Trust in Cloud Computing: Pro and Contra from the User’s Point of View

2.1 What is Cloud Computing?

According to the widely adopted definition of the US National Institute of Standards and Technology, there are five essential characteristics of cloud computing (Mell and Grance 2011):

On-demand self-service: Consumers can provision capabilities without human interaction with the provider of the resources (e. g. networks, server time, storage, etc.).

Broad network access: These resources can be accessed over a broadband network (usually via the Internet) using a wide range of end devices.

Resource pooling: The resources are available in a server pool to serve a number of consumers (multi-tenant model). The consumer has no influence on the physical and virtual resources used or their location.

Rapid elasticity: The resources can be adapted in accordance with the demand. Such scaling up or down is usually rapid and automatic, without the consumer having to do anything. The resources therefore appear to be unlimited, i. e. they can be acquired to any quantity at any time.

Measured service: The cloud systems control and optimise their performance by measuring the use. The monitoring, control and protocolling provides transparency for providers and customers about the extent to which the service is used and the costs incurred.

2.2 Actor Constellations in the Cloud

Rather than coming from a single provider as a package, a cloud solution is frequently supplied by a series of different actors (Buyya et al. 2009; Habib et al. 2012; Heininger et al. 2012; Walterbusch and Teuteberg 2012). At the same time, when it comes to reaching a decision on whether to use cloud services it is possible to distinguish between various user groups and user perspectives – depending on the level and field of application (see Table 1).

On the consumer side, two actor relationships can be distinguished. The ‘Business Cloud’ offers “Business-to-Business” (B2B) services (Armbrust et al. 2009). For the private consumers, cloud services are provided as “Business-to-Consumer” (B2C) services, and this cloud model is called the Consumer Cloud (Hu et al. 2010).

2.3 Service Levels in the Cloud

Three service levels are distinguished for the Cloud (Mell and Grance 2011; see Figure 1):

Infrastructure as a Service (IaaS): Basic resources such as computer processing and storage are provided, together with the necessary network infrastructure. Customers choose what they need, but are then responsible for its operation (e. g. Amazon Elastic Compute Cloud, EC2).

Platform as a Service (PaaS): Resources are provided for the production of applications and software products, e. g. development tools, programming interfaces, and operating systems. Since users are free from administering the underlying infrastructure they can concentrate fully on their development tasks (e. g. Google App Engine).

Software as a Service (SaaS): An environment is provided to implement software or an application in the cloud. The necessary infrastructure is provided and the programs run “in the cloud”, usually accessed via a browser (e. g. Microsoft Office 365).

The three service levels are hierarchically arranged, and the resources at a higher level include the resources of the lower levels.

Private consumers mostly use SaaS-solutions, e. g. cloud storage services (own Cloud, Dropbox) or software packages made available via the browser (Hu et al. 2010; Ion et al. 2011). IaaS or PaaS solutions can only be used by private consumers with specialist knowledge. However, if businesses move their customer-related information and communications technology into the cloud (B2B model for customer services), then customers can be indirectly affected by the processing of their data in the cloud without being aware of this (Chow 2009).

2.4 Deployment Models in the Cloud

Apart from the service levels, it is possible to distinguish between three basic deployment models (see Figure 1).

Public Cloud: Public clouds make infrastructure and resources publicly accessible via the Internet.

Private Cloud: A Private Cloud is only accessible within an existing organisational structure (e. g. company network, Intranet). A further distinction is made between a self-administered data centre (corporate cloud), a consumer data centre that is administered by the provider (managed cloud), and an external data centre administered by the provider (outsourced cloud).

Hybrid cloud: A hybrid cloud offers a combination of the other two models. Some services are publicly available, while others are private.

Taken together, the definition, the service levels, the deployment models, and actors can be presented in a general, descriptive model of cloud computing (Figure 1). The model includes the essential defining elements (virtualisation, scalability, device independence). The levels and deployment models are independent from one another. Dependencies exist solely between the actors and the demands they place on the levels and deployment models. In the following, the possible benefits and risks for cloud users are considered.

3.1 Prospects for Businesses

The literature on cloud computing has increasingly concentrated on the potential benefits for businesses who are using cloud sourcing for their IT activities (cf. Armbrust et al. 2009). Organisations and companies benefit in different degrees from the advantages offered by the cloud. The consumers of cloud computing have only low start-up costs, if any, in contrast to the investments otherwise required in IT infrastructure. In the case of SaaS, a more powerful, flexible and maintenance-friendly environment is achieved for software, which promotes more rapid software releases (Repschläger et al. 2010).

The core business of many providers of cloud services is not cloud computing itself but some other IT business which requires immense resources in order to cope with short term spikes in demand. Apart from such spikes only about 5 to 20 % of these resources are needed (Armbrust et al. 2009). The remaining unused IT resources are exploited to offer cloud services to other businesses and users in order to generate further incomes (Fehling, 2014).

3.2 Prospects of the Users

In particular with SaaS, users are able to adapt software and services flexibly to their needs and requirements. Empirical results show that the easy access to these services via network resources on a variety of end devices has considerable influence on the decision to use a cloud service. The greater the flexibility of access to data in the cloud is perceived to be, then the more positive is the attitude to the services and the more likely it is that these services will be used (Bhattacherjee and Park 2014; Park and Ryoo 2013; Park and Kim 2014). An additional incentive lies in the support for cooperation with other users and systems. If users view the possibility of exchanging data with others in the cloud positively, then they will also assess the cloud service more positively (Park and Ryoo 2013). And when users see potential for increased performance or efficiency and hope for support from the functionalities of the cloud service, then they use the system more frequently and intensively (Backhaus and Brandenburg 2014; Behrend et al. 2011; Bhattacherjee and Park 2013; Optiz et al. 2012; Gangwar et al. 2015; Park and Kim 2014; Wu 2011a). Other studies report a relationship between ease of use or usability and the use of cloud services (Behrend et al. 2011; Gangwar et al. 2015; Opitz et al. 2012; Wu 2011): If a cloud service can be used easily, quickly and intuitively, it will be appreciated more and used more frequently.

4.1 Interpersonal Trust

Our daily life is characterised by uncertain and risky interactions with other people and institutions. The future behaviour of interaction partners cannot be foreseen with certainty and there is a possibility that the behaviour of one partner will be to the disadvantage of the other. In order to make cooperation possible, one party (the trustor) may decide to act on the basis of trust in the other (the trustee). Trust then reduces the uncertainty and complexity of the situation (Luhmann 1968) and makes it possible to act without prior information about future events (cf. James 2002).

Trust is seen as the behavioural willingness of the trustor to make himself vulnerable to the actions of the trustee (Mayer et al. 1995). This willingness is based on the expectation or the subjective conviction that the trustee will act reliably and in a socially acceptable way (Kumar 1995, Zucker 1986, Luhmann 1968). The trustor has no way of influencing the behaviour of the trustee (Whitener et al. 1998), and enters voluntarily into a situation in which the damage incurred if the trustee exploits the vulnerability is greater than the potential benefit to the trustor (Dasgupta 1988).

The decision to exercise trust depends on the assessed risk (extent and probability of the potential damage) and the perceived trustworthiness of the trustee (Mayer et al. 1995). If the risk is high and / or the trustworthiness low then the willingness to extend trust is markedly lower than in a situation with less risk and a trustee who is perceived to be more trustworthy.

In most cases, the trustworthiness is based on perceived attributes of the trustee, known to the trustor as a result of previous interactions or through information from third parties. Such attributes include benevolence, integrity, and the ability to satisfy the expectations of the trustor (Mayer et al. 1995; Mayer and Davis 1999; Jarvenpaa et al. 1998, see Figure 2). Perceived benevolence relates to whether the behaviour of the trustee is oriented solely towards their own interests or also takes the interests of the trustor into consideration. Perceived integrity describes the extent to which the behaviour of the trustee draws on values and norms which the trustor regards as good and proper. Perceived ability represents the extent to which the trustee is felt to have the requisite skills and experience.

Figure 2

User trust in the cloud.

In many situations, behaviour which seems to be based on trust and an assessment of trustworthiness does in fact follow other rules. On the one hand, a trustor may not be aware of the risks involved, or may have a false impression of them. In this case, he is not acting on the basis of trust but on the basis of ignorance. On the other hand, there may be situations in which control mechanisms remove the uncertainty and risk for the trustor (e. g. by a contract). In this case, trust is no longer necessary because of the situational control or due to impending juridical consequences.

4.2 Trust in the Cloud Provider

Interpersonal trust can also be applied to the relationships between cloud providers and customers (Söllner et al. 2011). Users cannot fully monitor the actions of a cloud provider, because they have neither the necessary expertise nor the time for this (Buch et al. 2014). They therefore enter into a risky dependency and by using the cloud they increase their vulnerability (Simpson 2014). Furthermore, the provider will in most cases be pursuing commercial goals. This influences the perception of benevolence and integrity (perceived trustworthiness, see 4.1). The concept of trust must be slightly amended to take this into account. Users trust a cloud provider if they perceive him as trustworthy and therefore regard the risk to be acceptable (cf. Buch et al. 2014). Users act on the basis of their subjective conviction that the provider of the cloud service will help them to achieve their objective and will not exploit their vulnerability or act solely on the basis of economic goals (Söllner et al. 2012).

4.3 Trust in the Cloud

With regard to the cloud itself, the idea of perceived trustworthiness seems to be inappropriate, because a technical system cannot display benevolence or integrity. Technologies do not have a will of their own, or motives or intentions (Beldad et al. 2010; Friedman et al. 2000; Lee and See 2004). Research on trust in automation (Lee and See 2004) proposes other dimensions to describe the trustworthiness of technologies (cf. Söllner et al. 2012; Lee and See 2004, cf. Figure 2), namely process, performance, and purpose. The process of a system describes the extent to which the user is able to understand which structures and processes are involved in the operation of the system and how these interact (analogous to the integrity concept). The performance of the system relates to the support which a user feels that the system is able to provide (analogous to the ability to achieve specific goals). This also includes aspects such as reliability and predictability of the system. Purpose covers the reason for the development of the system (analogous to benevolence), and whether the user is clear about the aims and intentions of the system developer.

In the case of the cloud, the performance and the process transparency are of considerable importance. Performance refers to the robustness of the cloud and the reliability of the underlying infrastructure. Process transparency with regard to the cloud refers to clarity and an understanding of the technical and organisational processes behind the service.

4.4 User Characteristics: Generalised Trust and System Trust

Willingness to extend trust is situationally-dependent, but at the same time is also a personality trait (Schulz et al. 2009). A distinction must therefore be made between specific trust and generalised trust (cf. Mayer et al. 1995; McKnight and Chervany 2002). Generalised trust is influenced by an individual’s own culture and their personal experience, so that people in the extent to which they extend trust to other people or things (Cheung and Lee 2006). Together with further contextual factors, generalised trust influences the specific trust in a given situation (see Figure 2). Whether an individual trusts the cloud therefore depends on their personal experience and the generalised trust.

Another aspect is the system trust, which can be located between the generalised trust as a disposition and the context-specific trust (cf. Schulz et al. 2009). System trust describes the trust in systems which are relevant over and beyond a specific situation. For example, the Internet is a system which is equally important for a variety of trust situations relating to the cloud. Since most cloud services are provided via the Internet, this is also an object of trust that must be taken into consideration (see Figure 2). Many users state that they do not trust the cloud because they are generally mistrustful of the Internet (Eggert et al. 2014).

5.1 Threats to Security and Data Protection

With cloud computing, data is no longer stored locally by the service provider but at a location unknown to the user. Users of these services are vulnerable if the provider accesses their data and passes these on to others (Cavoukian 2008). Therefore, they must rely on the provider handling their data confidentially, respecting their private sphere, and ensuring adequate protection against unwanted access. The threat involved in using the cloud also increases in comparison with local processing simply as a result of the number of additional technical systems that must be made available in order to implement the cloud service (Ghosh and Arce 2010). Each individual sub-system of the service has its own security gaps and hazards which accumulate for the entire system. In comparison with locally stored software, the risk of attack increases for a mobile application, e. g. as a result of the use of (wireless) network connections and via the server hosting the application. Particularly in the case of Web applications (SaaS) security gaps in the Web browser can allow hackers access to data (Hashizume et al. 2013).

Cloud interfaces are also susceptible to unauthorised access. Depending on the service that is provided, various interfaces are needed, for example for resource control in the case of IaaS, programming interfaces for PaaS, or user interfaces (e. g. for an SaaS application). Such interfaces are vulnerable and may be assaulted by hackers.

In many cloud environments, the customers must authorise themselves via a user account and log in. These accounts are also frequently the target for attacks (Gonzalez et al. 2012).

In addition, synchronising and processing the data also involves transferring considerable amounts of data, which provides opportunities for various types of attack (sniffing, spoofing, Man-in-the-Middle attacks, side-channel attacks; cf. Soares et al. 2014).

For all these reasons, users must be able to rely on the security standards of the provider, usually without having much expertise in this field (Buch et al. 2014).

The large, flexible resource pools mean that many different users are accessing the same physical resources. Here it is necessary to ensure that these resources cannot be decoded by other users (Cachin and Schunter 2011). This risk is increased by de-duplication. In order to minimise storage requirements, duplicate data, i. e. data which is used by many users, is only stored once (Cachin and Schunter 2011).

Expert surveys (e. g. Uusitalo et al. 2010), qualitative user surveys (e. g. Eggert et al. 2014) and also larger opinion polls (e. g. Meske et al. 2014) show that a lack of security and inadequate data protection is one of the most important constraints on decisions to use cloud services. Thus a perceived lack of security influences the willingness to make active use of an SaaS cloud service (Backhaus and Brandenburg 2014; Bhattercherjee and Park 2013; Behrend et al. 2011; Wu 2011a; Wu 2011b). Users and non-users of cloud services are similar in their assessment of privacy and data security in cloud computing and fear unauthorised access and data theft by third parties and also data misuse by the provider (Eggert et al. 2014). Park and Kim (2014) found in a survey study that if the user of cloud services has a poor opinion of the security this not only leads to a negative attitude towards the cloud service and the provider, but also results in a drastically worse perception of the overall quality of the cloud service. Furthermore, if the user has a poor assessment of the security this also has a negative influence on their assessment of the usefulness and practicality of the cloud service (Shin 2014).

5.2 Availability and Reliability

Availability and reliability are important indicators for the trustworthiness of a service (cf. Performance, 4.2). The provider should ensure that the service is permanently accessible and that the resources are available round the clock – even in the event or maintenance and repair work or unexpected events, such as natural catastrophes or power blackouts. Empirical findings show that the perceived availability and reliability have a strong influence on the assessment of usefulness, and thus on the willingness to use a cloud service (Shin 2014). In a survey, a third of all non-users of the cloud data storage services said that they were too worried about losing data (Meske et al. 2014).

5.3 Insufficient Transparency

The wide variety of models, service levels and actors mean that the underlying architectures and the structure of the cloud service are often obscured. The user will hardly be able to make out who is involved in providing which resources for the cloud service.

6.1 Social Influences

In many situations, it is possible to observe a paradoxical situation in which users say that they do not trust a certain service, e. g. because they find the data protection and security inadequate, but then use this service nevertheless (cf. Norberg et al. 2007). For example, many students at German universities use Dropbox, which is one of the most favourite services in Germany (cf. Meske et al. 2014) or worldwide (cf. Hunsinger and Corley 2012). At the same time, this service often has outages and data protection problems (Caching and Schunter 2011). A closer examination of the factors influencing the use of Dropbox shows that in addition to its perceived convenience, the use of the service is also influenced by friends, family, and colleagues (Backhaus and Brandenburg 2014). People use Dropbox more frequently and more intensively if influential individuals in their environment expect or demand this. Similarly, other studies have shown that the media presence of cloud computing makes the use without trust more likely (Wu 2011a; Wu 2011b). However, many providers still mistakenly believe that they can interpret the behaviour of their users as a demonstration of trust in their services.

6.2 Lack of Knowledge and Understanding

The technological aspects and infrastructures of the cloud are too complex for most users to understand. Eggert et al. (2014) show in a sociological interview study that the users only have a vague idea of the concept of cloud computing. The authors also report that many users are not aware that they are already actively using cloud services, in particular for communications. The authors refer to this as hidden use (ibid, p. 304). In such cases trust no longer plays a role, because the users are oblivious to the potential risks involved. This problem can only be countered by disseminating knowledge widely, so that users have the chance to be informed consumers of cloud services, rather than acting in blind trust or excessive trust (cf. Lee and See 2004).

6.3 Technical Control Systems

If the users are aware of the security gaps that exist then this leads to a reduction in their trust in the service in question. Whether this loss of trust results in the cloud not being used depends on the extent of the perceived risk and on the vulnerability of the user to this risk. In order to cushion losses of trust, control systems are frequently employed in order to minimise the risk involved in digital exchanges.

The development of technical control systems draws in particular on encryption in order to protect the network connection of the consumer with the cloud against attacks by third parties. Encrypted protocols play an important role in this context (Soares et al. 2014). Other technical control mechanisms are employed to avoid data loss. Among these regular backups, redundancy, diversity and spatial separation of the security systems are the most frequent ones more robust (Ryan 2013; Huang and Nicol 2013). If users are aware of these technical measures their trust in the services is positively affected.

6.4 Organisational Control Systems

User data are often protected against illegal or improper use by means of a Service Level Agreement (SLA) between user and service provider. These SLAs cover the extent to which the private sphere of the consumer of the services is protected. Further trust-relevant aspects of the exchange relationship which are regulated in an SLA are the protection mechanisms of the provider against attacks, the responsibilities for individual parts of the services, availability and protection against breakdowns, liability in the event of data loss, etc. (Fernandes et al. 2014; Huang and Nicol 2013). The SLA also provides for legally binding entitlements if the specified performances are not provided (Huang and Nicol 2013). These specifications include parameters such as an availability rate that is regularly above 99 % (Karagiannis 2014; Fernandes 2014). An SLA creates greater security and reduces the risk perceived by the consumer. The main point is then how precisely and strictly the security-relevant aspects are defined and how much insecurity and residual risk remains.

A further organisational control system takes the form of cloud audits. The Cloud Auditors check the services with regard to their security provisions and effectiveness. As a rule, a successful audit in accordance with the relevant standards (e. g. SAS 70 II, FISMA, ISO 27001, cf. Habib et al. 2012) leads to the certification of the cloud service by an accredited public or private control agency. The certificate and the test seal (e. g. STAR) can be regarded as a sign of trustworthiness and security-relevant competence in compliance with the security standards (Habib et al. 2012).

Consumers are then able to judge services without having expert knowledge, i. e. how competent is the auditor, what are the requirements for the certification, and how thoroughly is the audit carried out? However, the fact that auditors are dependent on the market may reduce the trust in their findings. Other factors playing an important role include the experience, expertise, reputation and background of the auditors. Agencies with a high profile and a sound reputation are trusted more than new agencies still trying to establish their market position. It is interesting that unknown or fictive certificates also have the effect of increasing trust (Bär et al. 2011; Bär 2014).

Control systems such as encryption, certification and SLAs may reduce the risk of using the cloud and increase user acceptance, but they have their limits. Complete security will never be possible, and some trust will be required if the users are to accept the residual risk involved in using the cloud.

Some researchers argue that a control mechanism does not render trust unnecessary, but only shifts the trust (Tan and Thoen 2000). Control mechanisms used to minimise the risks of using the cloud will only be successful if the user trusts them. The trust has been moved from the provider to the controller of the provider. Users must trust the encryption technologies, audits, certification, and SLAs, otherwise these will be ineffective.

Even though control mechanisms are now widespread, so that a control mechanism and trust are frequently found in combination (Tan and Thoen 2000), a minimum of trust remains a precondition for every informed use of the cloud.