It's interesting how we entitled this section Business Continuity? with
a question mark. Because when we look at the cloud,
we are relying on another organization to store and process our data, we're
relying on another company to handle our network communications.
And one of the things we need to do is to ensure that those
dependencies we have will support our business needs,
that we can continue our critical business functions.
Business continuity planning is, as its name says,
trying to make sure that we can continue business.
Not just that the cloud provider can continue to operate,
but know that they can provide support for our business functions.
The cloud service provider is, for many organizations and many
different systems today, a critical dependency for operations
and mission of the cloud consumer.
The way we must determine this is by doing an analysis.
What would the impact of an outage of, say, the cloud service be on our
business? And we call this, therefore, business impact analysis,
the analysis of the impact on our business. As a consumer, we need
to take this into account because this is a risk.
We have to make sure that the cloud service provider we deal with has a plan
for business continuity in the event of a serious incident.
Say, for example,
they had a fire, or what would happen even if we had a
cut network cable? Do they have a plan?
And this is where I've heard people say in the past,
well, the cloud will never go down. Well,
yes, the cloud has gone down.
We've had a number of cases where even some of the largest cloud
service providers have had outages of 8 hours or more.
And in this case, we find that companies naively thought that while the
cloud service provider has a plan and they didn't realize it was necessary
for them as a consumer to purchase the additional protection to ensure that
the cloud service provider would keep their services running during some
type of a serious incident.
Some of the options for the cloud service provider is
that they could have multiple sites.
If one goes down, we can move to another.
Now ideally, those sites should be geographically dispersed so there's
not a chance of both going down at the same time.
But in other cases where we have a smaller cloud service provider,
it could be that they have an arrangement with another cloud provider.
So they provide backup facilities to each other.
Some of the options for us as a consumer is to go to a hybrid model
to have, of course, multiple cloud providers.
But then we have to make sure we have portability.
We can easily move our data from one provider to another.
We have the ability to transfer data.
Now this is important because one thing that the cloud is not
good at is bulk uploads and bulk downloads.
They're very good at processing and storing data.
But if I have to move a huge amount of data onto a cloud provider or
off of a cloud provider, that could take, as we saw,
for example with Glacier, it could take months.
And so the challenge here is making sure we have a data
transfer capability that will allow us to resume business
within that required length of time.
We also have to make sure that if we're dealing with multiple cloud providers
that they're using the same type of systems that would be interoperable and I
can easily port my data over to the other one.
Key point to review.
Each organization is responsible for its own risk.
Therefore,
each organization must exercise due care and due diligence to
protect the assets of the organization.
This means that we have to ensure we provide adequate
security, and we do this through the implementation of
appropriate controls based on our risk.
But then controls sometimes don't work, and that's why we need
monitoring to make sure the controls are effective, and the risk
has been reduced to an acceptable level.