations, reliable and high bandwidth internet connections, and upgrading their software.

## 4.2 Vendor Lock-In

The lack of standards in cloud computing may raise interoperability and manageability issues inside and between cloud providers, with possible economic impacts. Interoperability is concerned with the migration and integration of applications and data between different vendor's clouds. Whereas standardisation strives to support applications by different service vendors to interoperate with one another, exchange traffic and cooperatively interact with data, as well as protocols, for joint coordination and control [24].

In the absence of standardisation, SMEs willing to outsource and combine the range of services from different cloud providers to achieve maximum efficiency, will experience difficulty when trying to get their in-house (legacy) systems to interact with the cloud providers system. Likewise, the lack of standardization may also bring disadvantages, when migration, integration, or exchanges of resources are required. The main negative aspect is the necessity of factoring applications to comply with other cloud Application Programming Interfaces (APIs), which can possibly lead to higher costs, delays and risks, thus opposing agility, efficiency, and low costs [25]. In the aforementioned, reconfiguration of systems and applications to achieve interoperability are time consuming and thus, require a considerable amount of expertise, which could be challenging for SMEs. Further, interoperability and portability will give rise to standard reusability, which in turn will lead to faster cloud deployment [26].

# 5 Conclusion

The concept of cloud computing was briefly discussed. A survey of 300 SMEs showed their motivations and concerns for adopting cloud computing services. The results of the survey show that SMEs are highly interested in cloud computing enabling them to reduce costs, improve accessibility, flexibility and scalability. These benefits are seen by SMEs as key driving factors in adopting cloud computing services. However, the rapid increase in corporate data, placed in the cloud, has raised issues concerning security, vendor lock-in, and complications with data privacy and data protection. Consequently, this resulted in the slow growth of cloud computing adoption.

In order to convince more SMEs to migrate their systems to the cloud, these issues need to be addressed. The privacy challenge for cloud-based software architects demands the design of a service were security risks are reduced, whilst ensuring legal compliance. In other words, safety of data should be placed at the front and in the centre of the design process of any cloud service. Security can be enhanced by developing existing security measures such as perimeter defence on VMs, data encryption, backups, incorporating cryptographic protocols such as TLS, SSL, and WSS. Furthermore, implementing a standardised framework for cloud services will
support seamless cloud service integration between different vendor platforms. This
would allow cloud users to switch from one provider to another.

Cloud computing is still a new technological venture for SMEs, but it takes good
business sense and appropriate steps to fully reap its benefits. Whenever security, data
privacy, interpretability, and portability standards ameliorate, cloud computing
adoption will proliferate.

6 References

1. Pauly, M.: T-Systems Cloud-Based Solutions for Business Applications, In: Cloud Computing: Principles and Paradigms. (eds R. Buyya, J. Broberg and A. Goscinski), John Wiley & Sons, Inc., Hoboken, NJ, USA (2011)

2. European Commission: The New SME Definition: User Guide and Model Declaration. Available online at: http://ec.europa.eu/enterprise/policies/sme/files/sme_definition/sme_user_guide_e n.pdf (2005). Accessed on 1/5/2012

3. David, W.C.:Cloud computing Key Initiative Overview. Available online at: http://www.gartner.com/it/initiatives/pdf/KeyInitiativeOverview_CloudComputing .pdf (2010). Accessed on 1/5/2012

4. Leimeister, S., Christoph, R., Markus,B., Helmut,K.: The Business Perspective of Cloud Computing: Actors, Roles and Value Networks. European Conference on Information Systems (2010)

5. Mell,P., Grance,T.: The NIST Definition of Cloud Computing. Available online at: http://csrc.nist.gov/publications/nistpubs/800-145/SP800-145.pdf (2011). Accessed on 1/5/2012

6. Association of Chartered Certified Accountants, ACCA: A Digital agenda for European SMEs. Available online at: http://www.acca.co.uk/pubs/general/activities/library/small_business/sb_pubs/pol- afb-adaf.pdf (2011). Accessed on 1/5/2012

7. Mohan, T. S.: Migrating into a Cloud, in Cloud Computing: Principles and Paradigms. (eds R. Buyya, J. Broberg and A. Goscinski), John Wiley & Sons, Inc., Hoboken, NJ, USA (2011)

8. Craig, D.: How Are SMBs Viewing the Cloud? Available online at: http://www.constructioncloudcomputing.com/2012/02/16/how-are-smbs-viewing-the-cloud/ (2012). Accessed on 1/5/2012

9. Perry, C., Cavaye,A., Coote,L.: Technical and social bonds within business-to-business relationships. Journal of Business & Industrial Marketing, Vol. 17 Iss: 1, pp.75-88 (2002)

10. Lozano,B., Marks, A.E.: Executive's Guide to Cloud Computing. John Wiley & Sons (2010)

11. Brookbanks, M.: More Clouds Coming. IT Now Magazine, pp.16-19 (2010)

12. GoGrid, :Cloud computing adoption slower than expected. Available online at: http://www.gogrid.com/news/2012/02/22/cloud-computing-adoption-slower-than-expected (2012). Accessed on 1/5/2012

13. Almorsy M., Grundy, J., Ibrahim, A.: Collaboration-Based Cloud Computing Security Management Framework. IEEE 4th International Conference on Cloud Computing (2011)
14. Star UK:Can Cloud Computing give you the freedom to be more strategic? – UK businesses' attitudes to Cloud Computing revealed. White paper. Available online at: http://www.montal.com/newsletters/Jan10/STAR_041209.pdf (2009). Accessed on 1/5/2012

15. Sabahi, F.: Cloud Computing Security Threats and Responses. Available online at: http://ieeexplore.ieee.org/stamp/stamp.jsp?arnumber=06014715 (2011). Accessed on 1/5/2012

16. Devine, S.D.: Flying too Close to the Sun Can be a Risky Business. Business Technology E-Magazine, Available online at: http://www.lyonsdown.co.uk/publications/2011/infosec.pdf (2011). Accessed on 1/5/2012

17. Kandukuri, B.R, Paturi, V.R., Rakshit, A.: Cloud Security Issues. In: IEEE International Conference on Services Computing, pp. 517-20 (2009)

18. McIntosh, M., Austel, P.: XML Signature Element Wrapping Attacks and Countermeasures. In SWS '05: Preceedings of the 2005 Workshop on Secure Web Services. ACM Press, pp. 20-27 (2005)

19. Jensen, M., Gruschka, N., Iacono, L.: On Technical Security Issues in Cloud Computing. IEEE International Conference on Cloud Computing, pp. 109-116 (2009)

20. Forrester Research: Top Corporate Software Priority Is Modernizing Legacy Applications. Press release (2009)

21. National institute of Standards and technology: Guide to secure web services. Available online at: http://csrc.nist.gov/publications/nistpubs/800-95/SP800-95.pdf (2007). Accessed on 1/5/2012

22. Jansen, W., Grance, T.: Guidelines on Security and Privacy in Public Cloud Computing. NIST Draft Special Publication 800-144 (2011)

23. Al Morsy, M., Grundy, J., Müller, I.: An Analysis of The Cloud Computing Security Problem. In Proceedings of APSEC 2010 Cloud Workshop, Sydney, Australia (2010)

24. Yoo, C.S.: Cloud Computing: Architectural and Policy Implications. Prepared for the October 22, '10 Conference on Antitrust and Dynamics of Competition in "New Economy" Industries, Available online at: http://techpolicyinstitute.org/files/yoo%20architectural_and_policy Implications.p df (2010). Accessed on 1/5/2012

25. Machado, G.S., Hausheer, D., Stiller, B.: Considerations on the Interoperability of and between Cloud Computing Standards. Available online at: http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.155.51 (2009). Accessed on 1/5/2012

26. Craig, D.: constructing cloud computing. Available online at: http://www.constructioncloudcomputing.com/2010/08/25/can-we-talk-interoperability-and-portability-hold-the-keys/ (2010). Accessed on 1/5/2012