Is SaaS office safe?

Is software as a service (SaaS) office safe? We get this question a lot and the SaaS office most often asked about is Google Apps for Business and Microsoft Office 365. This security concern reflects in our research numbers: Fewer than 18 per cent of organizations are planning to deploy SaaS office but nearly twice as many companies are evaluating.

So, is SaaS office safe? There is no clear yes or no answer; the answer depends on relative risk versus in-house operations. Really, the right question to ask is, "Does SaaS office put me at greater risk and if so, can I justify this increased risk?"

FOR MORE: 5 problems with SaaS security

So, how do you move from risk relativity to reality? We look at seven key focus areas:

• Violation of compliance requirements -- SaaS office providers need to routinely undergo a third-party audit assessing their compliance with relevant regulations and legislation. A significant issue is controlling where the providers store (physically) the data, particularly for global companies.

• Availability -- Don't expect more than 99.9 per cent availability from SaaS office. How does this compare with your in-house Exchange availability?

• Integration with identity management -- The service must integrate with in-house identity management to provide multifactor authentication and single sign-on.

• Breach disclosure concern --There must be clear breach notification terms in any agreement with the SaaS office provider. You also have to understand the data leak prevention controls; both to avoid loss and avoid costly false positives. Both Google and Microsoft make it clear they are data processors and not data owners. In this role, their only obligation is to inform you of the breach; not your customers.

• Vendor lock-in -- This is one of the biggest challenges of moving to the cloud. What if the cloud provider goes out of business? What if there is a more competitive offering? A graceful exit must be part of the agreement. Tools are getting better and vary by provider, but don't expect a quick and easy exit.

• Intentional data disclosure -- The rules of engagement must be clear that releasing one customer's data does not expose any other customer's data. This is a particularly troublesome area, given neither case law nor clear application of the Fourth Amendment to search and seizure of data in the cloud.

• Audits -- Audits are the only means to assess the security controls of the SaaS office provider. Ideally, the SaaS office provider uses trusted third parties to perform standard audits and makes this information available to you.

Discuss each one of these areas with potential SaaS office providers and then turn the magnifying glass on your own operations. For example, do you comply with ISO 27001 or Federal Information Security Management Act (FISMA)? Microsoft has passed an ISO 27001 audit and both Google and Microsoft offer FISMA-compliant solutions.

The end result of this exercise should be a table comparing the relative risk of your in-house solution against the SaaS office solution. We find SaaS office increases risk for some organizations, for some it's a wash, and for some it actually decreases risk.

Ritter is a senior research analyst with Nemertes Research. He is filling in for Andreas Antonopolis who will return soon.

Read more about software in Network World's Software section.

Join the Good Gear Guide newsletter!

Error: Please check your email address.
Rocket to Success - Your 10 Tips for Smarter ERP System Selection

Tags SaaSGoogleMicrosoftsoftwareSoftware as a servicecloud computinginternet

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Ted Ritter

Network World
Show Comments

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Matthew Stivala

HP OfficeJet 250 Mobile Printer

The HP OfficeJet 250 Mobile Printer is a great device that fits perfectly into my fast paced and mobile lifestyle. My first impression of the printer itself was how incredibly compact and sleek the device was.

Armand Abogado

HP OfficeJet 250 Mobile Printer

Wireless printing from my iPhone was also a handy feature, the whole experience was quick and seamless with no setup requirements - accessed through the default iOS printing menu options.

Azadeh Williams

HP OfficeJet Pro 8730

A smarter way to print for busy small business owners, combining speedy printing with scanning and copying, making it easier to produce high quality documents and images at a touch of a button.

Andrew Grant

HP OfficeJet Pro 8730

I've had a multifunction printer in the office going on 10 years now. It was a neat bit of kit back in the day -- print, copy, scan, fax -- when printing over WiFi felt a bit like magic. It’s seen better days though and an upgrade’s well overdue. This HP OfficeJet Pro 8730 looks like it ticks all the same boxes: print, copy, scan, and fax. (Really? Does anyone fax anything any more? I guess it's good to know the facility’s there, just in case.) Printing over WiFi is more-or- less standard these days.

Ed Dawson

HP OfficeJet Pro 8730

As a freelance writer who is always on the go, I like my technology to be both efficient and effective so I can do my job well. The HP OfficeJet Pro 8730 Inkjet Printer ticks all the boxes in terms of form factor, performance and user interface.

Michael Hargreaves

Windows 10 for Business / Dell XPS 13

I’d happily recommend this touchscreen laptop and Windows 10 as a great way to get serious work done at a desk or on the road.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?