Security in the Cloud
When evaluating cloud computing, organisations are of course concerned about security issues. Information is hosted elsewhere, often offshore. Legal aspects are important for wider security considerations, although reputational risk of a security breach can be more significant.
Thu, March 25, 2010
IDG News Service — When evaluating cloud computing, organisations are of course concerned about security issues. Information is hosted elsewhere, often offshore. Legal aspects are important for wider security considerations, although reputational risk of a security breach can be more significant. The risk of security/privacy breach may be lower overall with cloud computing than applies in the status quo (for example on-site processing of data). In assessing whether to move to cloud computing, it is important to compare with the benefits and risks of the status quo. I outlined this in my earlier column CIO article, The Case against Cloud Computing revisited (See CIO August 2009 and http://cio.co.nz/cio.nsf/opin/9AD644B12571BCC0CC257610000176AA), picking up on the same theme in Bernard Golden's excellent CIO article, The Case against Cloud Computing.Privacy and security risks?It's not just about privacy legislation. People often discuss cloud computing as though the considerations stop and start with privacy legislation. There is general law that applies too, such as the law in relation to negligence, contract, confidentiality and so on. However, following the principles in the Privacy Act will often lead to compliance with other legal obligations as well. Privacy ActFor cloud computing, the key obligation is in Information Privacy Principle 5 in the Privacy Act. This requires:• The New Zealand organisation to protect information with such security safeguards as are reasonable in the circumstances; • If it is necessary to give information to a third party (for example a cloud computing service provider), that New Zealand organisation must do everything reasonable in its power is done to prevent unauthorised use or disclosure. For cloud computing, several conclusions flow from this:• 100 percent security protection is not required. What is called for is protection of information by such safeguards as are "reasonable in the circumstances to take". • Robust industry practice, codes, and so on, are likely to be relevant in determining the appropriate approach.• If the organisation (for example the New Zealand-based company using cloud computing services) gives information to a cloud computing provider, that organisation must "ensure ... that everything reasonably within [its] power ... is done to prevent unauthorised use or unauthorised disclosure of the information". This obligation applies whether the cloud computing provider is based in New Zealand or offshore.• That obligation also means that the New Zealand-based organisation often won't be able to rely solely on, for example, a supply contract under which the provider takes
