I don't know how accurate this is as I'm no expert but a friend of mine who is responsible for IT security for the company he works for is concerned more for the resultant instructions they will have to give employees. For example, you attend a company conference or presentation and next years business plan is shown on a whiteboard, you photograph it on your iPhone and the cloud "pushes" it to all your other devices, potentially you have just made confidential corporate information "available" to all the usual types who like to hack that stuff!!
Another example is what we've all done at some point I guess, you work all day at the office on some critical/important project and want to finish it at home at the weekend, you take the company laptop home or you email it to yourself via a company secure server, or you copy it to a memory stick, all very old fashioned it seems, but wait!!!! Now you can put it on your cloud and, again, it's "out there". As I said, I'm no expert but my pals inference was that he's more concerned about policing that kind of activity than he his with regard to the actual "cloud" security itself.
In a way this reminds me of the recent banking scandal, those people responsible for corporate profits pushed and pushed the boundaries until the whole thing came tumbling down, all the while assuring Joe Public that everything was ok. Are the IT comapnies now going down the same path, recent and ongoing events at RIM (Blackberry) have to be a cause for concern. I use a Mac email address for my business and in June next year that will migrate to the iCloud, I have to decide what I want to do.
I'd also love to know what some of you more literate IT guys think about Bullet's questions, thanks for reading my ramblings