Which is more secure? Data served up by an on-premise system or made available in the Cloud? If you think on-premise systems make your information safer, think again, says Irfan Saif, Principal, Security and Privacy, Deloitte & Touche LLP. There may be more protection in the Cloud.

Speaking on a Deloitte Insight video, Saif acknowledged that security is a big and valid concern for many companies thinking about implementing Cloud solutions. But it’s a great myth, he said, that “that on-premise instantaneously means far better security than off-premise or than in the Cloud.” He points to the number of significant data breaches of on-premise systems to make that point.

Data security in the Cloud may be more reliable, he said, simply because people are so concerned about it. Because the security bar is set much higher for the Cloud, the systems are under greater scrutiny and much more “third party assurance.”

That being said, business leaders should be cautious enabling access to data, whether through an on-premise system or in the Cloud. “Not all data is created the same,” said Saif. While companies may not elect to put their most critical corporate data in the Cloud, “there are many other types of data and applications that could well go into the Cloud and risk be effectively managed.”

Paul Clemmons, leader of Deloitte Cloud Practice, agreed that concerns about Cloud security are real. But more of the concern is myth, is perception, it is lack of awareness, it is lack of understanding and lack of rigor, rather than a true risk that cannot be addressed,” he said. “So, over time I think we are going to see more and more comfort with dealing with some of these topics.”

For some executives, getting comfortable with the Cloud may have to come sooner than later. One of the more interesting observations Saif and Clemmons made on the video was how many business leaders are unaware of their companies’ Cloud activities.

“In my view, I think that there is really no company today that isn’t in the Cloud,” said Saif. “They may not know that they are in the Cloud or they may not like they’re in the Cloud, but they are there and their data, more importantly, is there.” One CIO’s mandate not to do anything in the Cloud went unheeded by more than 100 members of his organization, who were members of social collaboration site. Another client’s review of purchasing orders over a 120 day period found more than a dozen Cloud projects.

Doing business in the Cloud “is very hard to avoid,” said Saif. “Therefore it is all the more important that businesses really figure out what their strategy and approach is because it is happening whether they like it or not.”

The Cloud “should not be viewed as in or out, should we do it, can we do it, is it risky,” added Clemmons. “It is fundamental to how we run our business, it is fundamental to innovation and it is not going away.”

Are you considering doing more work in the Cloud? Clemmons and Saif also give some advice and how companies should proceed.  To learn more, watch the video.

You may also be interested in the latest results of Deloitte’s most recent CFO Signals quarterly survey. To learn more, watch this informative on-demand Webcast by SAP and Deloitte.