GAIN CLARITY CRITICAL ISSUES. Your Data in the Cloud : Benefits & Risks GAIN CONTROL. berrydunn.com

Transcription

1 GAIN CLARITY CRITICAL ISSUES Your Data in the Cloud : Benefits & Risks berrydunn.com

2 AGENDA Defining Cloud Services Benefits and Risks Core Requirements Myths about Clouds Is Your Data in the Cloud Secure? Steps for Managing Risk Conclusions

3 CLOUDS & MORE CLOUDS IaaS PaaS SaaS EaaS

4 MOST COMMON? Infrastructure as a Service (IAAS) Provides: Servers and Databases Storage Routers and Firewalls Network resources A virtual, on-demand data center Accessible from anywhere on the Internet Storage 17% Platform 6% Hybrid 14% Applications 18% Infrastructure 27% Private 18%

5 OUTSOURCED INFRASTRUCTURE Benefits Reliability Availability Reduced Cost (?) Resources to implement new technology

6 WHY IAAS WORKS Provides a ready-made technology architecture Shifts infrastructure costs to an external entity Allows a business to focus on core competencies

7 AND WHY IT DOESN T. Add-On services add hidden costs Everyone is doing it Over-hype causes over-buy

8 MYTHS ABOUT CLOUD SERVICES 1. Cloud services will cut costs 2. No more IT worries 3. Data is automatically backed up 4. The service will never go down 5. The service provider is responsible for security 6. Data is kept private and confidential

9 CLOUD SERVICES WILL CUT COSTS Yes, but: Only if your business is the right size Only if you negotiate up front for all service costs Only if you choose a responsible and reliable vendor

10 NO MORE IT WORRIES Not really! Who is managing what? Never Assume: they are managing everything

11 MY DATA IS AUTOMATICALLY BACKED UP

12 MY DATA IS AUTOMATICALLY BACKED UP Not really! Never Assume: Data is backed up and tested periodically Storage and backup devices are redundant

13 THE SERVICE WILL NEVER GO DOWN Major cloud services have experienced outages Clouds dependent on other clouds go down too! Outages can (and do) cause data loss

14 THE SERVICE WILL NEVER GO DOWN

15 CROSS YOUR FINGERS

16 THE SERVICE PROVIDER IS RESPONSIBLE FOR SECURITY Not.really Cloud vendors have wildly differing security offerings Good IT security practices may not be in place (Do they have an annual independent assessment?) Monitoring & reporting may incur additional cost

17 DATA IS KEPT PRIVATE & CONFIDENTIAL Employees of the cloud service can see your data The Feds can access your data without your consent If the provider goes into bankruptcy, or shuts down suddenly, your data may be in the wind. Law Enforcement might impound your data as part of an investigation into someone else

18 RISKS FROM A CLOUD DATA BREACH Business Profits Employee Productivity Data Integrity Business Reputation Lawsuits Regulatory fines

19 MANAGING YOUR RISK 1. Determine if you are the right business size/type to take advantage of IaaS 2. Identify proprietary data that must be protected 3. Assess the impact of outages/breaches 4. Identify the services you require 5. Put safeguards into the contract

20 DUE DILIGENCE WITH CLOUD SERVICES PROVIDERS Ignore the sales pitch and focus on what you want Prepare a list of criteria Determine if provider uses sub-contracted services Research provider business history & stability

21 PUBLIC, PRIVATE OR HYBRID?

22 PUT IT IN WRITING: CONTRACT REQUIREMENTS Exact demarcation of services Specific reporting criteria for outages & breaches Specific Service Level Agreement with delineated service times Delineate clear ownership of your data Require documented security policies & procedures

23 PUT IT IN THE CONTRACT PART 2 Require specific locations (logically & physically) where your data will be stored, as well as notification of any changes Specific remediation and termination criteria (Don t let your data be held hostage!) Specific support levels Have an expert vet the contract

24 CONCLUSION

25 CONTACT INFORMATION We are always available for your questions. Eigen Heald berrydunn.com