Posts tagged value added services

he RSA Conference invited several guest speakers to talk about a variety of topics surrounding cloud computing, including security, value propositions and cost savings to consumers and IT departments which want to reduce costs of information storage. Guests offered various views on scalability, security risks and efficiency models that indicate that there are significant value added services that can reduce IT costs dramatically.

For consumers, the decisions of IT services used by various sized businesses convinced into using cloud computing affects how cloud information and products are used, and how the vendor manages and protects information that potentially exposes you to events beyond your control. Businesses recognize these potential risks and are aware of impacts they may bring upon themselves if cloud computing services are vulnerable.

The evidence is clear – networks are hacked into everyday. Credit card information, transaction records, bank account information, personal identification records, etc. are retrieved through network intrusions regardless if they are stored in managed private networks or outsourced to public cloud based providers. So what makes sense to implement?

Value propositions of shared infrastructure costs spread over a number of customers at a central data center repository suggests that there are significant savings to be had by entering into Cloud based network services. Cloud computing offers different architecture designs, some are good and some are poor. Those that are enabled with shared data drives, network switches, routers, firewalls, intrusion detection systems and VPN domains and hardware should be thoroughly reviewed and analyzed during your service provider review. Consumers have little choice — and little knowledge of how CIO’s and IT departments make these choices.

The components involved in making such decisions are pretty basic, yet continue to be immersed into classic Fear, Uncertainty and Doubt (FUD) debates. Network hacking and intrusions into large network infrastructure such as Google, Intel, Yahoo, and financial data centers are everyday news.

Should something go wrong…

Are the advantages of Cloud computing compared in-house management of data worth the risks or not? Are the financial savings gobbled up in tarnished image and damage control?  There are white papers offering several views on the subject here on ZDNet. You can decide from a technical merits perspective if the human and hardware costs savings can make a difference to your IT budget. These key benchmarks of return on investment can be categorically stated and offer ‘reasonable’ accuracy in financial reporting terms.

What cannot be put into the financial statement or projected costs savings are the unknowns in your company’s brand protection should something go wrong. Other considerations are litigation, insurance (risk) costs, and other service liability claims that could arise.

Soon to be a part of the equation are privacy and document responsibility protection costs that are not possible to calculate because the laws concerning how you protect your customer information are in a state of flux — and tort reform is not likely to be addressed in the near future. The more information is stored in central repositories where information about you is collected and used from single source environments, the more risk is taken upon by the provider of cloud computing suppliers. In a business environment that currently is experiencing difficult cost saving exercises, cloud computing is a potentially attractive option. In the current political environment the old business mantra of: ” too big to fail” is no longer true. Just ask GM, Lehman Brothers, and just about all pension funds. Today, a lot of companies have significant IT costs that potentially hinge upon whether or not they become the next dead, nearly dead, or put on life support entity. This may trigger how much risk a company undertakes managing information and intellectual property.

Consumers in many ways have simply become numb to it all. It’s almost acceptable that it is going to happen and why fight it. The tolerance level appears to be very high to potential impacts to an individual’s information. But how much more are people willing to take before it’s too much – let alone too late to fix? The tolerance to credit card fraud has been acceptable in the past because the consumer has never been liable for damages.  But as people become accustomed to electronic health care records, personal profile data and purchasing history becoming intermixed and interconnected, that may change how much risk and tolerance consumers are willing to put up with.

Even Google is vulnerable

It was OK when it didn’t happen to you, but when it does, the tune suddenly changes. Data centers that are operated by third parties invite more than just criminal intent, including government oversight, profiling, personal attack, manipulation and legal litigation that may wind up being more expensive to you and the company that entered into a cloud computing service than realized.  In fact, I would suggest that cloud computing service providers like Google are exposed to legal and financial risks that could lead to their demise.

In the United States, government agencies like DOJ, FTC, FITC, FBI will be of no help until after the fact. They simply pick up the pieces after an incident occurs. There are no regulations or federal guidelines that are enforceable in a cloud computing environment prior to commencing service. The privacy and criminal laws are not certification or compliance elements. ISO standards and other litmus tests are not mandatory, nor are they sanctioned by any government agency. In some countries, like Canada and Australia, there are requirements with respects to privacy and information security to be in compliance with concerning management of information, but not how they are physically stored within a cloud provider’s infrastructure.  Insurance companies are just beginning to learn how to offer product liability products concerning Cloud service providers and they will require certifications like IS0 27001 and SAS70 reviews.

Of particular concern is access to information by government authorities. By hosting your information with third party entities, you may not be even aware of search warrants and monitoring by government agencies and this creates potential vulnerabilities that are not only beyond your control, but potentially damage your company’s credibility - permanently. Processes, policies and jurisdiction issues are upcoming hot spots creating significant legal and ethical questions that are not transparent. Service providers can stress that they have the best security and controls in the world. They are no good to you as a company or individual when the authorities knock on their door and you don’t even know.

Criminal and intelligence communities’ attraction to attack such a valuable commodity will always be in demand. Consumer sympathy, complacency and tolerance will collide and cannot be relied upon for recovery. Cloud computing is an appropriate description for such services. CIO’s and consumers need to understand that SOME clouds may look like nice fluffy places to park your data, others but they can turn out to be towering cumulus clouds emitting thundering lightning bolts that eventually hit you, maybe more than once, and leaving nothing behind.

Full Source