"Overall, 73 percent of respondents said they need new skills to deal with cloud" claims a study interviewing 10,000 security professionals by Frost & Sullivan to be presented at the upcoming RSA conference.  

I think a big part of the confusion is the hiding of infrastructure design that cloud vendors engage in.    Part of the hiding is clearly to retain intellectual property ownership, but when you take into account discoveries like the recent one at Stonybrook that Rackspace cloud compute power doesn't scale with instance size (in fact, it's flat), the dark underbelly of the obfuscation comes into view, which is sowing FUD (fear, uncertainty, and doubt) among customers for competitive advantage.   There are cloud providers (ENKI included) that are transparent about infrastructure design and resource allocation, but they are in the minority and don't include "former bulk hosting companies" like Rackspace.  

For security to be effective, the security design cannot be based on assumptions about the infrastructure but rather an accurate understanding of what elements are involved.  There's no way to secure unknown infrastructure as a user or consultant - you have to rely on the cloud vendor's promises and guarantees, which in many cases are nebulous.