Businesses are rapidly adopting cloud computing solutions in order to save money and improve their overall operational efficiency. However, security risks and privacy concerns are issues that could outweigh the advantages by far should unfortunate situations come to light. In a time when mishandling confidential business information and customer data could lead to dire consequences, IT security teams must go above and beyond to ensure the best security and privacy practices of prospective cloud services.
Peeking into the Cloud Infrastructure
Elements such as data protection, disaster recovery and business continuity are all key areas that must be considered when opting for a cloud computing solution. And while a customer’s stored data gives the service provider potentially valuable marketing data for future reference, it could also result in the misuse use and breach of a privacy policy. One way to determine the overall effectiveness of the provider’s security and privacy policies is auditing, as it offers an internal glance at the firm’s internal operations. Since most cloud providers do permit internal audits, you should seek out one that allows for some type of external audits of their network and infrastructure.
Keeping Pace with Compliance and Regulatory Demands
Business customers who need to meet regulatory compliance must determine how leveraging a cloud service could possibly impact those standards. Data security and privacy are two of the most important factors of compliance as both state legislation and government regulations enforce strict stipulations on how data is to be handled. For example, privacy laws in Europe and Japan require that private data be stored and maintained in secure data center facilities located in those respective regions. In addition, the FFIEC (Federal Financial Institutions Examination Council), HIPAA (Health Insurance Portably and Accountability Act) and PCI (Payment Card Industry) Data Security Standards are all government enforced regulations that demand the secure storing and handling of private data. A cloud service provider that cannot help ensure compliance under these guidelines does not have your best interests in mind and could put your business in grave jeopardy.
Legal and Contractual Dilemmas
Liability and contractual issues must also be considered when evaluating cloud services. Unfortunately, both can be very sketchy when the cloud is involved. In some environment, aspects are well defined where it is understood that the provider owns the applications and infrastructure while the customer has ownership over their data and intellectual property. In other instances however, it can be difficult to determine just what rights the customer has verus the service provider, especially in a SaaS (Software-as-a-Service) environment. This could lead to a very grueling dispute should you choose to break off the partnership and host your data elsewhere. To avoid such issues, it is highly recommended that you understand liability and the terms of the contract before entering an agreement.
Cloud computing offers a range of benefits, but companies should not hop on the bandwagon without having a clear understanding of the security, privacy and legal consequences involved. By drawing up a complete assessment strategy outlining these key areas, you can get the answers you need and find out if this type of service is right for your business. When approaching this solution as if it was your own IT department, you can find out how to keep your data secure and optimize your cloud investment.
September 27th, 2009 at 12:57 am
For all the concerns mentioned here, there are some great benefits with cloud based services. Google Docs and Gmail are good examples (both Google products). Cloud based services can save a start up company a lot of money.
January 9th, 2010 at 1:01 pm
Health reform will ruin our system.