Sony Woes May Cause Some To Rethink Cloud

The Sony data breach that compromised the personal data of more than 100 million customers of the Japanese electronics conglomerate may claim yet another victim- the cloud computing industry.

Some businesses are rethinking plans to move to cloud-based computer systems located at remote datacentres that can be accessed over the web. Shares of companies that specialise in cloud computing have been some of top-performing stocks over the past year. But the attack on Sony, as well as a massive outage at Amazon.com Inc’s cloud computing centre, have caused some businesses to put the brakes on plans to move their operations into the cloud. “Nobody is secure. Sony is just the tip of this thing,” said Eric Johnson, a professor at Dartmouth University who advises large corporations on computer technology strategies.

Experts in digital security say that investors, businesses and consumers have put too much faith in the cloud. “You don’t want to have this trust in the magic of the cloud. It’s not that simple,” said Mike Logan, president of Axis Technology, a data security company. “It’s like Facebook. If you put all this sensitive information there, guess what? People are going to see it.”

More from Biztech

Future Group - Reliance Retail Deal approved by CCI RBI ban on cryptocurrencies takes effect; prohibition could force investors to tap the black market

Cloud computing companies have done a good job convincing customers that their data is safe, even though that may not be the case, said Gartner cloud security analyst Jay Heiser. “If you’re doing anything that is critical to your business, you need contingency plans,” Heiser said. “The marketing messages of some cloud computing companies have urged people to gloss over this need for contingency plans.”

Consumers trust the cloud to handle services ranging from email to credit reports and filing taxes, usually without first investigating the security of those systems. “Even services that you think may be secure, such as filing your taxes online, could be compromised,” said Murray Jennex, information systems professor at San Diego State University. Consumers expect a company as large as Sony to protect its data adequately, said Jeff Fox, electronics editor for Consumer Reports Magazine. “You would have thought a big time reputable company like Sony would be running up-to-date, patched software with an appropriate firewall,” he said. “If Sony didn’t do this, which other big, reputable companies aren’t doing this?”

Because cloud services are so new, there are few standards or best practices for how to store and protect data. “There’s nothing from the government or regulatory industry that says anything about how to run a shop,” said Dan Zeiler, director of security and compliance for American Internet Services. For now, companies generally have little protection against outages and security breaches, said Cynthia Larose, privacy attorney at Mintz Levin. She expects that to change in the wake of the Sony breach and the Amazon.com’s outage, which destroyed the data of a handful of its customers. Larose added that companies in industries such as healthcare and financial services as well as businesses that own a lot of intellectual property are seeking special insurance plans that protect against cyber thefts. “There’s a pretty broad sweep of companies going out and trying to get these cloud services covered,” she said.

Some cloud providers are already seeing their clients trying to negotiate new contracts that put financial penalties on cloud providers for service disruptions or security problems, said Ford Winslow, chief information officer of Abnology, a company that provides cloud services. He said the first round of contracts for early adopters are coming to an end after three-year deals and companies are seeking better performance and terms for disasters.