With an endless number of methods for data security, there are very few people who understand the difficulties in maintaining and developing a cloud based business system, rather than just encrypted streams of data with no context in reality.

We have come to understand that companies like SalesForce.com can replace hugely expensive and complex internal systems, effectively removing the need for something like a construction company to have a database development department   Mr Halbert points out that we must understand  how a system must be structured to be successfully secure as well as perceived to be secure by its client base.

Any modern programmer can understand an API security features and determine if the data transfered is actually “secure” to an acceptable level, but often there is no audit.  How this is done, how to accomplish it without fooling yourself into thinking you’ve “done it”.  If you have the potential loss of millions of dollars, you can’t simply have a group of programmer review the system.

There is also the difficulty in relying on third party agencies to handle your data.  How can you follow HIPPA procedures with healthcare regulations are they are?  Data being spread internationally without the owner of the data’s knowledge can also be effected by a given nation’s privacy laws.  How to deal with data subpoenas from a seemingly endless number of sources if you are utilizing a third party, or if you are the third party yourself.

Security is both technical, structural, political and emotional.  Now that we’ve found a million ways to encrypt data, it’s time to focus on putting that technology to use in the real world.  Often reality is ugly, decisions have to be made with cost and time restrictions that aren’t understood.   There is no answer that covers all the levels, but an audit starts with understanding what to look for and how to prepare for it.

A great book for people developing systems and those in need of a higher level of understanding of the whole.

-Dan Morris