Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

3/25/2009
12:33 PM
Sara Peters
Sara Peters
Commentary
Connect Directly
Twitter
RSS
E-Mail
50%
50%

A Cloud Can Save You Money...But What If the Cloud Goes Broke?

I've been talking quite a bit about whether or not (not) users of cloud services can prove compliance with security, privacy and e-discovery laws. (Blog piece here. Alert issue here.) Now a story at The Register has me thinking about yet another issue--the inescapable question of financial stability.

I've been talking quite a bit about whether or not (not) users of cloud services can prove compliance with security, privacy and e-discovery laws. (Blog piece here. Alert issue here.)

Now a story at The Register has me thinking about yet another issue--the inescapable question of financial stability.From the story:

    Finally there is the question of the financial stability of the service provider. And more importantly what happens if they go out of business suddenly or simply choose not to carry on providing the Cloud / SaaS service? Essentially this comes down to questions of how can any data and other valuable information be retrieved at a forced end of service or when the customer simply decides to terminate the arrangement? Can data be retrieved simply and easily? How will the service provider ensure that it removes such data, and any backup / replica copies from systems and ensures that these are either destroyed or placed securely in storage where they cannot be accessed?

Although the security industry is overperforming, as compared to the rest of the IT market, the flagging global economy has spurred several high-profile mergers of security companies, and resulted in the abandonment of some security products/services. (There will be a session about the costs/benefits of vendor consolidation at CSI SX.) The big cloud providers, like Amazon and IBM, are probably safe, but cloud computing is still a new technology and the possibility of a budding cloud provider going under before it blooms is quite real.

So what happens to their servers if they go out of business? E-discovery and data retention laws may require that data be retained for up to three years--and we're not just talking about data protected by privacy law, we're talking about logs and metadata. No cloud providers that I'm aware of share logs and metadata with their customers in the first place--will a defunct cloud provider turn that over to their customers?

Existing law doesn't fully address these new e-discovery questions, but there is, however, the case of Flagg vs. ?? set legal precedent that a party's obligation to produce electronically stored information cannot be avoided simply by storing it with a third party. It's possible that cloud users could find themselves legally obligated to present data that they can't provide.

Nolan Goldberg, associate at Proskauer Rose LLP, will be discussing e-discovery and cloud computing at CSI SX, where he will be joined by Tanya Forsheit, partner at Proskauer Rose, who will discuss the international implications of never knowing where on earth one's data is stored at any given moment. Call me a dweeb, but I'm excruciatingly excited to see that one.

Comment  | 
Print  | 
More Insights
Comments
Threaded  |  Newest First  |  Oldest First
HackerOne Drops Mobile Voting App Vendor Voatz
Dark Reading Staff 3/30/2020
Limited-Time Free Offers to Secure the Enterprise Amid COVID-19
Curtis Franklin Jr., Senior Editor at Dark Reading,  3/31/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
6 Emerging Cyber Threats That Enterprises Face in 2020
This Tech Digest gives an in-depth look at six emerging cyber threats that enterprises could face in 2020. Download your copy today!
Flash Poll
State of Cybersecurity Incident Response
State of Cybersecurity Incident Response
Data breaches and regulations have forced organizations to pay closer attention to the security incident response function. However, security leaders may be overestimating their ability to detect and respond to security incidents. Read this report to find out more.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-11529
PUBLISHED: 2020-04-04
Common/Grav.php in Grav before 1.6.23 has an Open Redirect.
CVE-2020-11527
PUBLISHED: 2020-04-04
In Zoho ManageEngine OpManager before 12.4.181, an unauthenticated remote attacker can send a specially crafted URI to read arbitrary files.
CVE-2020-11528
PUBLISHED: 2020-04-04
bit2spr 1992-06-07 has a stack-based buffer overflow (129-byte write) in conv_bitmap in bit2spr.c via a long line in a bitmap file.
CVE-2020-11518
PUBLISHED: 2020-04-04
Zoho ManageEngine ADSelfService Plus before 5815 allows unauthenticated remote code execution.
CVE-2020-5347
PUBLISHED: 2020-04-04
Dell EMC Isilon OneFS versions 8.2.2 and earlier contain a denial of service vulnerability. SmartConnect had an error condition that may be triggered to loop, using CPU and potentially preventing other SmartConnect DNS responses.