Last month's breach of a hosted Google Apps implementation used by Twitter Inc. has heightened fears in some quarters that cloud computing could pose significant security and privacy risks to users.
The Twitter breach gave a hacker access to confidential company documents via an employee's work Gmail account that had been hijacked through the password reset feature.
Shortly after the breach, some public interest groups and local law enforcement officials cited potential security concerns in calling on the city of Los Angeles to reconsider plans to replace its Novell GroupWise e-mail and Microsoft Office software with Google Inc.'s hosted e-mail and office productivity applications.
The $7.25 million migration project is set to begin later this year after its expected approval by the Los Angeles City Council. City officials have projected that the move to Google Apps will save about $13 million in software licensing and personnel costs over a five-year period.
Consumer Watchdog, an advocacy group based in Santa Monica, Calif., said the Twitter incident raises questions about whether “Google's cloud as offered provides adequate safeguards.” In a letter to several Los Angeles city councilors, the group urged that city IT personnel first test Google Apps with a small group of users, rather than following the current plan of implementing it for 30,000 users by the end of this year.
“Before jumping into the Google deal, [the city council] needs to insist on appropriate guarantees — for instance, substantial financial penalties in the event of any security breach,” John Simpson, a Consumer Watchdog project manager, wrote in a blog post.
In a letter sent to Los Angeles Mayor Antonio Villaraigosa on July 16, the World Privacy Forum encouraged the city to move “slowly and cautiously” in implementing Google Apps, citing “considerable legal uncertainty about the status of data in a cloud computing environment.”
Matt Glotzbach, director of product management for Google Enterprise, said the angst voiced about Google Apps and the Los Angeles project is based on incomplete information. “From what I know of the city's operation, this is a security upgrade,” Glotzbach said. “Those who may be unfamiliar with cloud computing see this as a security risk simply because it is new and because it is something different.”
Randi Levin, the city's chief technology officer and general manager of the Los Angeles Information Technology Agency, noted that the California State Department of Justice has reviewed the security and privacy plans and tentatively approved the project.
Nonetheless, IT managers suggest that large technology users should tread carefully and conduct comprehensive risk assessment studies when deciding whether to migrate to cloud-based products.
For example, Matt Kesner, chief technology officer at Fenwick & West LLP, a San Francisco-based law firm, said that IT managers need to consider the security and privacy implications of using applications hosted by other companies at off-site locations.
“It's one thing if you could be sabotaged by five people or even 500 people working with you in your company,” he said. “It's another thing if the people stealing your information could be any other person on the planet.”
Christopher Pierson, chief privacy officer at a large financial institution he asked not be identified, said that companies considering hosted products should also look at the potential for data commingling if their potential cloud provider hosts multiple customers on the same systems in a single data center.
Pierson also said that IT's concerns about cloud computing “are very similar to the concerns and risks associated with traditional data storage outsourcing, offshoring or other forms of remote data access.”
