Every cloud has a risky lining
Published: 25 Jun 2009 12:31 BST
...the basic starting point. When considering a SaaS subscription, look for organisations that are ISO27001 certified. Ask to see the supplier's Statement of Applicability to check the right controls are in place to meet your particular industry or organisational compliance needs.
Also check:
- What are the security arrangements at the vendor facility?
- What type of infrastructure is used to host client data?
- What virus protection is there and how regularly are vulnerability scans and penetration tests run?
- How often are the systems backed up and are system recovery processes in place?
- What level of data encryption is used to protect website transactions? How is compliance with relevant data privacy regulations ensured?
- Does the provider have a data back-up management process in place?
- Where and how are back-ups stored? And how are back-ups encrypted and secured?
You will also want to know what sort of continuity arrangements are in place — look for BS25999 certification. Check that there is a service-level agreement that guarantees a specific amount of uptime. Also, find out what happens in the case of equipment breakdown and power failure? In addition, is the facility scalable? And is it monitored continuously?
Finally, there are big challenges involved in getting any sort of IT service right, let alone a new one like SaaS. However flexible SaaS is, you still have a significant time investment to get your application set up and configured so that it meets your business needs. Never underestimate the time required: a move to the cloud will need a project team, with a clear timeline, and lots of end user participation.
Then there is the impact on users: remember you may have to change internal processes to accommodate the limitations of whatever you are deploying.
All in all, approached with some forethought the specific cloud and general IT good-practice issues can be resolved. The subscription-based computing model offers benefits that cannot easily be ignored, but do not ignore the associated risks either.
Alan Calder is chief executive of security and compliance organisation IT Governance. IT Governance is the publisher of Application security in the ISO27001 environment.
Previous
- Roundup: Cloudwatch special report
- Cloud clout: Who are the real powers in the cloud?
- Five cloud computing myths exploded
- Cloud savings fail to make up for loss of control
- Amazon gives users more cloud control
- Video: Cloud won't become standard, says Kaspersky
- Tech giants form open-cloud-standards group
- Q&A: HP plans reign of ink from the cloud
- Inside IBM's only European Cloud Centre
- What is the cloud's killer app?
- Video: Who is really moving to the cloud?
- Four reasons why business will take to the cloud
Did you find this article useful?
10 out of 10 people found this useful
Digg
Slashdot
Del.ici.ous
Stumble
Reddit
