Rego, with OnApp, recommends that customers perform zeroing out processes themselves, even if their provider also zeros out the disks. By running a simple command line in and , customers can zero out the disks, he says.

Others are not surprised by the results. "It's kind of to be expected," says J.B. O'Kane, managing principal at Vigilant, a security and risk consultancy. "It's the same problem we would encounter independent of the cloud related to data governance and what processes and due diligence are in place to protect against vulnerabilities." The situation outlined by Context, he says, is not all that different from data not being zeroed out on a managed hosting, private cloud deployment, or even an old computer that is being thrown away. In all of these contexts, the hard drives should be wiped out after each use. Apparently, he says, it's just not commonplace for that to be done in the cloud yet.

Network World staff writer Brandon Butler covers cloud computing and social media. He can be reached at BButler@nww.com and found on Twitter at @BButlerNWW.