How to deal with the legal risk of cloud computing

Cloud computing brings security, transparency and ease of data portability. Undoubtedly, the benefits of cloud computing have long been established for enterprise end-users. However, with the promotion of cloud computing, its legal risks are increasingly exposed to the world. A lawyer at White & Case, a global law firm, emphasizes that businesses and service providers still need to think carefully about application-managed and virtualized services.

Daren Orzechowski, a lawyer who handles cases related to information technology, branding and licensing, said: Cloud computing can create issues of security, legal access and data backup. He said cloud computing will immediately come to mind two questions: Who else will see my data? If there is a problem, I will have a copy of it. This is a software service or application service providers such as delivery of IT The problems encountered in outsourcing are the same. There are other technical issues that are also covered in "New challenges and opportunities for virtualizing cloud computing." In addition, security issues related to cloud computing are of even greater concern, see "Cloud Computing Requires Better Security and Interoperability."

Orzechowksi cautions companies to work hard to understand vendors and their security protocols, know how your data is handled, and ensure that you have the ability to intervene and gain access to your data in the event of a problem. As for service providers, they need to ensure that their policies and procedures are transparent so that end users can easily determine how their data is handled.

Orzechowski said I think it is important for manufacturers to show off the security you provide to people using marketing expenses. This is the most important thing. In addition, it is important for consumers to easily port data. In this way, the user can get the data and leave.

Orzechowski said the industry is discussing standards for data portability. However, this standard does not currently exist. As a result, it's hard for users to determine if they are being tricked and can not migrate their data from one managed service provider or cloud provider to another.

The more users do this in advance and the more the vendors see what their needs are, the more likely it is that manufacturers will develop a consistent solution.

On the security front, service providers need to expose the physical security they provide in the data center, wherever they are, and to expose the extent of hacking or other electronic threats.

A legal problem with data virtualization in a data center or cloud computing is the response to court summons when data is not centrally stored. Orzechowski said that the more interesting aspect of this from a lawyer's perspective is that when you use virtualization you do not have to put the data of a specific customer on a specific computer or server. This is totally different from renting a venue. Where the venue is rented, your data is on the third server. Now your data is spread across services. Like in an apartment building, you do not need to know what the neighbors are doing. If a court summons calls for the collection of physical hardware, will your data go to court along with the hardware? These matters must be carefully considered. Large manufacturers are very familiar with this kind of thing.

Similarly, organizations choosing web-based data stores must ensure that these data storage services meet the legal deadline for protecting data. In this way, legal proceedings and other legal action events, you can provide these data.

Orzechowski said that once the court makes the order or makes the request (even when requested by the government), it is important for the vendor to have the ability to provide the data at any time. If the data is virtualized, they can combine the virtualized data into a single copy and isolate the court-mandated data. This is something that must be done while protecting the secrets of sensitive data from other users. If you can not provide this data, the court is likely to take away the entire hardware, which is a terrible result for manufacturers.

On the other hand, courts may accept this solution if cloud providers have a reasonable solution to protect their users.