The Fog of Cloud Services

I spent a good part of the last hour following links to stories about security and privacy lapses in Google Docs. I started out with a TechCrunch article detailing additional security loopholes that a security expert had recently uncovered including:

* Embedded images in protected documents that never go away and that get saved to an open server
* The new diagram feature of Google Docs saves all previous versions of the diagram and makes them available to anyone who can read the doc, even if you've set the diagram to view only mode
* Sometimes users still can access documents after their permissions have been revoked

These are pretty serious issues for customers who use Google Docs in a true collaborative fashion; where internal contributors create content, collaborate on it, and produce a final version that is shared with a new audience that is only intended to see the final product.

As I followed links in the post I found that earlier in March a Google Docs user uncovered a bug that was overzealous when setting document permissions on collections of documents. I can actually envision the flawed logic of the code behind that button. Burr. Google reacted and took steps to remedy the problem ultimately notifying customers that they created an automated fix that removed all permissions (except the authors) from the affected documents. Pretty dramatic, and having been through things like this before, not without its own risks of corruption and locking people out of documents for good; what would happen if the author is no longer available?

According to the account of the person who reported the bug, the two weeks that Google took to respond and remedy the problem was admirable, despite the fact that "ultra-secret" information was shared with people who should not have seen the information. Not only does this raise the question of how enterprise-ready Google Docs development is but also what customers come to expect of cloud service providers. I wonder if two weeks would have been admirable if this were Microsoft instead of Google. Not to harp on the customer. He was satisfied and the problem was remedied in part due to his own pro activeness.

Bottom line is the stakes are high when it comes to offering enterprise services in the cloud. Not only for the provider but also for the customer. I had considered using Google Docs for a recent project but decided against it because I did not know where the information was going to be stored. Since it was client information I was working with, and not my own, I opted for the much more cumbersome email approach to sharing files. I’m glad I did. The problems caused by posting embedded images to a separate, unprotected store that subsequently does not remove images when the document is deleted is a reminder that users of cloud services have no control over the architecture or infrastructure of the system (unlike an in-house system) and that they are trusting Google is doing the right thing. In this case Google isn't doing the right thing; at least not right now.

To me this begs the question of whether or not Google's developers really understand developing for enterprise requirements. Sharing and collaborating enterprise content is not new (I keep saying that around cloud services) and there are many developers who brought us products like Lotus Notes and Groove that understand the issues in creating systems to share and secure content. What is new, however, are vendors building sharing platforms in the cloud as if they were enterprise-deployed solutions. They are doomed to make the same mistakes that were made in the early days of collaborative systems if they do not tap into the knowledge that enterprise solution developers already know. And customers will fall into those traps if they aren’t careful. I recall a customer account of how an unprotected HR file that listed salaries of all employees made it into the company’s shared store only to be accidentally displayed in a searching demo to executives. Scary as it was, the problem was contained within the intranet. Imagine if that had been in the cloud?

Google Docs is a 2.5-year-old beta product, which should tip customers off to the fact that it’s all one big experiment still. It is one development model to continue to stumble along, make the same mistakes that companies like Lotus and Microsoft spent years learning, and to use its customers as guinea pigs. If the price point (free) is worth it, then customers of Google Docs can have little recourse when something goes terribly wrong. Customers need to consider all cloud services as carefully as they would consider in-house solutions. Checking out the technical facts as well as their risk tolerance before “buying” is likely to mitigate buyer’s remorse. Don’t count on users to be cautious once you bless the service. Users will not be concerned about how a system is implemented to ensure that the information they post is secure. If the tool makes their work easier you can be assured it will be used heavily. Therefore, it’s up to the people who understand IT to make sure that the cloud services that the company uses are satisfactorily implemented and is secure.