Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

3/25/2009
12:33 PM
Sara Peters
Sara Peters
Commentary
Connect Directly
Twitter
RSS
E-Mail
50%
50%

A Cloud Can Save You Money...But What If the Cloud Goes Broke?

I've been talking quite a bit about whether or not (not) users of cloud services can prove compliance with security, privacy and e-discovery laws. (Blog piece here. Alert issue here.) Now a story at The Register has me thinking about yet another issue--the inescapable question of financial stability.

I've been talking quite a bit about whether or not (not) users of cloud services can prove compliance with security, privacy and e-discovery laws. (Blog piece here. Alert issue here.)

Now a story at The Register has me thinking about yet another issue--the inescapable question of financial stability.From the story:

    Finally there is the question of the financial stability of the service provider. And more importantly what happens if they go out of business suddenly or simply choose not to carry on providing the Cloud / SaaS service? Essentially this comes down to questions of how can any data and other valuable information be retrieved at a forced end of service or when the customer simply decides to terminate the arrangement? Can data be retrieved simply and easily? How will the service provider ensure that it removes such data, and any backup / replica copies from systems and ensures that these are either destroyed or placed securely in storage where they cannot be accessed?

Although the security industry is overperforming, as compared to the rest of the IT market, the flagging global economy has spurred several high-profile mergers of security companies, and resulted in the abandonment of some security products/services. (There will be a session about the costs/benefits of vendor consolidation at CSI SX.) The big cloud providers, like Amazon and IBM, are probably safe, but cloud computing is still a new technology and the possibility of a budding cloud provider going under before it blooms is quite real.

So what happens to their servers if they go out of business? E-discovery and data retention laws may require that data be retained for up to three years--and we're not just talking about data protected by privacy law, we're talking about logs and metadata. No cloud providers that I'm aware of share logs and metadata with their customers in the first place--will a defunct cloud provider turn that over to their customers?

Existing law doesn't fully address these new e-discovery questions, but there is, however, the case of Flagg vs. ?? set legal precedent that a party's obligation to produce electronically stored information cannot be avoided simply by storing it with a third party. It's possible that cloud users could find themselves legally obligated to present data that they can't provide.

Nolan Goldberg, associate at Proskauer Rose LLP, will be discussing e-discovery and cloud computing at CSI SX, where he will be joined by Tanya Forsheit, partner at Proskauer Rose, who will discuss the international implications of never knowing where on earth one's data is stored at any given moment. Call me a dweeb, but I'm excruciatingly excited to see that one.

Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 4/10/2020
Zscaler to Buy Cloudneeti
Dark Reading Staff 4/9/2020
The Coronavirus & Cybersecurity: 3 Areas of Exploitation
Robert R. Ackerman Jr., Founder & Managing Director, Allegis Capital,  4/7/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: Yes, I do have virus protection on my system, now what?
Current Issue
6 Emerging Cyber Threats That Enterprises Face in 2020
This Tech Digest gives an in-depth look at six emerging cyber threats that enterprises could face in 2020. Download your copy today!
Flash Poll
State of Cybersecurity Incident Response
State of Cybersecurity Incident Response
Data breaches and regulations have forced organizations to pay closer attention to the security incident response function. However, security leaders may be overestimating their ability to detect and respond to security incidents. Read this report to find out more.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-11669
PUBLISHED: 2020-04-10
An issue was discovered in the Linux kernel before 5.2 on the powerpc platform. arch/powerpc/kernel/idle_book3s.S does not have save/restore functionality for PNV_POWERSAVE_AMR, PNV_POWERSAVE_UAMOR, and PNV_POWERSAVE_AMOR, aka CID-53a712bae5dd.
CVE-2020-1801
PUBLISHED: 2020-04-10
There is an improper authentication vulnerability in several smartphones. Certain function interface in the system does not sufficiently validate the caller's identity in certain share scenario, successful exploit could cause information disclosure. Affected product versions include:Mate 30 Pro vers...
CVE-2020-3952
PUBLISHED: 2020-04-10
Under certain conditions, vmdir that ships with VMware vCenter Server, as part of an embedded or external Platform Services Controller (PSC), does not correctly implement access controls.
CVE-2020-4362
PUBLISHED: 2020-04-10
IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 traditional is vulnerable to a privilege escalation vulnerability when using token-based authentication in an admin request over the SOAP connector. IBM X-Force ID: 178929.
CVE-2020-1802
PUBLISHED: 2020-04-10
There is an insufficient integrity validation vulnerability in several products. The device does not sufficiently validate the integrity of certain file in certain loading processes, successful exploit could allow the attacker to load a crafted file to the device through USB.Affected product version...