How to safely integrate cloud computing into your company

Cloud computing is one of the hottest topics in business today. This innovation lets companies utilize massively scaled information research infrastructure at a remote site instead of their own data center, resulting in increased redundancy, security and significant cost savings.

The cost of purchasing

"The cost of purchasing and maintaining the infrastructure internally and the salaries of people to operate the infrastructure continues to increase, during the cost of obtaining it on a larger scale from cloud service providers continues to decrease," says Michael Dickson, CPA, CISA, CISM, CRISC, director, business innovation services at GBQ Partners LLC. "The result of these two trends is an intersection of the cost models for computing."

There is much confusion about what cloud computing is, because there are so many different kinds of cloud service offerings. Cloud computing is nothing more than a new name for an old concept.

Provider's application

Cloud services enable you to connect to a provider's application, deploy, run and manage your own applications on a provider's computing resources, or you can deploy, run and manage your own applications that were created using programming languages, databases and tools supported by the provider. In each of these models, the provider and management have different responsibilities as it relates to owning and managing the operating and application systems.

Remotely hosted applications, like Office 365 and SalesForce.com are perfect examples of using SaaS. The applications are developed, owned and hosted on providers' infrastructure, and users subscribe to the services they need and connect over any network.

Examples of IaaS are products like Amazon's Web services and Rackspace's cloudfiles. Subscribers pay for the amount of computing or storage they need, relying on the provider to manage and maintain the infrastructure.

The benefits

You need to understand the benefits and risks, because they will vary for each company depending on which service type you are considering. The key is to understand your specific risk posture by assessing the application landscape, the type of data processed and understanding the in a class by itself accessibility, confidentiality, security and compliance requirements of your specific situation. This will drive the decision on what should be 'put in the cloud.' Moving into the cloud doesn't have to be an all-or-nothing proposition. You can start by putting a low risk commodity application in the cloud, and keep your high-risk core business applications on site until you get more comfortable with how it works for you.

It's safe if you choose your provider carefully and structure your agreement properly. The biggest misconception is that you don't know what's happening to your data when they are in the cloud. If you select the right service partner, they will have implemented the appropriate security and physical and logical access controls to prevent others from gaining access to your computing environment.

The big benefits are cost savings

The big benefits are cost savings and increased reliability/availability resulting from economies of scale. If a business has a peak time, it can take advantage of extra processing capabilities for that peak period, however doesn't have to maintain and own all of the computing capabilities all year round. Computing is becoming a utility. Like electricity or natural gas, you pay for what you use.

People as well fear they will lose control of their computing capabilities, and that can be good or bad, nevertheless it needs to be addressed. They're fearful that if they get into a fee dispute with their provider, or become unhappy the level of service provided, the service provider holds all of their eggs in their basket. You can mitigate these risks by structuring the agreement to address users' rights to data when all is said and done of a dispute and by implementing solutions that provide real time back-up outside of the cloud.

Michael Dickson, CPA, CISA, CISM, CRISC, is director, business research services at GBQ Partners LLC. Reach him at 947-5259 or mdickson@gbq.com.