31 March 2015

Is the cloud secure? It depends

By Andrew Clifford

If you ask a cloud vendor whether their solutions are secure, I am sure they would say "yes". They'll talk about server security, encryption, access controls, monitoring, and so on. But do all these controls really mean your data is safe, or not?

I have always struggled with this, as both a consumer and a provider of cloud-based solutions. But in an "aha!" moment last week, I finally found a useful analogy: self-storage.

As houses have got smaller and we've all acquired more stuff, many people are turning to self-storage units to store their excess belongings. And with the rise of Internet-based retailing, many small businesses now use self-storage units as mini-warehouses. Self-storage is booming.

Are self-storage units secure? Well, that depends.

The providers put a lot of effort into security. As Big Yellow states, "Every customer has their own PIN code to access the storage areas, plus we have staff on site seven days a week, 24 hr digital CCTV, perimeter fencing and electronic coded gates." You can be sure that your old furniture, or a job lot of teddy bears and toasters, will still be there when you next visit.

But if you had £100 million in gold bullion, would you put it there? No, of course you wouldn't. It's not Fort Knox. You would want military-style security, biometric access, bomb-proof premises, and all sorts, before you would trust it with something so valuable and such a target for theft.

That's not because there's any flaw in self-storage security, but because of what its aiming to do. The sort of security measures it has – such as simple PIN code access – are entirely appropriate for a cheap and accessible public-facing service.

Public cloud solutions are the same. They are likely to be more than sufficient for most of your data. But some of your data might be very sensitive, or subject to specific regulations, and that prevents you from holding it in a shared, public facility, however secure.

This has helped me to understand how to answer questions about whether our Metrici service is secure. The simple answer is "yes", and I can talk about secure servers, encryption, data ownership, data separation, user management, monitoring, and so on. For nearly all customer requirements this provides more than enough security while maintaining usability and excellent value.

But if some customers are still concerned, the self-storage analogy helps me understand that I shouldn't just keep going on about how secure our solution is. Instead, I need to ask them whether they would ever be satisfied with a shared, public service. If they wouldn't, this isn't a weakness of our solution, and I need not defend it as if it were. We can explore the costs and benefits of running a private instance for them. Do they really need this, and is it worth the extra cost?

Security is not black and white. You would be crazy to keep gold bullion in a self-storage unit, but you would also be crazy to keep your old furniture in Fort Knox. It all depends.