In the clouds: Some down-to-earth research is needed before moving to cloud computing.

• Author: Bradley, Susan
• Position: Data storage

Once the playground of military and university research institutions with large and expensive processors that can store and share data, "cloud computing" is fast becoming more affordable to businesses.

Not familiar with cloud computing? Well, have you ever checked e-mail via a web-based interface? If so, you've been in the clouds.

[ILLUSTRATION OMITTED]

Simply put, "in the cloud" or "cloud computing" refers to data that's housed at a data center rather than at your firm.

Three tech giants--Amazon, Google and Microsoft--have moved to provide the ability for rank-and-file businesses to use cloud computing. But before you look to the rainbow, there are some storm clouds.

Protecting, Accessing Data

Consider the most critical and sensitive data you have in your office, such as client data and financial information. Would you be comfortable if all of that data is on servers that you don't own and are located elsewhere? Would you be comfortable if you couldn't review the data center's physical security? And the most important question: what processes has the vendor taken to ensure the data is secure in the cloud?

The media is filled with stories of cross-site scripting attacks on web-based databases, which occur when a website has not been properly coded to limit the malicious use of code injected into it. If a website is not built to test for, and protect from, attacks, they could leave your data vulnerable. Don't assume that just because these vendors are in business they have tested for this issue.

Data access points are another key component to review. Do you access the data from a browser or a private network connection? Both can have security issues. If you access the information across web connection using an internet browser, the safety and security of the web browser is key. If you have an unsafe connection and the data transmission is not protected by a Secure Sockets Layer (or SSL) connection, the data transmission is at risk. The only place you can see this is between your web browser and that website. If the cloud is not securing your data after they receive it, either from web server to Structured Query Language (SQL) server, or from computer to computer, you will probably not know without some sort of external process review.

What data back-up procedures does the data center provide? Does it have redundancy and disaster plans? It's possible that cloud computing may provide more disaster protection than your own data protection...