Network security is my Job. I have to answer to auditors, demonstrate we’re treating the data properly, that the wrong people can’t get to it, and that we know the wrong people can’t get to it.
The cloud gives me the willies, but for reasons not immediately obvious.
When someone breaks into your house and steals your laptop. You dial the local police department.
When someone uses your credit card in a truck stop one-state-over, you have the FBI to help in inter-state jurisdictional stuff.
When someone from Azerbaijan steals your data, hosted in South America, who do you call?
Likewise: there is a Security truism: If someone can touch your hardware, they can own your hardware.
If your stuff is running in a Virtual Machine, at a Cloud Hosting Provider, then the person running the management console doesn’t even have to physically touch your hardware to own it. Or the Baddie that manages to elevate his privileges to that level.
There’s also Murphy’s Law…what happens when your data is shifted to a 3rd party cloud provider after their acquisition, then the Government that controls that portion of the internet turns it off?
Many hosting providers do not charge for uploading your data, and charge reasonable rates to host it…but then charge you to get it back off…do you have that war chest set aside for that possibility? No? Ever had a business relationship go sour?
The reason that Storage places are such a good, safe investment is: If the tennant stops paying, they have his stuff!
Lots of doom and gloom. Frankly, I think in 10 years or so, cloud hosting will be the norm. The niggling issues will have been worked out, and the economy of scale the hosting providers work at will safe lots of money.
I also think it’s a good value for all but the largest companies. A small Mom and Pop shop stores their first byte at a hosting provider and that data is suddenly fault tolerant and redundant…a service they really wouldn’t want to stand up themselves. That data is also protected by Armed Guards, in a facility with back-up generators and multiple connections to the internet.
Encryption and co-location and onsite backups can go a long way to minimise the concerns, but it’s helpful to at least think through the issues first.