In looking at the security of cloud computing, it is necessary to look at the alternative, and the inherent risks of non-cloud computing. It’s a natural human tendency to want to have control over everything. And if somebody else is controlling something, we want to look over their shoulders while they’re doing it. When the plumber comes to fix our pipes, do we sit in the living room and watch television and let the poor guy just do his job? No, of course not. We follow him to the bathroom and watch.
It doesn’t make the pipes get fixed any faster or any better, but by watching, we have regained that sense of control that we lost when we called the plumber in the first place. It’s almost as if by watching the plumber, we’re doing the work ourselves. We are no longer in control, but we feel as though we are.
In the case of the busted water pipe for example, is it better to maintain direct control over the situation? Probably not. Most of us who are not plumbers have better things to do with our time. And while it’s true that we could probably fix that broken pipe ourselves if we had enough time, how-to manuals, and pipe dope, the plumber (who’s done it many times before) could probably do it faster and better.
We can see in this simple scenario that there are circumstances where it is better to not have direct control.
For those who resist using the cloud, the alternative is to remain in control by running your own data center, your own servers, your own storage farm, and your own applications. Doing so leaves you in complete control, but there is an opportunity cost involved.
The guy who fixes his own plumbing suffers an opportunity cost, because he must make multiple trips to the hardware store, invest time and money, purchase hundreds of dollars’ worth of tools, and miss his favorite television show. And just like the guy who fixes his own plumbing, the company that insists on hosting absolutely everything in-house is losing out.
The most immediate advantages of the cloud is the lack of an up-front capital investment, and freeing the internal IT staff to attend to more pressing concerns. But beyond that, there are advantages that relate directly to security. A cloud computing service provider will typically offer a service level guarantee to protect against data loss, outage, failure, and cyberattack. Typically, this SLA is backed up by specific terms that lay out performance levels, as well as penalties that the provider may be liable for if those levels are not met.
The physical security element is important and often overlooked. All the firewalls and passwords in the world are useless if somebody in a lab coat carrying a clipboard can bluff his way into your office and walk out with a pocketful of thumb drives and the CEO’s laptop under his arms. And make no mistake, this does happen, and often. Industrial espionage is alive and well. If you are hosting your own data center, is your data safe? Sure, it’s firewalled. But is it in a locked room? Is access to that room regulated, with entry by keycard only? Probably not. Service providers offering cloud services, collocation centers and hosting providers typically adhere to rigorous physical security protocols to protect against physical theft or tampering.
Besides physical security, the technical security is of the utmost importance. Hosting your own servers and applications requires extra measures. A larger organization may need to deploy dedicated IT staff to security only. Cloud computing, on the other hand, builds security directly into the cloud platform. While the company still must maintain in-house security in any case, the provider ensures that the applications and data are safe from attack.
And lastly, the issue of disaster recovery is vital, and one that is often ignored. We may tend to think that simple backup is equivalent to disaster recovery, but it is not. Disaster recovery calls for redundant, off-site backup, as well as procedures and technology for recovering data and applications at a moment’s notice in case of disaster. It can be costly—but a cloud provider will already have these measures in place.
Of course, when considering cloud providers, these considerations are always a factor, and it should be determined ahead of time that the cloud provider:
• Offers a detailed, specific SLA
• Offers physical security at their data center
• Offers superior technical security to protect data and applications
• Offers a detailed backup and disaster recovery plan
With these things taken into account, it becomes very evident that maintaining direct control over everything comes at a high cost, and in most cases, those necessary elements are not met.
________________
This blog is brought to you by Virtual Global, provider enterprise-class cloud computing solutions. Since 1995, our technologies have helped commercial and federal customers worldwide with their enterprise IT needs.
Cloud Computing News 
Comments Off