With new cloud computing services coming into existence every day, universities and businesses alike are contemplating if they should move to the cloud. There are several benefits of using cloud computing, which is why its use is becoming increasingly common. But, cloud services have a number of associated risks, especially for research institutions and companies. The production, transmission, or storage of proprietary data by cloud services could place the organization’s data at risk. It is imperative that these risks be considered before making a decision to use any cloud service.

Before we discuss the pros and cons of using cloud services, it is important to define the term "cloud services". In an effort to formulate a Cloud Security Policy for the Georgia Institute of Technology, the author participated on a panel that defined cloud services as "Hardware, software, or storage resources used without direct ownership of the underlying architecture that provide these services. Additionally, maintenance and physical access restrictions are non-enforceable or otherwise outside the ability of the user to perform or audit."

So, web services such as email clients (Gmail, Hotmail), document repositories (Google Docs, Dropbox), remote system access (PC Anywhere, Go To My PC), chat (Skype, Google talk), cloud computing platforms (Amazon Web Services, Microsoft Azure), etc., are all cloud services.

Cloud services offer several benefits, which make them an attractive option:

• Ease of use: Cloud services are kept ready to use by providers and as such are easy to use.
• Low maintenance costs: There is very little or no maintenance cost associated with the use of cloud services.
• Flexibility and scalability: The amount of resources needed can be easily scaled up or scaled down.
• No up-front investment: Cloud services are pay-per-use with no up-front investment.
• Reduction in overall IT costs: Cloud computing reduces both initial and ongoing IT labor costs.
• Ability to develop and deploy applications faster: Cloud computing lets you provision and make use of hundreds or even thousands of servers within minutes.
• Ability to focus on your own projects: Availing cloud services lets you focus on your core competency.

Although cloud services provide a host of benefits as discussed, their use entails several risks, too:

• Reliability of the cloud service provider: The use of cloud services of a start-up puts data at high risk as the company may go out of business and the data may be lost.
• Ownership of data: Often the terms of service of cloud service providers state that they would own any stored data. This endangers any research, proprietary, or confidential data.
• Ownership of data: Often the terms of service of cloud service providers state that they would own any stored data. This endangers any research, proprietary, or confidential data.
• Level of support: There are several risks associated with using cloud services with missing or limited level of support such as losing access to the data and the data getting leaked. The lack of any good support to address such issues poses a significant risk.
• Validated provider: Availing the services of a cloud service provider that has not undergone a security review or does not possess a certification (TRUSTe seal, European Union Safe Harbor certification, McAfee secure) poses a risk.
• Meeting contractual obligations: The contractual obligations of research institutions or businesses may prohibit them from sending the data to a third party such as a cloud service provider.
• Jurisdictional issues: The location of the cloud service provider’s data center may subject the data to different legal requirements. For example, if the data center is located overseas, it may allow a foreign government to access the data.

So, what should you do?

Most importantly, you should ensure that the cloud service provider does not claim ownership of the data you create, store and transmit with them. You should conduct regular audits of the cloud service provider to ascertain what assurance they provide, the level of support offered, and to ensure that their terms of service do not put your data at risk.

The best way to approach this would be to see if your company or university maintains a cloud computing policy and to follow it. You should also contact your IT department, as this would not only help you avoid unnecessary risks, but they can help recommend the cloud service provider that best suits your needs.

You should also try to use your organisation’s cloud service offerings.

Hopefully, you will be able to realise the benefits of cloud computing while avoiding the associated risks.

September 2013