CIO Talk Radio Blog

In my previous post I shared my experience negotiating Demand Pricing and Data Ownership concepts as part of contracting with a cloud provider. Today I’ll tackle what I consider one of the most difficult components of a cloud contract, Security. I’m hoping others will share their experience in this area, because I don’t believe anyone has the final answer for how to negotiate these complicated concepts, especially when one considers the myriad of types of cloud providers and services offered.

Recently a family member experienced a very tragic event when their house burnt down.  They only had a minute to get out of the house before it was completely engulfed in flames.  Luckily everyone escaped without harm, but they lost everything they ever had.  Furniture, clothing and other household items are easily replaceable, but personal items are not.  Photos, keepsakes, and of course the data on computes hard disks are irreplaceable!

Experts are having to radically rethink security because of mobility, cloud computing, social media, and other new technological forces.  A principal reason for this is quite simply the pace of change.  The rapidity with which technologies are being developed and deployed is unprecedented.  A security professional likes to deliberate, weigh risks, and take measured steps.  But the rate of adoption of newer technologies reduces the time available for threat analysis and strategizing.

A quote famously attributed to Politian Tip O’Neil states, “All politics is local.” Something similar could be said of global privacy and intellectual property laws. In Europe the individual owns his or her own information, which cannot “leave” Europe, while in the US, any information gleaned from public records on the Internet belongs to whoever collects it, who is then free to sell it to anyone.  So while US citizens enthusiastically register for “do not call” lists and diligently delete cookies, marketers, debt collectors, investigators, and the nosy can buy publically available information on whomsoever they want. In the US, intellectual property and the income stream from it lives on indefinitely, while in Europe, intellectual property such as a public performance, automatically becomes public domain after 50 years. In Europe privacy issues have been raised over Google’s Street View application. The service is banned in Austria (although a Romanian company has a similar application in use in Austria).

Crises come from many directions, both internal and external, and take many forms. The real issue of what is at stake is what we do about them.