Pros And Cons Of Cloud Computing
______________________________________________________________
By Robert E. Braun
Law360, New York (January 20, 2011) -- On Oct. 29, 2009, the city of Los Angeles announced that it was outsourcing its e-mail services to Google Inc., becoming the largest governmental body to outsource such a key computer function to an Internet-based provider to that time. Before and since, both large companies and small have elected to move key entity functions to services that are accessed through the Internet.
This growing trend to Internet-based computing services — “cloud computing” — has, over the past few years, become one of the most significant developments in computing services. This article will define cloud computing and discuss some of its benefits; review key business, legal and strategic challenges of cloud computing; and offer tips for addressing those challenges.
What is Cloud Computing?
While there are many concepts of cloud computing, cloud computing today generally refers to delivering computing power — whether in the form of software, storage capacity or other products and services — over the Internet. Cloud computing makes documents, e-mails and other data accessible from any personal computer or mobile device with access to the Internet.
This is not really a new development — many things work this way already, from online search engines to e-mail and photo albums to calendars and shared documents. Most of us use the cloud every day, by accessing search engines, social networks and e-mail. What has become different, and what makes this trend important, is that companies use it to transfer essential business functions from in-house operations to Internet-based services.
Benefits of Cloud Computing
Users find cloud computing is attractive because of some clear benefits:
Cost Savings
First and foremost, promoters and adherents of cloud computing argue that it is less expensive than providing the same computing services in-house.
While the per-unit costs of computer hardware and software — computers, servers, routers, operating systems and computer programs — have fallen over the years, it is still expensive to establish and maintain extensive computer systems that are necessary for businesses. Many users find that moving computing services into the Internet moves those data center costs from the customer to the cloud computing vendor, including software and hardware acquisition, operating and maintenance costs.
Even if the hardware and the software is no less expensive, outsourcing computer services allows companies to reduce real estate costs (through reduction in operating space), payroll, benefits and insurance costs. Many companies find the savings realized from moving to the cloud to be compelling.
Economies of Scale
These savings are achieved in large part because of economies of scale — a vendor can offer the service for less than similar services on an in-house standalone basis. Cloud computing vendors can choose the most efficient locations for services, and share resources among multiple clients that would otherwise have to be replicated by each individual client.
Vendors can also focus on utilizing their resources more efficiently. Inherent in this thought is that companies that limit their services to providing computing resources are experts; companies that use computers to support their core businesses cannot focus as clearly on a support service.
Reductions in Personnel
Along with economies of scale, customers of cloud services are able to reduce their technical staff. The technical personnel required to maintain a company’s data center move from the customer to the vendor, and while customers may still need desktop technical support, vendors reduce this cost through remote tools, allowing the vendor to access workstations on-site to diagnose and resolve issues.
It should be noted that reductions in personnel (without, presumably, a reduction in service) not only reduce direct personnel costs for salaries, benefits, office space and the like; the personnel issues related to having a data center move from the customer to the vendor can shift potential liability associated with a work force.
Scalability
Particularly important in uncertain economic times, cloud computing is typically scalable. Customers can, with relative ease and speed, increase or decrease resources to reflect their needs. The cost of the cloud service typically fluctuates with the increases and decreases, subject to contract restrictions.
As a result, a customer does not have to maintain unused resources to meet fluctuating demands or to anticipate growth, and can eliminate unnecessary resources if business declines; cloud computing services can be contracted on an as-needed, when-needed basis, without requiring the client to create substantial infrastructure which may not be needed.
And as companies grow, they can quickly add resources which allow them to take advantage of business opportunities and secure additional revenue, often at a marginally additional cost.
Mobile Work Force
Cloud computing accommodates mobile users and mobile applications quite effectively because it is accessible through the Internet, a factor that is particularly important as a work force becomes more mobile.
While much of the evidence is anecdotal, as companies seek ways to reduce costs, reducing their real estate footprint becomes desirable, and one way to achieve that is through a mobile work force. Since cloud services are accessed through the Internet, there is no appreciable difference or advantaged gained by having a localized work force.
Just as importantly, workers more often seek a mobile platform that can be accessed from multiple locations. Using cloud computing can be part of a plan to attract and retain key, motivated personnel.
Quality and Responsiveness
Vendors of cloud computing services also argue that the quality of technical services will increase by moving to the cloud. Cloud computing services are commonly focused on a small number of specialized programs or services — for example, customer relationship management, or data storage. With this kind of focus, vendors can develop a level of expertise and redundancy that cannot be expected by typical technical staff, particularly for small and midsized companies.
Again, by making the service or product a core function of a company, rather than an expensive support mechanism, customers seek to gain a benefit not just in cost, but in quality. Since the cloud vendor spreads the costs of these expensive resources across a group of customers, it can afford to retain the highest quality personnel. And the per-unit cost can be less than the cost for comparable resources on an individual customer basis.
Disaster Recovery and Business Continuation
An added benefit of cloud computing is its dual purpose as both a current, functioning service and a business continuation and disaster recovery service. Internet-provided services have this capability because, unlike an in-house data center, they are by definition off-site and not bound to any location.
Moreover, a customer of a cloud computing service can require that the service maintain a disaster recovery system — this is, again, a potentially expensive and difficult undertaking for the customer, but part of the essential, core competency of a cloud computing vendor.
Information Security
Cloud computing vendors also argue that they have more robust, state-of-the-art information security systems, incorporating the most developed firewalls, encryption, physical security and other steps that cannot be effectively implemented by most individual companies.
Cloud vendors can also keep not only information technology, but security personnel, on staff to maintain the security of the system; typically, a customer would have the information technology personnel serve double duty in this area.
Regulatory Compliance
Finally, cloud computing vendors can provide services which meet various legal and regulatory requirements of clients that are outside the clients’ core competence, most commonly auditing standards (particularly SAS 70) and Sarbanes-Oxley Act requirements, both of which require assessment of the internal controls of a service organization.
Cloud computing services can assist and streamline auditors’ opinions on internal controls by providing services which are designed with compliance in mind.
All these factors can make cloud computing services attractive to a variety of companies. However, cloud computing services also come with drawbacks and concerns.
Challenges of Cloud Computing
Is Cloud Computing Cheaper in the Long Run?
Because cloud computing negates the need to purchase hardware and operating software, the initial costs are almost always less than setting up a proprietary equivalent from scratch, and lower cost is one of the key drivers to cloud computing, particularly for companies with limited resources.
Over time, however, companies may find that their costs may be less or more than an in-house system, particularly since the customer of a cloud provider has little, if any, leverage on fees. That lack of leverage is magnified since, as described below, transferring from a cloud provider may be so difficult or expensive that it is possible to be handcuffed to a particular vendor.
Flexibility and Termination
Probably the last thing a potential cloud computing convert thinks of when considering a new provider is what will happen when it’s time to end the relationship. Most software users know that it is difficult and expensive to change systems, often requiring operating multiple systems for testing, retraining personnel and dealing with inevitable problems.
However, cloud computing adds an additional complication, since the software and data is in a third party’s hands, and remote — often very remote — from the user. The very things that make cloud computing attractive and solution-oriented are the factors that will create complications on termination. This is the case especially if the cloud provider is unable to meet its commitments generally. Consequently, users of cloud computing systems may be handcuffed to their programs.
Is Cloud Computing More Secure?
Cloud vendors argue that their systems are more secure than in-house systems, since their entire focus is on providing software or data storage services to customers, while a customer’s system is not a core competency. Cloud vendors often have full-time security analysts and can spread the cost of state-of-the-art security measures over a variety of clients.
However, cloud providers are also more attractive targets than their individual clients, since they have so much more information. To put it another way, a data thief may prefer the challenge of stealing the information equivalent of the Hope diamond instead of a handful of half-carat gems because the payoff is so much greater.
Moreover, since the cloud vendor is operating a "utility," there is always the concern that over time the vendor’s commitment to security may decrease, and customers have no way of knowing that standards have dropped.
Technological Edge
Clients look to cloud vendors because they seek access to higher-quality technical resources than would otherwise be the case — cloud vendors help level the playing field, particularly for smaller clients.
Maintaining the edge is difficult and expensive, and there is no guarantee that cloud providers will continue to upgrade and advance the product and provide the same degree of advantage. Similarly, one of the benefits of cloud computing, to the user, is its scalability; however, if a cloud provider loses its commitment to responsiveness and capacity, the cloud user may not be able to take advantage of this key benefit.
Disaster Recovery
One added benefit of cloud computing is enhanced disaster recovery. An effective disaster recovery program is an important part of virtually any business (and for financial institutions and certain other firms, an obligation); creating and maintaining a disaster recovery program is complicated and expensive. Since data retention is a core function of cloud computing companies, cloud vendors can focus on this portion of their services.
However, it is also difficult to verify the existence and effectiveness of a system that may exist thousands of miles from the client. Even cloud providers may not create a meaningful system: In one case, a cloud provided substantial protections for its mainframe computers but, when audited, the racks of individual personal computers used by many customers were not similarly protected, despite representations to the contrary.
Addressing Key Business Concerns
In order to make the cloud computing relationship work — that is, in order to make sure that the customer actually obtains the promised benefits — clients should consider a few key guidelines.
Expert Assistance
Few companies have the in-house capability to evaluate effectively either their computing needs or the ability of a vendor to meet those needs. The added features of cloud computing, with Internet-based applications or services, remote maintenance and assistance, and other factors, makes it even less likely that a typical firm possesses the ability to complete this evaluation.
Based on our experience, companies that engage technical and legal consultants to guide them through the process of identifying needs, engaging vendors and evaluating compliance are much more likely to be satisfied with their experience. Companies that rely on vendors to perform these duties are “hiring the fox to guard the henhouse,” and their experiences are often unsatisfactory.
Due Diligence
Before entering into an agreement for cloud computing services, a customer should take the time to investigate the history and performance of the vendor.
Has the vendor been involved in litigation, particularly litigation claiming breach of contract or failure to perform? Are there independent user groups or blogs that have identified shortcomings in the vendor and can provide real-life evaluations? How does the vendor compare to its competitors?
All these are valid concerns which should be considered before making a final choice of vendor.
Operating Characteristics
Surprisingly, many cloud computing agreements fail to identify the functions that the customer believes it is buying. While a customer may have been provided with significant marketing materials and while the vendor’s website might extol the virtues of its products and services, the vendor’s agreement may not reference those claims and may, in fact, disclaim any warranty based on those materials.
If the cloud computing vendor fails to provide the benefits the customer believed it was purchasing, the customer may not have meaningful recourse unless key functionalities are described and incorporated into the agreement. More importantly, identifying key functions in advance will help avoid expensive disputes altogether.
Service Availability
Because cloud computing services are provided over the Internet, and because cloud computing vendors provide services remotely, the customer and vendor must identify any anticipated disruptions in service, and who will be responsible for those interruptions.
This is essential when a customer enters into an agreement for a cloud computing vendor to provide critical, sensitive services, and where disruption in those services could hamstring the customer’s operations, its relationship with its own customers, vendors and employees, or hinder compliance with obligations to lenders, investors and regulators.
Support
Similar to service availability, any agreement between a vendor of cloud computing services and a customer should identify how and when the vendor will provide support. The agreement should identify support levels — for example, what constitutes a minor problem, and what constitutes a major failure — and also identify the response times by the vendor.
Cessation of Services for Nonpayment
Most cloud computing agreements provide that if the customer does not pay invoices promptly, the vendor will have a number of remedies, including the ability to terminate service. Customers should consider the impact of the loss of critical computing functions where there may be a dispute over payment or a disagreement as to whether the vendor has provided the services promised. If at all possible, the likelihood of a termination of service should be eliminated.
Termination and Duties on Termination
As with any service agreement, the vendor’s right to terminate services should be reviewed very carefully and appropriately limited. Moreover, particular thought should be given to the duties of the vendor on termination.
One key concern should be the ability of the customer to obtain the information held by the vendor in a format that the customer can use. Any agreement should identify with specificity the obligations of the vendor to deliver the customer’s information upon termination, the format in which it will be delivered, and the continuing obligation of the vendor to assist the customer after termination in assuring the completeness, accuracy and availability of that information.
As an adjunct, steps should be taken to assure that the vendor will not be able to use confidential or sensitive information following termination of the relationship.
Vendor Failure; Back-Up and Recovery Options
Companies should consider the consequences of a business failure by a cloud computing vendor; as the past few years have demonstrated, even well-known and seemingly stable companies can fail. If a cloud computing vendor fails, its customers may lose access to key company information.
Among the steps a company should take are requiring the vendor to demonstrate and maintain its back-up and recovery options; provide hard and electronic copies of the customer’s information to the customer on a regular basis; and give the customer access to software, typically through a source-code escrow agreement, in the event of failure.
Improvements and Enhancements
One of the anticipated benefits of a cloud computing relationship is the availability of continually improved and enhanced software and services. The agreement between the vendor and customer should identify how these improvements and enhancements are implemented, the cost, if any, for the improvements, how customer requests for enhancements are treated, and related matters.
Security
As we discussed earlier, identity and information thieves may find cloud computing services attractive targets. A cloud computing vendor should make clear representations as to its privacy and security policies and procedures, including compliance with applicable state and federal laws and regulations, as well as various industry standards.
For example, a cloud computing provider that processes credit card transactions should be in full compliance with the Payment Card Industry’s Data Security Standards.
The agreement between the vendor and customer should also allocate responsibility for addressing any breach involving the customer’s security. In most cases, the customer will want to control any communication with its customers, employees and other affected constituents, but will want the cloud computing vendor to be responsible for costs incurred because of a breach.
Conclusion
Accessing software, storage capacity and other products and services over the Internet bears the promise of achieving benefits key to many companies. At the same time, cloud computing customers need to understand what can stand in the way of those benefits.
___
*Robert Braun (RBraun@JMBM.com) is a partner in the Los Angeles office of Jeffer Mangels Butler & Mitchell LLP.
The opinions expressed are those of the author and do not necessarily reflect the views of the firm, its clients, or Portfolio Media, publisher of Law360. |
