Michael Crandell, CEO of Rightscale, once described cloud computing as "the notion of providing easily accessible compute and storage resources on a pay-as-you-go, on-demand basis, from a virtually infinite infrastructure managed by someone else. As a customer, you don't know where the resources are, and for the most part, you don't care."

It’s true that individuals use services like Yahoo Mail to create, send, receive and store e-mail. They use Flickr and Photobucket to store pictures, and they share all kinds of information on Facebook and Twitter without much thought of where their information actually resides or who is managing it. As long as the sites and services work properly, everyone goes about his or her business.

But Crandell's definition -- or at least the "don't know, don't care" part of it -- only works for individual users, for what Proskauer Rose associate attorney Nolan Goldberg likes to call "consumer-grade cloud computing." "Commercial-grade" cloud computing, however, requires something completely different. Because for businesses, not knowing or caring where the resources reside and how those resources are managed will cause problems that keep compliance and security professionals up at night.

Computer Security Institute Senior Editor Sara Peters says data owners that use the cloud "surrender the ability to adequately secure the network infrastructure, they surrender the ability to collect the logs so often necessary to prove compliance, but they cannot surrender liability." Tom McHale, product management VP at CA, agrees with Peters, to a point. "The fact that you're putting [data] on a cloud doesn't mean you can forget about it," McHale says. But he doesn't think the business that buys extra storage or computing power "surrenders" much of anything. It becomes part of the company's infrastructure, regardless of where it is physically. As such, McHale says, it should be "managed like ... normal infrastructure."

Since data privacy and security laws don't yet address many of the issues raised by cloud computing, the challenge lies in figuring out how to properly manage data in the cloud while remaining compliant. Goldberg and Proskauer Rose partner Tanya Forsheit say the best way to do that is to get to know the vendor well, and negotiate the terms of the service agreement in detail.

For instance, Forsheit says companies should know where their vendor's servers reside so they can determine which national privacy laws apply to their data and design policies and controls according to that country's requirements. "If you don't know where your data is, where it's actually residing -- which, frequently you're not going to know, if it's in the cloud being hosted by a third party somewhere -- you could very well be running afoul of the EU data protection directive," she says.

Previous Page Next Page