The Cloud Carries Risks, Too

Photograph by Alex Wong/Getty Images

Over six hours one weekend in June, several startups suffered catastrophic failures. A powerful storm knocked out a data center owned by Amazon, which leases server space for companies and their websites. Affected businesses went offline. Engineers scrambled to fix the mess.

The outage highlights the risks of “the cloud,” technology industry jargon that means parking data and software on a third-party’s computers. Technology failures, security breaches, and acts of God can wreak havoc on businesses that entrust such critical functions to another.

It is a risk that companies weigh heavily before deciding to use cloud services, which are being increasingly adopted across sales and human resource departments, among others. It also factors into which cloud providers companies choose.

Of course, businesses that keep computing in-house face many of the same dangers. Executives must ask whether they are any more capable than cloud vendors at handling the inevitable emergencies. “There’s a huge variety of risk,” says Bryan Ford, an assistant professor of computer science at Yale University who studies risks in cloud computing. “It’s a highly complex situation because some of the same risks apply when the computing is done in-house as when it’s outsourced.”

Amazon’s outage at a data center in Virginia took down companies such as Flipboard, a reading app for tablet computers; Instagram, the photo sharing service; and Pinterest, the online bulletin board. Netflix’s video streaming service was also affected, but it recovered more quickly than the others.

Hundreds of thousands of companies lease Amazon’s servers to support their websites and data crunching. Outsourcing frees Amazon’s customers from having to buy and maintain their own servers, which can be expensive and time consuming.

Amazon Web Services, the formal name of Amazon’s data hosting, has had previous outages. But it is not alone in going offline. Most cloud services eventually do, even if the crashes are relatively brief. Last month, some of Salesforce’s customers lost access to their sales records for a couple of hours. Two months earlier, Box, the online storage service, had an outage. Microsoft’s Azure cloud platform also experienced hiccups earlier this year.

A recent study by the International Working Group on Cloud Computing Resiliency, made up of academic and technology industry representatives, tried to quantify the cost of the outages. It estimated the combined downtime at 13 major cloud service providers to be 568 hours since 2007—with an economic impact on customers of at least $71.7 million.

Companies that use cloud services can minimize their risk through a number of techniques. Spreading operations over multiple cloud data centers, or making sure those operations can be shifted quickly, can ensure that downtime at a single cloud facility doesn’t take a business entirely offline. Clearly, the companies that suffered outages in the wake of Amazon’s troubles had failed to create adequate redundancy. Many of them said later that they had learned a valuable lesson and would address their shortcomings.

Security is another area where companies must pay close attention. Cloud services usually provide a certain level of security, but their customers must sometimes take steps beyond that to ensure data privacy.

The question of who can provide better security is not much of a debate when it involves small businesses. Large cloud providers likely have dedicated staff handling security, while small companies may lack expertise. Because of regulations, financial and health-care companies must largely avoid the cloud for storing private customer information. Rules require that they instead keep the data in-house, under a watchful eye and where it is easily available for audits.

Lynda Stadtmueller, an analyst with consulting firm Frost & Sullivan, says that it is smart for businesses to store proprietary data in-house while using the cloud for less critical information to minimize risk. Even so, Stadtmueller says that concerns about the cloud are a bit overblown: “In truth, the risk in the cloud it is not as high as many people believe.”

Before it's here, it's on the Bloomberg Terminal.