Cloud Services May Not Be For You
Justin Hoeft

Cloud Services May Not Be For You

When you own something, it's yours. Except when someone else has it.

I'm thinking of your data. Pictures. E-Mail. Contacts. Calendars. Accounting. Medical Records. Scanned Images. The list of available online services is ever-expanding. The Cloud has revolutionized the way we work - we can not only access our data but our applications from almost anywhere. We can almost achieve the same level of productivity using a 5" cell phone while taking a walk that we might enjoy on a 22" monitor at the office.

Storing your data in the cloud ensures its availability no matter where you are. No matter what catastrophe may befall your office building, your data will always be there. You can compute worry-free a team of experts across the globe maintains your Cloud services and safeguards your data against the unthinkable. Responsible Cloud service providers will have backups on top of backups, your data will live in multiple locations, and your applications will always be available so long as you have an Internet connection.

Services which simply warehouse your data online seem like a great idea - Dropbox, Google Drive, and Microsoft OneDrive all work well, make sharing documents and pictures easy, and offer plenty of space. But the same features which make online drives convenient can come back to bite you. There are issues of privacy, security, and ultimately regulatory compliance. You might encrypt your files before placing them in this kind of shared storage, but you should probably invest in a service meant specifically for secure corporate file sharing - it would be embarrassing to say the least if you had to admit to your customers that the data which was compromised was stored in a free online file storage service.

The real power of the Cloud lies not in warehousing data but in serving up applications we can't live without. It's great to get work done in front of a computer at the office, but have you been productive on a tablet while relaxing at a restaurant? How about dealing with an emergency through an application on your cell phone? Moving both your company's applications and data out of the server and into the Cloud not only frees you from the office LAN, it enables your business to work without concern for a server and its requisite updates and maintenance, you can simply work, and your Cloud service simply works. This is Software as a Service, or SaaS.

Not every application translates well to the Cloud. The Cloud versions of many applications are often well done, but some critical features are missing. Features we're used to having in the desktop versions of many applications just haven't been implemented in the Cloud versions - this is certainly the case for Office 365's online versions of Word and Excel, and the Cloud version of Quickbooks is a much different experience than the local version.

Subscription price structures may be enough to drive some people away from the Cloud - you never own it, you only rent it, so you will never be done paying for it. If you can't pay for it then you can't use it, and you're sunk. If you don't have the money to pay for an essential service the service will be suspended. With the service suspended you can't go get your work done. If you can't get your work done then you can't pay for this essential service.

On the other hand investing in a Cloud application often will get you off of the upgrade treadmill and onto a platform that will always be current. An example of this is Microsoft Office - every few years, in order to maintain compatibility with the rest of the world, businesses have had to buy new versions of Office for each desktop computer. Using Office 365 guarantees that you will always have access to the latest version. If you do the math and compare the cost per PC of the Office upgrade treadmill (upgrading to each new edition of Office when it becomes available) to the monthly cost per user of Office 365 you will find that, in the end, the cost analysis actually favors Office 365 over Office 2013. However, many businesses have successfully continued to use older versions of Office or periodically skip versions, and the math certainly works in favor of skipping a version, IF you're willing to tolerate some incompatibility with newer versions.

But, what happens when the Cloud Service provider is failing to hold up their end of the bargain? Imagine a situation in which your application and data aren't available, and its a failure on the part of the SaaS provider. Perhaps it was hackers. Perhaps the new guy pushed the wrong button. The end result is that you can't work. What can you do? Pick up the phone and call? Just like the thousands of other people who also can't work and are calling tech support?

Now, imagine a scenario where you have invested in a Cloud service, you have used it for a significant amount of time, and you have a significant amount of data in that Cloud service which you use every day. But there's a better service - perhaps they have more features or a better price. Or perhaps there's an application for your local network server that better suits your needs. Regardless why you want to change, the question becomes: can you change? What is the process for getting a copy of your data out of a SaaS and into another application? If a potential SaaS provider can't give a satisfactory answer to this question then you might consider other options.

A lot of considerations must be made before choosing a Cloud service provider for your business. At the end of the day the question isn't just which SaaS you will choose, but whether you need SaaS at all. With a physical server your applications can be bought and paid for, living safely within your walls and available as long as you keep your server powered, updated, secured, maintained, and backed up. No sweat.

Jim Schramm

Lead Cyber Security Engineer @ MITRE

10 年

Great article. Another thing to consider is that common security controls and data feeds that your Security Operations Center may consume now are not readily available from some cloud providers. Full PCap? Not going to happen on AWS without standing up a virtual appliance in your virtual enclave. Regardless of FedRamp certification or other advertised compliance, it's still up to you to identify gaps between the controls your business requires and what is available from your cloud provider.

回复

要查看或添加评论,请登录

Justin Hoeft的更多文章

社区洞察

其他会员也浏览了