Cloud security and lessons from private sector