Research and retrieval of news articles by:
Bennett Gold LLP, Chartered Professional Accountants

SPECIAL NOTE TO ALL VISITORS:
Effective December 31 2012, articles are no longer being updated on this web site.
The site is now maintained as an historical archive, covering notable e-commerce news articles from the period 1999 to 2012.

MANAGING THE CLOUD'S SECURITY RISKS

Posted on October 15, 2010

Cloud computing is all the rage these days. CIOs seem to be diving into cloud-based solutions with reckless abandon despite the fact that a mistake in planning or execution can have career-limiting effects. So, let's take a moment to balance the benefits against the potential security pitfalls that lie in the clouds.

The really important question is, How safe is your business in the clouds? After all, cloud vendors all aim to put your stuff onto cloud servers, and in most cases, these systems sit outside of your data center and outside of your direct control.

While this may buy you some cost reductions, it carries significant risks. Let's consider the classic triad of information security: confidentiality, integrity and availability.

There's no getting around that putting data onto an external server carries confidentiality risks. No matter what your cloud vendor may promise contractually or in its service-level agreement, if its security gets breached, so may yours.

How do you counter that risk? You can encrypt sensitive data, or you can keep the real sensitive stuff off the server. Encryption can be a viable path for some stuff like off-site backups. Being particularly careful about what goes on the server can help as well, so long as you maintain some level of oversight and control over the day-to-day decisions. That is, if you give your users the ability to store stuff on a cloud server, they're liable to store all sorts of stuff there, blissfully unaware of the security risks.

As to integrity, the risks in cloud computing are relatively small, unless your cloud service provider's security gets breached anyway. If an attacker breaches its defenses and tampers with your business data, then integrity can become vitally important all of a sudden, depending on the nature of the data.

And then there's availability. You're gambling that your data will be available when you need it when you put it in the cloud, betting that the availability won't be eroded by network outages, data center outages and other single points of failure. You can hedge your bet a bit by going with an industrial-strength cloud provider, but you'll pay more.

If availability of data is important to your business, then you can't blithely go with the lowest bidder. You need to do appropriate due diligence and find out everything you can about your vendors' availability, disaster recovery and business continuity plans. "Trust but verify" should be your mantra.

Much of this sounds like Information Security 101. To be sure, there's a lot of plain old common sense that should be applied when considering cloud solutions.

At my company, we do use some cloud services and get gobs of value from them. For example, I'm a fan of Apple's MobileMe cloud service. It helps me keep my contacts, calendars, bookmarks, etc., synchronized across my various computing devices. But I'm also careful about the data I put there. I keep business-sensitive information on my local hard drives, and generally encrypted.

I've also found great value in using cloud services as part of my Plan B for mobile disaster recovery. Whenever I travel on business, I always keep an encrypted copy of the stuff I need for that trip out on the MobileMe cloud. If my laptop is stolen or suffers a catastrophic failure, I know I can go out and buy a new one pretty quickly, and then load the mission-critical data I need from the cloud service.

Then, when I return home, I can do a full reload from the more extensive backups that don't leave my control.

It's about balancing risks and benefits. Having the most important stuff readily available to me via a cloud service as I'm traveling is a risk that has sufficient benefit should I need to invoke my Plan B.

Keeping all of my basic contact, calendar and bookmark data synchronized across multiple machines is likewise hugely beneficial.

I don't have any misplaced belief that Apple's MobileMe service is impregnable. Rather, I accept that risk for the value of the services it provides to me.

That's how we should view cloud services in general. It's important to make informed decisions before diving into the latest trend. There is value to be found in cloud computing. But rely too heavily on it, or place your deepest darkest secrets on it, and you're likely to be disappointed.

E-Commerce Alerts are issued by Bennett Gold LLP, Chartered Professional Accountants as situations develop. Bookmark this site and check back often. Our e-mail address is: info@BennettGold.ca

In accordance with United States Code, Title 17, Section 107 and Article 10 of The Berne Convention on Literary and Artistic Works, the news clippings on this web site are made available without profit for research and educational purposes.

ALERT
ARCHIVES
Final Entries
2012
2011
2010
2009
2008
2007
2006
2005
2004
2003
2002
2001
2000
1999