There are obvious advantages of Cloud Computing such as the huge savings in staff salaries, software licensing and power charges.
However close attention must be paid to risk management. Principally it is critical to recognise that data being hosted in the Cloud does not necessarily replace the necessity of a solid Business Continuity plan.
It is crucial to ensure that companies establish how responsibility for their data is being handled.
To be competitive in the market Cloud providers must therefore be open to probing questions ranging from queries over access controls to data encryption.
For instance data must be encrypted and separate from data belonging to other organisations. It is also essential to establish whether providers conduct regular security audits to comply with government regulation.
In fact government regulation is something which must be considered across many factors, not least with regards to where data actually resides. It is important that data is under the correct jurisdiction.
Other considerations such as infrastructure change are also important. Customers must be adequately notified of change and should have some control over when such switches are made. Technical specification should be made clear from the outset to ensure that customers are not forced to make major investments to keep up with change.
Business decision makers must be able to assess how their data is being managed at every level and above all what procedures are in place for outages.
It is a rarity for Cloud providers to specify the procedures they have in place for large-scale failure. Who is responsible if data is lost?
For some services such as Amazon’s EC2 service the customer is. For other services such as Terremark, SunGard and Savvis there is a shared responsibility between the provider’s technical support team and the customer themselves. However it has to be said that ‘shared responsibility’ for such a scenario sounds like a headache from the outset. To enter into contract with a company who will claim little or no responsibility for data is very risky.
It is important to know your Cloud provider inside out and be certain of the SLAs in place. Cloud Computing is something which can be extremely beneficial for an organisation. However careful planning and consideration is required before making the move.
