Danny Bradbury| Guardian
There is no doubt that cloud computing is a game-changer for the IT industry, but what about the security implications? Cloud computing is essentially a storage service – companies hand their data over to third-party providers, who then host it behind the scenes. The idea is that companies no longer have to worry about storing and managing their information, and can rely on someone else to provide the infrastructure. It not only offers potential cost savings, but also empowers companies to be more agile and mobile.
And yet security is often the biggest issue for companies considering a move to cloud computing. Among specific concerns raised by these organisations , things such as data leakage, malware outbreaks, insider sharing and hacker theft consistently lead the way.
The UK Information Commissioner’s Office (ICO) recently published guidelines clarifying what legal experts already knew: in the event of a security breach, companies can’t blame outsourcing providers that they have commissioned to handle their data. The company who generated and owns the data (the data “controller”, in legal parlance) will still be liable for such breaches.
Recent regulatory decisions have proved this. In September, the ICO slapped a £250,000 penalty on Scottish Borders council for failing to monitor how paper records were treated when the council gave them to a third party to be digitised. The third party dumped them in a bin; the council took the penalty.
Security concerns are not unfounded, but Clive Longbottom, co-founder of analyst firm Quocirca, worries that they are overblown.
“It comes back to the ‘server-hugging’ mentality, where people can’t see where data is and therefore believe it is unsafe,” he says. He advises CEOs to take their 10 biggest IT security concerns, and give them to their IT managers. “I’d be surprised if they could tick off more than five as dealt with,” he warns, adding that cloud service providers will probably be more adept at coping with such security risks.
Nevertheless, both the ICO and IT experts suggest companies need to ask cloud service providers a few clear questions before handing over their data.
Requesting evidence of a third-party security audit is one way to help ensure the security of your cloud provider. Don’t forget to ask for proof that any subcontractors used by the cloud provider also pass muster.
Also, have the cloud provider tell you where they will be storing your data. You want to be sure it is in a jurisdiction that doesn’t play fast and free with other people’s information, contravening the UK Data Protection Act.
This issue is linked to data ownership. If the cloud provider goes bust and your data is stored on disks that the service provider owns, the receiver is under no obligation to return them. Savvy customers should therefore ensure they own the physical devices used to store their data. If that is not possible, then conducting financial due diligence is a good idea.
“If you’re going to do business with us, one of the first things you’d do is check our financial credibility,” says Ian Callens, business leader at IT consulting firm Icomm Technologies.
You should also analyse your company data and quantify the impact of it being compromised before shipping it off to a cloud provider. If you’re determined to outsource it, then encrypt it before you send it – or ensure that the cloud provider scrambles it, and make sure you understand how they manage the electronic keys that will decrypt it.
The cloud remains a viable option for many UK businesses but, as IT security experts stress, it pays not to have your head in the clouds when it comes to putting together a strategy to use it. The best advice may be to keep your feet firmly rooted in reality – and look after security first.
