Some random cloudy thinking
Thanks to the announcement of Apple’s iCloud, I’ve been forced to answer several inquiries about The Cloud this week. Now, I’m coming out of hiding to subject all of you to some of it…
The thing that you must never forget about The Cloud is that once information moves to The Cloud, you’ve inherently ceded control of that information to a third party and are at their mercy to protect it appropriately–usually trusting them to do so in an opaque manner.
What does that mean? Well, start with the favored argument for The Cloud, the mighty “cost savings.” The Cloud is not cheaper because the providers have figured out some cost savings magic that’s not available to your IT department. It’s cheaper because their risk tolerances are not aligned to yours, so they accept risks that you would not merely because the mitigation is expensive.
Argument #2 is that it’s faster to turn up capability in the cloud–also a self-deception. For anything but the most trivial application, the setup, configuration, and roll-out is much more time consuming than the infrastructure build. Even when avoiding the infrastructure build produces non-trivial time savings, those savings are instead consumed by contract negotiations, internal build-vs-rent politics and (hopefully) risk assessments.
Finally, The Cloud introduces a new set of risks inherent in having your information in places you don’t control. This morning, for example, Bruce Schneier again mentioned the ongoing attempts by the FBI to convince companies like Microsoft/Skype, Facebook and Twitter to provide backdoor access to unencrypted traffic streams from within their own applications. These risks are even more exaggerated in products where you’re not the customer, but rather the product being sold (e.g. Facebook, twitter, Skype, etc.). There, the customer (i.e. the Person Giving Them Money) is an advertiser or the FBI, et. al. Your privacy interests are not (at least in the eyes of Facebook, et. al.) Facebook’s problem.
For those of you that like metaphors, in the physical world, I don’t (usually) choose to ride a motorcycle without full safety gear (helmet, jacket, pants, gloves, boots, brain). I do, however, drive a car with only a minimum of safety gear (seatbelt, brain) because the risk profile is different. In the Information Security world, I don’t usually advocate putting information whose loss or disclosure would impact our ability to ship products or maintain competitive advantage in the cloud (unless required by law, a Problem I Have) for the same reason.
That’s not to say that I’m opposed to the cloud–I’m actually a fan of it where it makes sense. That means that I use the cloud where the utility exceeds the risk. Cost is rarely a factor, to be honest. But just like any other high-risk activities I engage in, I think it’s important to make honest, informed choices about the risks I’m accepting and then act accordingly.