Feeds

Cloud storage: It's strictly for airheads

Time to back up on blind faith

3 Big data security analytics techniques

Comment Cloud storage is fatally flawed right now. After the chaotic outage of Microsoft's Sidekick T-Mobile service and the collapse of SwissDisk's filers, what sensible business is going to entrust their data to the cloud?

Big brands, with their reputation for reliability, give no guarantee of cloud storage trustworthiness. T-Mobile is a solid and trustworthy mobile phone service provider yet it lost users' data. Microsoft runs Hotmail, has its own mega-data centres, and has ambitions to parlay its years of experience into the Azure cloud service - yet it still lost Sidekick users' data.

It gets worse. The Sidekick data loss wasn't due to a failure in Microsoft's infrastructure, as no Microsoft-based Windows-based infrastructure was used at all. It was seemingly based on Sun Linux and Solaris servers, an Oracle Real Application Clusters database and Sun back-end storage that Microsoft was unfamiliar with.

The service wasn't run according to Microsoft in-house standards at all, but users would not know this. They wouldn't know that the Mobile brand and the Microsoft brand were just wrappers around a third-party service.

In the cloud it's not just data that vanishes, it's the ability to verify what is actually happening to it. Brands are surface things in the cloud with no guarantee at all that you can trust what goes on beyond them inside the cloud or verify it either.

Buy a notebook computer from Dixons, Comet, PC World or Carphone Warehouse in the UK and sign up for an online backup service. You have no idea who actually provides the service, where their data centres are and what infrastructure and processes are involved in looking after your data. Sure, it may say “powered by Spare Backup”, but what does that mean to the average user?

Buy an online backup service from Mozy, Carbonite or a cloud storage service from Nirvanix, Google or Amazon, or from any of the myriad other local, regional and national services springing up, and you have no idea at all of the data centre infrastructure, products and processes involved. You just throw your data in and hope that they look after it properly. You can't verify that they do. It's a matter of blind faith.

That faith can be misplaced. If SwissDisk, T-Mobile, and Microsoft can fail to look after your data then anybody can. A brand is no guarantee of trustworthiness, not without the ability to know what’s going on. As Ronald Reagan said: “Trust, but verify.”

Any business, tiny, small, medium or massive, that entrusts its data to the cloud today without having its own local backup is being irresponsible. It's gambling with its data. If the data is mission-critical then the business' director or executive in charge of that decision should be fired.

It is totally unrealistic to expect users to have the ability to verify a cloud service provider's infrastructure and processes. Such things will be regarded as sensitive commercial information by them anyway. There has to be regulation if there is no public verification. The state won't get involved so the industry will have to regulate itself.

The good news is that this isn't rocket science. It's what trade associations of professional service providers do already. They self-regulate by certifying members behave according to standards and carry sufficient insurance for the risks they run if they make mistakes. Look at dentists, lawyers, civil engineers or any other trade professional person or business - they all sport the distinction of their professional body and its standards.

What we need is a code of practice backed up by membership of a Cloud Storage Providers' Association with certification for members. No business should contract for cloud storage services from suppliers who are not members of such a CSPA body, and the CSPA should rigorously enforce the creation of a minimum acceptable standard of service; and also rigorously police its members and throw out suppliers who fail to meet the standard.

Every cloud storage provider with a belief that they are an honest business providing a good and solid service should see the sense of this, and start making moves for a CSPA-type body to come into being. Without it cloud storage services will be offered by cowboys and incompetents, who lose users data, as SwissDisk, T-Mobile and Microsoft have.

Cloud storage needs open standards for the custodianship of users' data, and only a reputable trade body can provide it. What is the industry waiting for? Do we need another SwissDisk, another Sidekick before it will act? ®

SANS - Survey on application security programs

More from The Register

next story
This time it's 'Personal': new Office 365 sub covers just two devices
Redmond also brings Office into Google's back yard
Kingston DataTraveler MicroDuo: Turn your phone into a 72GB beast
USB-usiness in the front, micro-USB party in the back
Dropbox defends fantastically badly timed Condoleezza Rice appointment
'Nothing is going to change with Dr. Rice's appointment,' file sharer promises
BOFH: Oh DO tell us what you think. *CLICK*
$%%&amp Oh dear, we've been cut *CLICK* Well hello *CLICK* You're breaking up...
Just what could be inside Dropbox's new 'Home For Life'?
Biz apps, messaging, photos, email, more storage – sorry, did you think there would be cake?
IT bods: How long does it take YOU to train up on new tech?
I'll leave my arrays to do the hard work, if you don't mind
Amazon reveals its Google-killing 'R3' server instances
A mega-memory instance that never forgets
Cisco reps flog Whiptail's Invicta arrays against EMC and Pure
Storage reseller report reveals who's selling what
prev story

Whitepapers

Designing a defence for mobile apps
In this whitepaper learn the various considerations for defending mobile applications; from the mobile application architecture itself to the myriad testing technologies needed to properly assess mobile applications risk.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.
Five 3D headsets to be won!
We were so impressed by the Durovis Dive headset we’ve asked the company to give some away to Reg readers.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Securing web applications made simple and scalable
In this whitepaper learn how automated security testing can provide a simple and scalable way to protect your web applications.