Successfully reported this slideshow.
We use your LinkedIn profile and activity data to personalize ads and to show you more relevant ads. You can change your ad preferences anytime.

Risks and rewards of placing employee benefits systems in the Cloud


Published on

Is Offsite Software Hosting Safe and Secure?
Presented by:
Howard Kaplan
Director of Business Development
LBi Software

Published in: Technology, Business
  • Be the first to comment

  • Be the first to like this

Risks and rewards of placing employee benefits systems in the Cloud

  1. 1. Risks and Rewards of Placing Employee Benefits Systems in the Cloud Is Offsite Software Hosting Safe and Secure? Presented by: Howard Kaplan Director of Business Development LBi Software
  2. 2. Agenda <ul><li>Introduction </li></ul><ul><li>A Brief History of Computing </li></ul><ul><li>SaaS & Cloud Terms Demystified </li></ul><ul><li>3 rd Party Hosting vs On Premise Deployment </li></ul><ul><li>Risks and Rewards of 3 rd Party Hosting </li></ul><ul><li>Engaging Your IT Department </li></ul><ul><li>Summary </li></ul><ul><li>LBi Overview </li></ul><ul><li>Q&A </li></ul>
  3. 3. A Brief History of Computing <ul><li>Mainframes and Green Screens </li></ul><ul><ul><li>Intra-company system </li></ul></ul><ul><ul><li>Maintained by internal staff </li></ul></ul><ul><ul><li>Prior to the PC </li></ul></ul><ul><ul><li>Direct (hardwired) terminal to mainframe connection </li></ul></ul><ul><ul><li>Leased (dedicated) data lines for remote access </li></ul></ul><ul><ul><li>Zero risk of external malicious access </li></ul></ul>
  4. 4. A Brief History of Computing <ul><li>Client Server </li></ul><ul><ul><li>Intra/Inter company system </li></ul></ul><ul><ul><li>Maintained by internal staff </li></ul></ul><ul><ul><li>User’s Desktop PC = “Client” </li></ul></ul><ul><ul><li>Powerful PC(s) = “Server” </li></ul></ul><ul><ul><li>Local Area Network (Ethernet) </li></ul></ul><ul><ul><li>Wide Area Network (Internet & Leased Lines) </li></ul></ul><ul><ul><ul><li>V irtual P rivate N etwork (VPN) (“point to point tunneling”) encryption </li></ul></ul></ul><ul><ul><ul><li>Password encryption </li></ul></ul></ul><ul><ul><li>Virtually zero risk of external malicious access </li></ul></ul>
  5. 5. A Brief History of Computing <ul><li>Application Solution Provider (ASP) Hosting </li></ul><ul><ul><li>100% 3 rd party hosted </li></ul></ul><ul><ul><ul><li>No servers onsite </li></ul></ul></ul><ul><ul><ul><li>Support split - Internal IT & ASP host </li></ul></ul></ul><ul><ul><li>Generally Dedicated Servers </li></ul></ul><ul><ul><ul><li>100% Internet accessible </li></ul></ul></ul><ul><ul><ul><li>Dedicated machine(s) running only your application(s) </li></ul></ul></ul><ul><ul><ul><ul><li>No sharing with other companies </li></ul></ul></ul></ul><ul><ul><li>VPN access recommended </li></ul></ul><ul><ul><li>Very minimal but possible risk of external malicious access </li></ul></ul>
  6. 6. A Brief History of Computing <ul><li>Software as a Service (SaaS) </li></ul><ul><ul><li>100% 3 rd party hosted </li></ul></ul><ul><ul><ul><li>No servers onsite </li></ul></ul></ul><ul><ul><li>Virtual Servers (Cloud) </li></ul></ul><ul><ul><ul><li>100% Internet accessible </li></ul></ul></ul><ul><ul><ul><li>Machines may run multiple Operating System environments </li></ul></ul></ul><ul><ul><ul><li>Shared servers with other applications and customers (i.e. Google apps) </li></ul></ul></ul><ul><ul><ul><li>Shared application (multi-tenant) </li></ul></ul></ul><ul><ul><li>VPN or other encryption recommended </li></ul></ul><ul><ul><ul><li>HTTP vs HTTPS (Secure Sockets Layer - SSL) </li></ul></ul></ul><ul><ul><ul><li>Other methods available </li></ul></ul></ul><ul><ul><li>Minimal but possible risk of external malicious access </li></ul></ul>
  7. 7. SaaS & Cloud Terms Demystified <ul><li>SaaS - Primarily a software licensing model using cloud deployment architecture </li></ul><ul><ul><li>Multi-Tenant Architecture = Multiple customers sharing the same application instance and (usually) the same database (i.e.,, gmail, etc.) </li></ul></ul><ul><ul><li>Single-Tenant Architecture = One customer per application instance and database </li></ul></ul><ul><ul><li>Deployed in the Cloud (Over the Internet in a shared environment) </li></ul></ul>
  8. 8. SaaS & Cloud Terms Demystified <ul><li>Cloud Computing – Software deployment model </li></ul><ul><ul><li>Computing via the internet </li></ul></ul><ul><ul><li>On-demand network access </li></ul></ul><ul><ul><li>Shared pool of configurable resources </li></ul></ul><ul><ul><li>Rapid deployment </li></ul></ul><ul><ul><li>Infinite scale </li></ul></ul>
  9. 9. What is SAS 70 Type II? <ul><li>S tatement on A uditing S tandards </li></ul><ul><ul><li>Standard by which auditors evaluate servicing companies </li></ul></ul><ul><ul><ul><li>Unbiased reports by an auditor </li></ul></ul></ul><ul><ul><ul><li>Provides service organizations a reliable and widely recognized means of disclosing their internal security controls and processes to their customers </li></ul></ul></ul><ul><ul><li>Evaluation includes the way the service / company conducts its business </li></ul></ul>
  10. 10. Http vs Https (Secure Sockets Layer) <ul><li>Using an Https connection: </li></ul><ul><ul><li>The server responds to the initial connection by offering a list of encryption methods it supports </li></ul></ul><ul><ul><li>In response, the client selects a connection method, and the client and server exchange certificates to authenticate their identities </li></ul></ul><ul><ul><li>Then both parties exchange the encrypted information after ensuring that both are using the same key </li></ul></ul><ul><ul><li>In order to host https connections, a server must have a public key certificate , which embeds key information with a verification of the key owner's identity </li></ul></ul>
  11. 11. Secure Sockets Layer (SSL) <ul><li>When using a SSL connection (https): </li></ul><ul><ul><li>Recognized by a secure padlock which appears in the browser </li></ul></ul><ul><ul><li>Web server requires the use of an SSL certificate </li></ul></ul>
  12. 12. Security Breaches Happen <ul><li>“ A Wisconsin teenager has been arrested and charged for allegedly hacking into a Pentagon computer in June and illegally accessing a U.S. Army computer, according to the Department of Justice.” </li></ul>DOJ charges teen with Pentagon hacking
  13. 13. Security Breaches Happen <ul><li>“ Epsilon, a marketing services firm based in Dallas, has warned clients that a massive breach in an email database may have exposed the names and emails of thousands of users. </li></ul><ul><li>Among the affected clients are Best Buy, RitzCarlton Rewards, JPMorgan Chase, Capital One and Citi. </li></ul><ul><li>Epsilon maintained that no financial information – credit card numbers, for instance – has been revealed.” </li></ul>How many email warnings did you receive recently?
  14. 14. Why Host vs. On Premise Deployment <ul><li>Minimal security considerations </li></ul><ul><li>Selected vendor solution offered only in a hosted environment </li></ul><ul><li>Price important </li></ul><ul><ul><li>Capital vs Operating budget availability </li></ul></ul><ul><li>Deployment timeline </li></ul><ul><li>Limited internal IT resources </li></ul><ul><li>Limitless scalability </li></ul><ul><li>Reliability (99.99%+ uptime guarantees) </li></ul>
  15. 15. Driving Cloud Adoption
  16. 16. Cloud Economics <ul><li>Estimates vary widely on possible cost savings </li></ul><ul><li>“ If you move your data center to a cloud provider, it will cost a tenth of the cost.” – Brian Gammage, Gartner Fellow </li></ul><ul><li>“ Use of cloud applications can reduce costs 50% to 90%” - CTO in Washington D.C. </li></ul><ul><li>Preferred Hotel </li></ul><ul><ul><li>Traditional: $210k server refresh and $10k/month </li></ul></ul><ul><ul><li>Cloud: $10k implementation and $16k/month </li></ul></ul>
  17. 17. Why On Premise vs. Host Deployment <ul><li>Maximum security </li></ul><ul><ul><li>European “Safe Harbor” laws an issue </li></ul></ul><ul><li>Available IT resources </li></ul><ul><li>Price not an issue </li></ul><ul><ul><li>Long term lowest cost </li></ul></ul><ul><li>Greater internal control </li></ul><ul><li>Company policy </li></ul>
  18. 18. Risks and Rewards of 3rd Party Hosting <ul><li>Risks </li></ul><ul><ul><li>Security - Higher risk in a shared server/virtual server environment and/or no VPN access </li></ul></ul><ul><ul><ul><li>SAS 70 Type II audit provides high level of assurance that effective security procedures are in place </li></ul></ul></ul><ul><ul><ul><li>Data encryption options </li></ul></ul></ul><ul><ul><ul><li>Risk still low </li></ul></ul></ul><ul><ul><li>System down - Major hosting providers provide multiple layers of backup and redundancy </li></ul></ul><ul><ul><ul><li>Offsite / off grid Disaster Recovery options </li></ul></ul></ul><ul><ul><ul><li>Offsite data backup </li></ul></ul></ul><ul><ul><li>Internet Down - Everyone is down </li></ul></ul>
  19. 19. Risks and Rewards of 3rd Party Hosting <ul><li>Rewards </li></ul><ul><ul><li>Price - SaaS solutions generally have much lower upfront costs and low monthly costs vs. outright software purchase and onsite implementation services </li></ul></ul><ul><ul><li>Support - 24/7/365 maintenance and support included in the price & guaranteed uptime, commonly 99%+ uptime </li></ul></ul><ul><ul><ul><li>Minimize need for internal IT resources </li></ul></ul></ul><ul><ul><ul><li>Patches and upgrades are generally automatic </li></ul></ul></ul><ul><ul><ul><li>Scales up on demand </li></ul></ul></ul><ul><ul><li>Deployment Time - Generally much faster than a local software implementation </li></ul></ul><ul><ul><ul><li>Software already installed and ready to configure </li></ul></ul></ul><ul><ul><ul><li>Infrastructure in place and ready to go </li></ul></ul></ul>
  20. 20. Engaging Your IT Department <ul><li>Be part of the discussion </li></ul><ul><ul><li>Voice your issues and concerns </li></ul></ul><ul><li>Trust your IT department </li></ul><ul><ul><li>They understand the technology, risks, company policies, their resource constraints, etc. </li></ul></ul><ul><li>Work together in the vendor selection process </li></ul><ul><ul><li>Weigh functional requirements vs supportability </li></ul></ul><ul><ul><li>Gain consensus </li></ul></ul>
  21. 21. Summary <ul><li>Trust your IT staff to design the safest environment for your needs </li></ul><ul><li>Use VPN and other encryption technologies </li></ul><ul><li>Select only SAS 70 Type II certified providers </li></ul><ul><li>Consider Disaster Recovery options (redundancy) </li></ul><ul><li>Frequent offsite data backups (at least daily) </li></ul><ul><li>Plan ahead for your worst case scenario </li></ul>
  22. 22. LBi Software <ul><li>Established 1982 </li></ul><ul><li>Primary Focus on Human Capital Management (HCM) Solutions </li></ul><ul><li>Legacy in custom HCM development </li></ul><ul><li>Custom & Packaged solutions </li></ul><ul><li>Web 2.0 Development expertise </li></ul><ul><li>IVR/CTI/Speech Recognition expertise </li></ul><ul><li>Mission/Business Critical solution delivery </li></ul>
  23. 23. LBi Software Products
  24. 24. Q&A