Despite data risks, some applications still a fit for cloud services
A new report from a European security agency highlights some of the risks of outsourcing IT services to cloud providers, and by extension illustrates the importance of carefully choosing which applications you want to run in the cloud.
“Cloud computing users face problems including loss of control over data, difficulties proving compliance, and additional legal risks as data moves from one legal jurisdiction to another,” the IDG News Service reported, in summarizing the “Cloud Computing Risk Assessment” report from the European Network and Information Security Agency.
For all their benefits, cloud computing services require companies to relinquish control on a number of fronts. “For example, the provider’s terms of use may not allow port scans, vulnerability assessment and penetration testing. At the same time, service level agreements (SLAs) may not include those services,” the IDG News Service writes. “Compliance could also prove to be a big problem if the provider can’t offer the right levels of certification or the certification scheme hasn’t been adapted for cloud services.”
Just because the cloud carries risks doesn’t mean IT shops shouldn’t consider moving applications outside their own data centers. But they should consider the reasons for doing so carefully.
A good analysis in Computerworld by reporter Cara Garretson notes that “if a company is in a heavily regulated industry, it should choose a cloud service provider that adheres to the same regulations it does” and that “The cloud provider should be able to prove its compliance and detail how audits will be conducted so customers don’t put themselves at risk of unknowingly violating the law.”
But even if cloud services are determined to secure, that doesn’t mean enterprises should automatically move most of their applications to Web-based platforms. Part of the decision involves deciding which applications give you a competitive advantage when they are maintained in-house, and which ones don’t.
“Look at your portfolio of applications and services and decide which are commodities, not core competencies,” Forrester analyst James Staten says in the Computerworld article. “Those are your candidates for cloud.”
The reality, as ex-Microsoft and current Google executive Don Dodge notes, is that the cloud, for all its hype, is not suitable for every IT function. But in the cases where it makes sense it can add value while lessening the burden on internal technology staff.
“Moving to the cloud is not an all or nothing proposition,” he notes in a blog post.
“While there are some regulatory and compliance concerns for some applications, it isn’t an all or nothing proposition,” Dodge writes. “Moving your email, calendar, spreadsheet, word processor, and other productivity apps to the cloud now can save big money, and free up your IT resources to focus on more strategic issues.”Follow Jon Brodkin on Twitter.
