Cloud computing is changing the way companies are developing and deploying business applications.

What is cloud computing?

Cloud computing is a concept as well as a method for outsourcing computing activities to the Internet (ie, cloud). Think of a public service utility such as the electric company that delivers electricity to your home or business through power lines. The electric company owns and operates the infrastructure and delivers the electricity, which consumers pay for based on consumption. Conceptually, this is much like how cloud computing works. Companies may either use a third-party, such as Amazon’s Elastic Cloud Computing (EC2) service to host their applications and data or use a third-party application such as Salesforce.com. In either case, users access applications from anywhere utilizing only a web browser with an Internet connection. Cloud computing reduces costs in most cases, because companies only pay for what they use and can reduce the capital expenditures associated with an information technology (IT) infrastructure build out. If you have ever used Google Apps for e-mail, calendaring, or word processing, you have used cloud computing!

What are the risks of cloud computing?

Companies can outsource the IT infrastructure, hosting, and storage of their applications and data to a cloud computing environment; however, risks still remain. The following are some business risks to consider when companies contemplate a switch to a cloud computing platform managed by a third-party:

• Security – Effective security controls are paramount to prevent unauthorized individuals or entities from accessing confidential information. If the third-party service organization does not have strong security or access controls, data and application functionality could be compromised. Moreover, investigating security incidents or breaches can be more difficult in cloud computing environments, because incident logging may extend across an ever-changing set of hosts and data centers.
   
• Continuity – Third-parties should have an appropriate infrastructure and business plans in place to continue their services in the event of a disruption such as a disaster. Companies are in effect outsourcing the responsibility to maintain business continuity to third-party service organizations that provide cloud computing services.
   
• Availability – Users must be able to rely on the availability of accessing applications and/or data over the Internet. Without sufficient availability, user productivity will suffer and potential cost savings from using cloud computing will be negated.
   

How can risks be mitigated?

Risks can be mitigated by doing your research on your cloud computing provider. Ask third-parties what controls are in place for securing your applications and data. Request information on their disaster recovery plan. Review the provider’s security certifications. A SAS 70 report is often very useful in communicating the controls third-parties have placed in operation specific to the cloud computing services provided.

Also consider that although cloud computing can be an economical and beneficial IT solution, not all applications and infrastructure has to be moved to the cloud. Evaluate how vital each application, business process, and data set is to the business and consider placing less critical functions on the cloud.