Someone else's cloud infrastructure too sketchy for large enterprise SaaS application?

Question

I have a set of geared-to-enterprise SaaS services I will be trying to sell soon to a number of large companies. In IT and Security reviews for critical software in the past, as a vendor you were dinged if you were running on someone else's virtual environments. It was expected you'd be running on your own, or at least bare hardware for which you've contracted.

Despite it being 2012 and not 1997, I know first-hand there are those who will poo-poo the idea of buying a service hosted on something like AWS or in a multi-tenant hosting situation that was not solely dedicated to the service at hand.

Are there still security concerns in the enterprise about this overall, especially in the ERP integration arena? There is a lot more cost involved at a DC with servers and Oracle licenses, etc, etc and thus the pricing model changes significantly.

Would you consider services sold on someone else's cloud too risky? This would be in a general IT systems perspective in various industries. (e.g. Likely not for Banking, but most banking are on-premise anyway)

Answer 1

In general, there are only a few key areas of added risk, for a cloud-hosted system as opposed to a self-managed system. Some of these may apply to some industries, others less so.

• Compliance - some regulations / laws make it difficult (if at all possible) to be compliant when hosted in the cloud. Lately most cloud providers are making efforts to meet this challenge.
• Data migration - generally you won't know where your data is located, e.g. it may be moved out of the country. This may be relevant again to compliance, e.g. Data Protection Act in the EU. Again, many providers are now allowing you to enforce a specific region for your instances.

In my opinion, as long as the provider meets your core requirements, the above issues are not so important.
However, these next two will always remain as risks, that should be managed appropriately by each business according to their own tradeoffs:

• Insider access - while you (hopefully) have some control over your own employees, even the administrators - via employee vetting, and other non-technical / personal controls, you have no such control over the cloud provider's employees.
  While these can be partially mitigated, either by technical controls (such as encryption, which will only make it harder to do you damage, not impossible), or legal controls (e.g. non-indemnification, etc though highly unlikely), this will remain a valid business risk, that some business would not want to accept.
• Availability - obviously, you have slightly higher probabilities of high levels of access, when your machines are on site. Remotely, you're dependant on too many levels - besides the cloud providers, there is the ISP, and etc.
  Again, there is some mitigation, both technical and contractual (e.g. SLA with penalty clause), however as above this can still be a valid business risk.

So, to sum up the answer to your final question:

Would you consider services sold on someone else's cloud too risky?

A simpler question is: Is it more vulnerable? That has an easy answer: Not really. As @Rook said, there are too many factors equally out of your control, even when you own the physical boxes. So you dont lose much that way.

However, "too risky" is dependant on each business' risk tolerance, and various other trade-offs.
Aside from compliance issues, the last too points I mentioned would be the stickiest issues to manage.

Answer 2

So just because its on a machine in your building makes it yours? Do you know everything running on this machine? The answer is always No. A piece of hardware providing a service is a black box to the end user. If anything having a vendor send you a dedicated piece of hardware is a massive security threat. Firewall settings should always be very constrictive when it comes to remote connections. For the vast majority of enterprise networks I have encountered the idea of an attacker with a black box inside your local network is a nightmare.

An important defense in depth security principle is isolation. When a system is compromised it becomes a beach head for a full scale invasion of the rest of your infrastructure. An ideal security design would have every system isolated and only exposing the minim necessary functionality to the other components of your infrastructure. SaaS and cloud computing can conform to this design, but so can traditional computing platforms.