Il s'agit de la republication d'un article initialement publié en novembre 2009. Malheureusement, il est toujours d'actualité. Pensez à votre DR !

There have been a storm a few days ago in Southern France. A very devastating storm, with strong winds that damaged buildings and threw hundreds of thousands of trees on the ground, cutting phone lines and disrupting electricity supply.
A major snow fall has hit the US at the same period, with the same consequences for over a million of american citizens.

While the media give a lot of coverage to the situation facing the families, they often do not mention the fate of the thousands of small businesses hit by the storms. And yet since businesses provide work and salaries, their fate is of first importance for the community: what could be worst than being left with a damaged house and without a job?

Businesses face a complex issue: their premises have been devastated, their tools destroyed and their activity has stopped. Their revenue has dropped to zero, and they run the risk of never being able to recover from the situation. And yet, there is something potentially worst than a damaged building or machine: the loss of information. Information is an asset, same as a building or a machine, except that it can not be (easily) valued and can not be replaced. It is both the memory of the company and its life blood: how do you manage a company without inventory information? Without customer files? Without any visibility on the orders delivered? To deliver? Without financial information? And yet, this is the situation most small businesses are facing. While they grieve for the loss of their production tools, their suffer and even greater pain for the loss of their information.

For most small businesses, a proper, redundant infrastructure is too expensive. Backups, when they exist, are limited to tapes, often left in the computer room, on top of the server itself…Redundancy, disaster recovery plans, business continuity plans…It all requires a capital investment most entrepreneurs do not understand and they don’t even bother. It requires expensive people to put in place and maintain. They prefer to live with the risk, focusing on their business: like tobacco cancer and winning at the lottery, “it” happens only to others.

And yet…

And yet, today’s technology offers a simple, elegant and inexpensive way to address these concerns: the cloud.

What is the cloud?

The cloud refers to the Internet: on technical designs, the Internet is often represented by a cloud. This cloud now offers services that are made possible by the quality (speed) of Internet connexions and by the computing power within the Internet. With cloud computing PC’s do not require software to be loaded on the PC but rather access the features on the web through a web browser. Some services of interest to companies we can cites are:

• CRM packages
• accounting packages
• full fledge ERPs
• messaging tools
• collaboration tools
• office suites
• …

This implies that the most critical tools a company uses can be transfered to the cloud. The advantages are:

• back up responsibility and infrastructure is transfered to the service provider
• data are stored and used in different places, often far apart, further mitigating the risks
• information (and its associated applications) is accessed using a standard web browser
• software maintenance issues (updates, upgrades, patching…) belongs to the service provider.

Cloud offerings often offer even more advantages:

• flexibility in licensing terms
• compliance
• cost is less than a local installation
• additional services can be offered and easily integrated to the base offer (ex: e-commerce extension to the ERP)
• collaborative aspects are often an integral part of the offer and make the “local hard disk issues” things of the past: access to documents on local hard disks, multiple versions, sharing, risk of failure…

Cloud? ok, but to what shall I pay attention?

Of course, there are a few things to pay attention when choosing a cloud offering. Information, your information, should be stored according to the 4 pillars of information security:

1. confidentiality: make sure the server your information is stored in is secured enough that your information can not be accessed by unauthorized parties
2. integrity: you information must not be tampered with, even accidentally. You have to know you can rely on the information the servers give you,
3. availability: this is all about SLA’s. The company providing the cloud offering is in charge of the infrastructure. It is it role to make sure it is redundant, scalable and secured. Service availability should be at least 99.999% (the five “9”). Be caution with the terms: here, I am talking about “service”, not network, not Internet access, etc… The service is the end-to-end chain that allows you to access your data and work with it. It includes: your Internet access, the Internet access on the service provider’s side, its internal network, the servers, the storage…You can not ask the question of availability for every component of the chain, you won’t even get an answer, but be sure to read the fine prints under the SLA paragraph…Set the SLA’s that suit your activity: even if stringent SLA’s are expensive, compare their costs to a loss of service and to the impact an outage might have on your customers
4. traceability: that is an other story but a service provider that can have you covered on that front too should have your preference.

And don’t forget to devise a simple business continuity plan: you never know when a storm might strike…