Cloud Computing’s Hidden Perils

Yesterday, I logged on to my Xdrive online storage account and was startled to see this message, instead of the usual start screen: On January 12, 2009, AOL will permanently close the Xdrive Online Storage Service. Also on screen was a link to let me download my entire account (copied into a zip file). For now, I can still access my files on Xdrive, but what if I hadn’t needed to access my account for the next couple months? (I use Xdrive primarily as a backup for my music files, so I don’t have reason to access it very often.) Would AOL have notified me by email to give me enough notice to get my files off Xdrive before it shut down?

After this experience, I thought about some of the comments I’ve seen from the Windows IT Pro community re cloud computing, especially why some IT pros are hesitant to dispatch their organizations’ essential applications and valuable data into the cloud. For example, in response to Paul Thurrott’s November 4 WinInfo item about Windows Azure, Bruce Boyce said, “In our [business], the clients have privacy & security issues to deal with and that can't be adequately dealt with in a cloud environment. Besides, if the host system goes down, who's responsible for making us whole again due to lost business?”

Bruce, I’m right there with you on this one. Cloud vendors may assure customers that their data is secure—but what about the cloud vendors themselves? Are they liable for losses your business may incur should the vendor go out of business and you no longer can access your applications or data? How do you ensure business continuity in the event that your cloud vendor, who seemed viable yesterday, overnight announces bankruptcy and closes its doors or is acquired by a company that wants to divest itself of the very services your business is running on?

ZDNet’s Software as Services blogger Phil Wainewright agrees. He starts his blog, “Back up your online data. Now.” this morning with this ominous line: “The dark side of the cloud is the risk of financial failure at your provider.” He goes on to discuss former online photo archiving site Digital Railroad as a cautionary tale for businesses and consumers (like me) who have succumbed to the allure of the cloud. Without warning its customers, primarily professional photographers, Digital Railroad shut down in late October and, when it couldn’t find a buyer for the company, announced that its secured creditor had seized the hardware on which its more than 1,500 customers had their copyrighted images stored.

Phil goes on to say that he doesn’t think the risks of cloud computing service providers going out of business are serious enough to steer businesses away from the cloud. Nevertheless, his advice—to have a “backup” backup strategy—seems to me to negate the whole point of cloud computing. If I need to back up all my iTunes files to a Zip drive just in case something happens to my online backup, do I really need the online backup in the first place? And where does this leave businesses, especially small-to-midsized businesses (SMBs) that stand to benefit the most from offloading their applications, IT management, and storage into the cloud? An unrecoverable loss of essential data assets like what happened for Digital Railroad customers could kill an SMB.

The best strategy for dealing with the risks of cloud vendors is to mitigate them before you move your applications and data into the cloud. Do what you can to protect your business before you sign a contract with a cloud or software as a service (SaaS) provider. As with any other software investment, check out the vendor’s track record of meeting its customer obligations. As Wainwright notes, business customers may need to insist on some kind of assurance of service continuity, at least for a short-term period, should the vendor go out of business. And read the fine print in those contracts. Hosted services' terms of service, for example, often include limitations of liability, stating, basically, that you use the service at your own risk and the hosting provider isn’t liable for damages for losses of data, revenue, and business. Look for providers that provide SLAs (e.g., Rackspace, Apptix’s Mi8 Hosted Exchange). The clearer your service guarantees from cloud vendors, the better off your business will be should you lose those services unexpectedly.