The document provides an executive briefing on strategic issues surrounding cloud services. It defines different types of cloud services and models. It also discusses the business drivers for cloud computing including cost optimization, risk optimization, and strategic agility. Additionally, it outlines some of the legal and security risks organizations should consider when using cloud services, such as data privacy and protection, contracting risks, and security vulnerabilities. It emphasizes the importance of having appropriate security policies, service level agreements, and terms in cloud contracts.

1. EXECUTIVE BRIEFING:
STRATEGIC ISSUES
SURROUNDING CLOUD
SERVICES
April 11, 2013

2. EXECUTIVE BRIEFING: STRATEGIC ISSUES
SURROUNDING CLOUD SERVICES
BRIEF INTRODUCTION TO
CLOUD COMPUTING
April 11, 2013

3. CLOUD DEFINITION
Automation Elastic Scale Orchestration
Key
Characteristics On-Demand Global Secure
Utility Billing
Self Service Access
Software as a Platform as a Infrastructure as a
Service Types Service (SaaS) Service (PaaS) Service (IaaS)
Cloud Types Public Private Hybrid Community
Thanks to Geoff Sinn and Dimension Data for certain slides. NIST = The National Institute of Standards and Technology
3

4. TRADITIONAL VS. CLOUD COMPUTING
4

5. BASIC DEFINITIONS: CLOUD TYPES
• A Cloud architecture that is deployed for the sole use of a single
Private Cloud enterprise – and resides on the enterprise premise (i.e. on-premise)
• A Cloud architecture that is deployed for the sole use of a single
Hosted Private Cloud enterprise – but hosted by a cloud services provider (i.e. off-premise)
• A Cloud architecture that is deployed for the provision of public cloud
services – a cloud architecture that serve multiple enterprises – hence
Public Cloud sharing of underlying infrastructure elements occur (to varying
degrees, based on the actual service type).
• A dedicated partition within a Public Cloud architecture that is
allocated to a single enterprise – hence certain elements of the
Virtual Private Cloud architecture are shared, while others are dedicated to a single
enterprise (related to the service type).
• A Cloud architecture that is made up of a combination of previous
Hybrid Cloud Cloud Types – most often a combination of Private and Public Cloud
Architectures (once again related to the service types).
• A Public Cloud Architecture for the provision of cloud services to a
Community Cloud specific or limited community or segment or vertical.
5

6. BREAKDOWN OF PRIVATE CLOUD
Source: Gartner 2011
6

7. BREAKDOWN OF PUBLIC CLOUD
• Finished Application that
you rent and customize
• Developer Platform that
abstracts the infrastructure,
OS and middleware to drive
developer productivity
• Deployment platform that
abstracts the infrastructure
Source: Forrester Research Inc.
7

8. THE ABC’S OF CLOUD – “XAAS”
AaaS – Architecture MaaS – Monitoring
BaaS – Backend NaaS – Networks
CaaS – Call Center OaaS – Office
DaaS – Data PaaS – Platform
EaaS – Email QaaS – Data Quality
FaaS – Frameworks RaaS – Recovery
GaaS – Governance SaaS – Software
HaaS – Hardware TaaS – Telephony
IaaS – Infrastructure Uaas – Unification
JaaS – Java Authentication Vaas – Value-Added-Services
Kaas – Knowledge XaaS – Anything
LaaS – Lending Yaas – Yield Optimization
ZaaS – Zebra
Credit: Updata Partners
8

9. BUSINESS DRIVERS OF CLOUD COMPUTING
Cost Optimization Risk Optimization Strategic Agility
• No capex, less assets • Business continuity • Time-to-market
• Pay-as-you-use • Technology • Innovation
• On-demand capacity independence • New business models
• Elasticity • Operational complexity • Resource leverage
• Economies of scale • Specialized skills
• Time-to-value
9

10. ECONOMICS OF CLOUD COMPUTING/SAAS
 Recommend resources from VC firm Updata Partners (Carter
Griffin) web site:
http://www.updatapartners.com/resources/12/SEVC-Cloud-Presentation/
 SE Venture Conference 2013 Presentation on Cloud
Computing
 Growth in Cloud market from $14B in 2010 to $60B in
2016
 SMB’s are early adopters
 Cloud Computing: GMPP, rCAC and the Importance of
Component Level Analysis -- Key metrics for measuring and
managing a SaaS business
 Cloud Computing: A Closer Look at Churn -- a deeper
analysis of churn and its impact on SaaS businesses
10

11. EXECUTIVE BRIEFING: STRATEGIC ISSUES
SURROUNDING CLOUD SERVICES
MANAGING LEGAL RISK IN
THE CLOUD
April 11, 2013
11

12.  Main areas of legal risk:
 Keeping data “secure” to:
 Manage personal information in compliance with
growing number of laws and regulations, and
 Maintain trade secrets/other IP
 Avoiding contract risk and the customer-supplier
“gap”
12

13. CLOUD COMPUTING AND SECURITY
Advantages Disadvantages
 Data Dispersal  Lack of Transparency
 Data Fragmentation  Lack of Responsiveness
 Secure Data Centers  “Trading Market” of
Subcontractors
 Multiple Customer
Demands  Vendor Lock-In
 Easier Patching and
Updates
13

14. UPDATES IN PRIVACY AND SECURITY LAW
 HIPAA Updates
 This month – 10 year anniversary for HIPAA
 2009 Hi-Tech imposed obligations on vendors (“Business Associates”)
 New Omnibus Rule effective March 26, 2013; compliance required generally by
September 23, 2013. Enhanced obligations on Business Associates and
increased penalties.
 Massachusetts Data Security Act
 Effective March 2010; contract requirements effective March 2012
 Requires contract terms with vendors; written security policy; and that certain
personal information to be encrypted
 New COPPA Regulations
 Published December 2012; compliance required July 1, 2013
 Now covers third-party plugins, ad networks
 Expands what constitutes personal information (e.g. IP Addresses)
14

15. UPDATES IN PRIVACY AND SECURITY LAW
 EU Data Protection Proposed Regulations
 In January 2012, detailed revisions proposed to make the law more
uniform across the EU, and increases protections and possible penalties
 US companies seeking to transfer personal information from EU to US
must follow a safe harbor certification/filing approach or other rules to
comply with EU regulations
 FTC:
 Concerns have increased from use and sale of personal information, to
use of IP addresses, device identifiers, and other information not
normally considered as personally identifiable
 Breach Notification Laws:
 NC Identity Theft Protection Act of 2005
 Virtually all states have adopted similar statutes
15

16. SECURITY POLICY
 Legal Requirement to have a Written Information Security Policy:
 NC law: All companies must have written procedures relating to the destruction
of personal records as official policy
 Mass. Data Security Act: organizations that handle information about Mass.
residents must have a comprehensive written information security program
 HIPAA/Hi-Tech: Also requires a written information security program
 Federal Trade Commission: Failure to protect personal information by using
reasonable security can be an unfair and deceptive trade practice
 Other Good Reasons for a “WISP”
 Complying with breach notification laws
 Assuring compliance with required privacy notices (e.g. California requirement)
 Protecting intellectual property
 Satisfying officer and director fiduciary obligations
 Complying with contracts
 Increasing value of company to buyers
 Dealing with subpoenas and related requests for electronic information in
discovery
16

17. CONTRACTING IN THE CLOUD
 Typically service agreements, not licenses
 Often offered via “click and accept” agreements
 Sometimes incorporate by reference other terms of
use and policies
 Sometimes purport to be changeable without notice
by the vendor
17

18. CONTRACT TERMS: SECURITY AND PRIVACY
 Confidentiality
 Obligation to maintain reasonable and effective
physical, technical and administrative security
measures
 Compliance with all applicable data privacy and
security laws
 Right to review security/disaster recovery policies
 Right to audit and test security
18

19. CONTRACT TERMS: SECURITY AND PRIVACY
 Notification in the case of breach
 Indemnification for breaches/payment of costs
of required notices to customers
 Require use of encryption
 Restrictions on use of subcontractors and
downstream sharing of information
 Restrictions on where data can be stored
19

20. CONTRACT TERMS: DATA ISSUES
 Ownership and Use of Data
 Disposition of Data on Termination
 Location of Data
 Legal / Government Request to Access Data
20

21. CONTRACT TERMS: SLA’S
 Uptime
 Performance & Response Time
 Error Correction Time
 Infrastructure / Security
 Performance Credits
 Use of Measurement Technology
 Notice/Reporting Obligations
21

22. CONTRACT TERMS: PRICING
 Monthly service fees
 Per user or provider, or based on transactions?
 When does it start?
 Implementation fees
 Commitment to start date?
 Add-on pricing
 Payment terms
 Caps on increase in fees
22

23. CONTRACT TERMS: TERM & TERMINATION
 Length
 Termination Rights
 Termination Penalties
 Data Rights upon Termination
 Vendor Termination or Suspension
 Automatic Renewal
23

24. KEY TAKEAWAYS
 Companies (vendors and users) should:
 review the laws applicable to their situation, and
update security practices, policies and
procedures as needed
 perform appropriate due diligence and contract
negotiations for important cloud contracts
 review insurance policies and possibility for
additional insurance
24