The legal implications of data and
applications being held by a third party are complex and not well understood.
There is also a potential lack of control and transparency when a third party
holds the data. Part of the hype of cloud computing is that the cloud can be
implementation independent, but in reality regulatory compliance requires
transparency into the cloud.
All this is prompting some companies to
build private clouds to avoid these issues and yet retain some of the advantages
of cloud computing. For example, Benjamin Linder, Scalent System’s CEO, says: “What I find as CEO of a software company in
this space, Scalent Systems, is that most enterprises have a hard time trusting
external clouds for their proprietary and high-availability systems. They are
instead building internal "clouds", or "utilities" to serve
their internal customers in a more controlled way.”
Third-party
data control Threat #1. Due diligence
If
served a subpoena or other legal action, can a cloud user compel the cloud
provider to respond in the required time-frame? A related question is the
provability of deletion, relevant to an enterprise’s retention policy: How can
a cloud user be guaranteed that data has been deleted by the cloud provider?
Third-party
data control Threat #2. Auditability
Audit difficulty is another side effect of the
lack of control in the cloud. Is there sufficient transparency in the
operations of the cloud provider for auditing purposes? Currently, this
transparency is provided by documentation and manual audits. Information
Security Magazine asks: “How do you
perform an on-site audit when you have a distributed and dynamic multi-tenant
computing environment spread all over the globe? It may be very difficult to
satisfy auditors that your data is properly isolated and cannot be viewed by
other customers.”
A related concern is proper governance of
cloud-related activity. It’s easy, perhaps too easy, to start using a cloud
service.
One popular auditing guideline is the SAS
70, which defines guidelines for auditors to assess internal controls, for
instance controls over the processing of sensitive information. SOX and HIPAA
are other well-known regulations. US government agencies generally need to
follow guidelines from FISMA, NIST, and
FIPS.
Certain regulations require data and
operations to remain in certain geographic locations. Cloud providers are
beginning to respond with geo-targeted offerings.
Third-party
data control Threat #3. Contractual obligations
One
problem with using another company's infrastructure besides the uncertain
alignment of interests is that there might be surprising legal implications.
For instance, here is a passage from Amazon’s terms of use:
10.4.
Non-Assertion. During and after the term of the Agreement, with respect to any
of the Services that you elect to use, you will not assert, nor will you authorize,
assist, or encourage any third party to assert, against us or any of our
customers, end users, vendors, business partners (including third party sellers
on websites operated by or on behalf of us), licensors, sublicensees or
transferees, any patent infringement or other intellectual property
infringement claim with respect to such Services.
This could be interpreted as implying that
after you use EC2, you cannot file infringement claims against Amazon or its
customers suggesting that EC2 itself violates any of your patents. It's not
clear whether this non-assert would be upheld by the courts, but any
uncertainty is bad for business.
Third-party
data control Threat #4. Cloud Provider Espionage
This
is the worry of theft of company proprietary information by the cloud provider.
For example, Google Gmail and Google Apps are examples of services supported by
a private cloud infrastructure. Corporate users of these services are concerned
about confidentiality and availability of their data. According to a CNN
article:
For
Shoukry Tiab, the vice president of IT at Jenny Craig, which uses Postini and
Google Maps, the primary concern is security and confidentiality. "Am I
nervous to host corporate information on someone else's server? Yes, even if
it's Google."
Note that for consumers, there were
initially widespread confidentiality concerns about Gmail, but now those
concerns seem to have faded. We believe this is an example of the Privacy Hump:
Early
on in the life cycle of a technology, there are many concerns about how these
technologies will be used. These concerns are lumped together forming a
“privacy hump” that represents a barrier to the acceptance of a potentially
intrusive technology…. Over time, however, the concerns fade, especially if the
value proposition is strong enough.
Consumers at least seem to have decided
that, in this case, the dangers of placing their data in the cloud were
outweighed by the value they received.
Third-party
data control Threat #5. Data Lock-in
How
does a cloud user avoid lock-in to a particular cloud-computing vendor? The
data might itself be locked in a proprietary format, and there are also issues
with training and processes. There is also the problem of the cloud user having
no control over frequent changes in cloud-based services. Coghead is one
example of a cloud platform whose shutdown left customers scrambling to
re-write their applications to run on a different platform. Of course, one
answer to lock-in is standardization, for instance GoGrid API.
Third-party
data control Threat #6. Transitive nature
Another possible concern is that the
contracted cloud provider might itself use subcontractors, over whom the cloud
user has even less control, and who also must be trusted. One example is the
online storage service called The Linkup, which in turn used an online storage
company called Nirvanix. The Linkup shutdown after losing sizeable amounts of
customer data, which some say was the fault of Nirvanix. Another example is
Carbonite, who is suing its hardware providers for faulty equipment causing
loss of customer data.