nobeastsofierce - Fotolia
Sending desktops and applications to the cloud is like sending a child off to college. For a long time, you've had control over and insight into that kid's life. But when the first day of freshman year comes, that control is forever changed.
The same is true for hosting desktops and applications in the cloud. There are certainly advantages to it: Someone else deals with management, and you can pay a relatively small fee to use as much infrastructure as you need. That's a lot easier and cheaper than standing up VDI or building your own private cloud on-premises.
The day you send desktops and apps to cloud providers' infrastructure, however, you lose the level of control that you once had. It may seem that they're not secure, but control doesn't equal physical or mental security.
The preparation you do to send your kids out into the world and keep themselves safe -- don't talk to strangers, walk with a buddy at night, don't do drugs -- helps you sleep a little better at night. Similarly, you can prepare yourself for what's to come from hosting desktops and apps in the cloud by changing your mind-set and being proactive.
Don't believe the hype
Attacks on corporate information actually happen on-premises more frequently than they do on cloud providers' infrastructure. The difference is that when there's a breach in one single company, you don't usually hear about it in the news. Most companies just handle a local breach in-house, and it affects only that organization's employees and clients. But when providers such as Dropbox are hacked, that can affect thousands of users, which is why there's more fanfare around it.
There's also a level of narcissism that comes with concern over security breaches in the cloud. Remember that the work your company does is important to it, but there are only so many organizations with valuable secrets. Hackers likely don't care about stealing your workers' Microsoft Word data.
Pick a provider you trust
That being said, there have been security breaches in the cloud before, and as long as there are hackers in the world trying to steal corporate secrets and cause general mayhem, that's going to remain the case. As such, it's important to do your due diligence and pick a cloud provider you can trust.
You should be able to get in touch with your provider quickly in the event of an emergency, and you should feel good about hosting your desktops and applications with that vendor. Ask how the provider provisions resources, what happens to user profiles and how much control you have over management. If profiles delete themselves at logoff, that's better for data security, but it's not always a realistic use case. And the kind of management you exert over cloud-hosted desktops and applications isn't the same as what you'd do in-house; it's more about creating and removing desktops, and choosing which users receive which applications, for example.
Work your SLA
Another great way to feel more secure about hosting desktops and applications is to negotiate a service-level agreement (SLA) that's favorable for you. Most standard SLAs favor the cloud provider, but you can customize some terms with your provider.
Knowing that your provider will have to pay up if there's an outage or a security breach won't put the toothpaste back in the tube -- once data is out, it's out -- but penalties for the provider might make you feel that your desktops and apps are better cared for.
Only host desktops and apps that make sense
There are organizations that have truly sensitive information, such as government agencies and pharmaceutical companies. Those are the kinds of shops where a data leak or security breach could spell huge financial losses or even risks to personal or national security. Hosting desktops and applications in the cloud might not be right for those companies. Although even the Central Intelligence Agency and other government groups are finding ways to use the cloud, they're looking at a custom, locked-down, firewalled cloud, which isn't the norm for enterprise IT.
For the average company, follow this rule of thumb: You wouldn't want to host desktops or applications that harbor that kind of mission-critical information in the cloud. If it's not in the cloud, you have control over securing it on-premises. And if your company's data being out in the world won't hurt the business, then host away. There's no sense in worrying about a cloud breach if your data isn't sensitive.
Only allow certain workers to use cloud desktops and apps
It's important to examine the use cases for hosted desktops and applications -- who really needs them? Supporting temporary teams and projects with cloud-hosted desktops means users get only the applications and data they need, and you have control over who gets the desktops. This also applies to temp workers, contractors and consultants. When the job is done, you can delete the desktops.
This way there isn't the pressure of letting every scrap of corporate data relocate to the cloud forever, and there's a separation between outside users and the corporate network. Plus, relying on outside architecture to host the desktops and applications means they're not taking up space on your servers.
How security affects trust in DaaS providers
Rogue employees, cybercriminals heighten cloud security concerns