The Nice-to-Haves and Need-to-Haves of Cloud Computing

First, SMBs typically purchase server hardware with the expectation it will last for years. A year or two later, they discover they need to double the capacity of that system in order to meet technology needs. These costs are often not budgeted.

Additionally, security has moved from a simple firewall and anti-virus software to very expensive, hard-to-manage security systems, including log review and correlation (SIEM) systems, next-generation firewalls, host intrusion detection systems and sandboxing of all incoming files. Your IT department can no longer consist of one person wearing many hats, including maintaining infrastructure, ensuring data security and providing end-user support. To reduce this complexity and its associated costs, many firms are moving to the cloud.

Kinds of Cloud

Cloud services can be broken down into three major categories: software as a service (SaaS), platform as a service (PaaS) and infrastructure as a service (IaaS).

Software As a Service

SaaS requires the least amount of technical knowledge and, as a result, allows for the least amount of IT administrative control. In the SaaS model, a cloud provider is responsible for everything from the hardware to the application. These types of services are all run primarily from a Web browser and require nothing to be downloaded or installed on the client's workstation. Examples of SaaS solutions include Dropbox, Salesforce, GoToMeeting and Office 365.

Platform As a Service

PaaS allows for more control but requires more technical knowledge than SaaS solutions. PaaS cloud solutions take care of the hardware and the operating system, allowing the user to focus on the applications. This is an ideal solution for application developers, who don't need knowledge of the underlying OS or hardware. Examples of PaaS solutions are Force.com, Apache Stratos and OpenShift.

Infrastructure As a Service

IaaS requires the greatest amount of technical knowledge and grants administrators the most control. IaaS cloud providers are responsible for the underlying hardware or infrastructure through a host of virtual devices, including firewalls, networks and virtual servers and workstations. The company is responsible for managing the OS and the applications. This is the most flexible cloud-computing model and is highly scalable. Examples of IaaS are Amazon AWS, Microsoft Azure and Google Compute Engine.

Security Considerations

Security considerations are still paramount when migrating to a cloud solution. Maintaining good security and operational practices is a critical and nonnegotiable factor. In fact, these policies, standards and procedures are more important than ever to ensure that you are appropriately protecting your cloud implementation. Since cloud solutions are Internet accessible, if they are not appropriately secured, malicious actors can sometimes get in more easily than if the equipment is on your own premises.

Vendor Risk Management Plan and Business Continuity Plan

When an IT service provider proposes that you use a cloud system implemented by that vendor, it's critical you also implement a vendor risk management plan (VRMP) so you can make sure your managed service provider is following appropriate security procedures to protect your data. A VRMP will also let you assess whether the cloud solution you are considering is appropriately secure as well. And, finally, it is important you have a business continuity plan in place so your employees and your managed service provider know what to do if your cloud system fails, suffers a hacking attack or has otherwise been rendered unavailable.

Making the Move

Moving to the cloud by yourself is not a simple process, and any organization should carefully consider the pros and cons of such a shift. Determining if moving to the cloud is right for your organization can be broken down into several steps:

1. Clearly define the problem which you are trying to resolve. Are you facing heavy infrastructure and maintenance costs associated with running a proper data center? Are there business continuity issues which need to be addressed, such as utilizing multiple locations to protect against specific regional natural disasters like earthquakes? Are there certain controls or customizations the organization currently has that may not be feasible in a cloud-based solution? All these questions need to be answered to ensure the cloud solution you choose is appropriate.
2. Determine if your organization must adhere to specific compliance requirements, standards or regulations. These could range from the Health Insurance Portability and Accountability Act (HIPAA) and Payment Card Industry (PCI) standards to the new California Consumer Privacy Act (CCPA) and many other statutes. While a number of these compliance regulations have overlapping requirements, not adhering to specific ones can result in hefty fines. Don't forget to ensure protections are in place for personally identifiable information, if it is present on your network — and it likely is.
3. Ensure your IT provider understands its technical capabilities and what it's willing to manage. Ensure managed service providers and cloud service providers have clear delineations on management responsibility. Some solutions only require users to understand how to employ a specific web application while the cloud provider supports the balance of the platform. Other solutions may provide virtual infrastructure, meaning someone besides the cloud provider must be able to support all aspects of the OS and applications.
4. The organization must understand the total costs involved in moving to the cloud so it can budget accordingly. If your IT provider is setting this up for you, ask for a total cost of ownership for the cloud operations to make an effective decision. Charges can add up, so understanding the costs upfront will allow for proper budgeting. Many organizations have dived headfirst into the cloud only to realize the services exceeded their initial of cost assumptions.

Cloud Service Providers

Migrating IT services to a client service provider (CSP) benefits law firms by reducing their technology infrastructure's physical footprint in their offices, including built-in redundancy, easy scalability with better physical security and access to advanced security features. Ultimately, this all results in lower IT capital expenditures.