We have had a lot of piqued interest from our clients in regards to cloud computing—the potential cost savings, associated risks and whether the savings outweigh the risks. While many clients are entertaining the idea of placing non-proprietary information in the cloud, placing intellectual property and/or financial data into the public-facing Internet is still too risky.

Traditional means of securing data continue to be through the use of multiple layers of security, including Virtual Private Network (VPN), which encrypts data between locations. However, cloud computing makes these traditional methods more cumbersome.

Cloud service providers do not typically allow for physical-level VPN traffic, although they do support application-level encryption via HTTPS, providing for secure communications at the application level and data payload. Application-level encryption is becoming the de facto standard for “secure” data communications, but it does not provide the same level of security as site-to-site or client VPN products.

Also, data encryption is provided by most cloud providers. Depending on the methods and specifics of the encryption types and algorithms being used, this encryption in the cloud provides protection of data should external applications or malicious entities gain access to the cloud-based, publicly-accessible data of our clients.

However, because the cloud providers maintain the encryption algorithms and may also have the encryption keys, the cloud provider may have the ability to access, distribute or corrupt data. As a result, moving to the cloud is not a “no brainer” for companies or organizations. Implementation of cloud computing can provide:

1. Cost savings via the potential to decrease IT resources and reduction in spends on hardware and software
2. Increased fault tolerance and disaster recovery options due to the distributed data center configuration of cloud providers
3. Increased accessibility because of the Internet-based access.

However, no one benefit may be significant enough on their own to motivate a client to switch to the cloud. Only after understanding the return of all of these benefits in conjunction with the risks will most clients see the light.

IT Hardware and Software Vendors seem to stand the most to lose in the cloud computing scenario. However, some understand that there is a place for both On Premise and cloud-based IT services.  The largest software manufacturer in the world, Microsoft, is welcoming cloud computing. They have created SaaS, PaaS and IaaS service offerings (Office 365, Azure, Windows Server Hyper V, Dynamics) to supplement their key product offerings, which have traditionally existed on Premise.

This strategy seems to be logical, as some type of local infrastructure will need to exist for clients to access the Internet-based systems. As a result of the local infrastructure, which will need to continue to be managed and supported, some other local services and resources can be run with little cost increase. While understanding the potential benefits for cloud-based services, the local environment must become more reliable, secure and efficient in order to support the remote cloud-based resources.

In order to help with our clients’ decision on which applications, services and resources should be placed into the cloud, we consider the following:

1. Current applications and data in use by the clients: Non-mission critical applications are the easiest and least concerning tasks to move first providing the opportunity for a successful Cloud migration and implementation. Applications such as hosting of public websites, email and offsite file replication provide quick wins in cost savings, fault tolerance and data accessibility.
2. Cloud service providers who provide “private” cloud options specifically for clients’ proprietary data: These implementations are providing a hybrid of Software as a Service and Platform as a Service offerings, which may allow for more direct control of data security for the client. As a result, VPN services may be able to be configured and data storage could be encrypted without any involvement from the cloud provider.
3. Service offerings of different cloud providers specializing in specific industries: As a result of a cloud provider’s industry specialization, they may obtain certifications like PCI and HIPPA, which may ease the concerns of clients for placing their data into the cloud.

Have you moved to the cloud? What challenges did you need to overcome?

-Jerry Irvine