Most businesses make use of cloud services to some degree. Whether it is occasionally dipping into a SaaS application when required or relying on cloud based services for all your computing and storage needs, there is almost always some of your private business data stored in the cloud. This raises questions around who holds ultimate control of data, and the storage location of your data. Surveys illustrate the level of concern: the 2017 McAfee State of The Cloud Survey underlines how only 23% of respondents fully trust public cloud providers to keep their data secure.
Control and ownership: do you have a say?
Clearly, making use of cloud services imply that your data is processed and controlled by a third party – or indeed a number of third parties. Understandably many businesses are concerned about retaining ultimate ownership of their data, which entails matters such as copyright, easy access and the removal of your data upon request. Thankfully, the widely used, established cloud storage services have very clear terms and conditions that outline your rights.
Typically, these will state that you retain full ownership of your data at all times and that you can request a copy of your data whenever you need to. It is not the established players that are a cause for concern. Businesses should be particularly alert when dealing with smaller, specialist providers who do not have policies and practices in place – especially when your technology partner outsources some aspects of computing and data storage to yet another provider.
Physical location of cloud assets
Cloud services are popular in part due to the cost savings on offer, and this is achieved by the large-scale centralisation of data storage and computing power. Some cloud providers will have several data centres, while others will have a central site and a mirror storage facility. It is not uncommon for cloud services to completely outsource storage and computing services to another provider – so your data may not even be controlled by the firm supplying services to you.
Data centres can be in a very different location from where the business operates: a London based firm could have all of its computing operations based in the US. Depending on your field of business and the type of data you handle, there are implications to offshoring data storage and processing. By making use of an off-shore cloud provider you could unwittingly be flouting data protection rules. To reduce risk, you may be able to initially choose where your data is stored. Moreover, many cloud providers offer fuss-free migration of entire cloud tenancies from one data centre to another, so you could move your data to a different country if circumstances or indeed legislation demand this.
Keeping control of your data
First and foremost, read the terms and conditions for every service you sign up for. If the data you are storing is of a confidential nature, enrol the help of legal experts to help you make sure that you are operating within the law when you choose your technology partner. Though most cloud service providers have extensive backup and redundancy facilities that you would find difficult to replicate on your own, there are other risks involved in storing data in the cloud which means that you still need to keep a local backup copy of your data.
Aside from the cloud provider itself going out of business, the risk of account intrusion or a large scale cyber attack leaves your data vulnerable. Though it is unlikely that data will be transmitted unencrypted by a company offering cloud services UK based companies should still check that there is an encryption layer present at all times.
Is it worth making use of cloud services, everything considered?
Considering the existing trends in the way information technology is provisioned, it is unlikely your company will be able to avoid cloud services altogether. You may decide to play it safe and keep your most business-critical data in-house, but either way it is important that technology leaders in your company stays aware of the risks associated around the storage and control of your company data – regardless of how much does end up captured by cloud providers. In essence you should get the storage and control aspects of cloud utilisation right regardless of your preference for the implementation of cloud services.