The cloud does not only happen in a cloud. The cloud is simply a nebulous way of depicting the magic that happens between geographically distanced technology interacting over a network. Clouds have been long used as a way to pictorially represent a network connection between two end-points without trying to depict or represent the hardware, technology and software that resides inside. Clouds have been around for a long time in technical schematics but the term “cloud computing” has only recently come in vogue as an answer to everyone’s technology prayer. It is, in a manner of speaking, a cute little marketing gimmick.
As far as business continuity and disaster recovery planning is concerned, we should not think of the cloud as the savior to all our recovery challenges. In fact, the only thing that is really new is the term. Technology continuity programs have utilized networks to distance end users from the technology they use; to allow flexible access to other resources to meet increased demand or adjust to unexpected problems; and, to back up data to off-site locations for a long time. Before the term “the cloud” became a cool thing to say, we simply called it remote computing.
But the fact remains, there is still hardware and software at each end of and within the cloud itself that can break and require redundancies, quick fixes or alternate modes of operation depending upon the timeliness you need that functionality back in play. In other words – we still need disaster recovery plans.
Furthermore, the cloud represents some additional risks and threats itself. Just as the cloud is used to avoid depicting what happens inside, it also hides who might be inside there with you. Networks can be compromised. You may not know who else is inside that cloud looking at, duplicating and/or changing your data. In addition, much of the cloud concept now includes having solutions where data and applications are warehoused on technology that houses other organization’s data and applications as well. All of this opens up risks of compromise, sabotage and cyber terrorism. In fact now, some endpoints that do not have adequate backup solutions in place can take down numerous companies with one incident. There are several industries that utilize the cloud to access a monopoly-like third party service provider to help them function. If that organization experiences a failure without adequate backup systems in place – an entire industry could be jeopardized. One example that immediately comes to mind is the airlines industry. There are few service providers that provide flight control data necessary to board planes, perform crew scheduling, and manage operations. If one of those entities experiences a prolonged outage – many airlines may be non-operational until the systems can be brought back up on-line.
Like almost everything else in life, the cloud provides many benefits but it also has potential risks and downfalls. I simply suggest that business continuity and disaster recovery planners do not let the hype of “the cloud” to cloud our judgments on what is needed in our continuity programs. In many cases, the use of the cloud simply relocates single-points-of-failure or moves risks and threats from internal assets to vendor supported assets, but the risks and threats are still there and the impacts of failure still remain.