One Cloud Does Not Fit All

Migrating to the cloud can mean a multitude of things. There are private clouds, public clouds, hybrid clouds, and cloud applications. What works for one firm may not be the best choice for every firm. It is important to look at firm needs holistically before evaluating options.

What Is the Cloud Anyway?

The primary meaning of cloud is merely that your data and, in some cases, your applications do not reside on your PC or on systems within your office. A private cloud can mean that an internal IT team is administering your network, but all systems reside in a hardened off-site data center with redundant power and connectivity. It can also mean the same thing when it is managed by a managed service provider (MSP) or hosting company. The word private indicates that firm data remains isolated from that of others and that the resources used to host it are solely used by your company.

The public cloud is very similar, but some of the resources used to host the infrastructure may be shared between companies. Microsoft® Azure® and Amazon® Web Services offer many different options for which there are shared resources which can make systems very resilient provided they are optimized for resiliency by duplicating resources across geographical areas.

The hybrid cloud model means that some components may be hosted in an off-site data center and some are hosted on site locally. Some firms opt for this if they have clients who insist that none of their data reside in the cloud.

Cloud applications are somewhat different in that it is just that application and data that is being hosted and provided by the software company. Firms who choose this option may have most of their resources in their own on-premises data center but have decided on specific cloud applications to supplement their existing systems. Alternatively, they may use an assortment of cloud applications instead of having any on-premises systems.

What About the Acronyms?

As with any new technology, the cloud comes with its own vernacular and jumble of acronyms. Most of these represent the way service is delivered as well as the way providers charge for the service.

SaaS or software as a service is when a software company provides just their application to you over an Internet connection and usually also hosts your data.

DaaS or desktop as a service refers to a situation where none of a company’s data or applications reside in their own offices or even on their own computers. The beauty of DaaS implementations is that they are device agnostic, allowing customers to choose the device to which they wish the desktop or applications to be delivered, and all the company data remains on company systems.

IaaS or infrastructure as a service is where a company’s entire IT infrastructure, which could include telephony and other communications resources, are hosted by a managed service provider or by a public cloud provider.

In many of the “as a service” situations, the customer does not own the hardware or software but rather pays a monthly, quarterly, or annual subscription fee to use the product. This can make cancelling the service or switching to another service provider complicated and time sensitive. When deciding on a cloud provider, ensure that an exit strategy is outlined in the agreement and that it is something with which your firm can tolerate.

Points to Consider

All too often, firms are lured into migrating to cloud products without considering what it really means. If all firm data is located in the cloud, suddenly the firm’s Internet connectivity becomes supremely important. For firms with minimal or no in-house IT, cloud solutions can be a great way to ensure resiliency of applications and data. If all firm resources required to do business are in the cloud, having redundant Internet connections is essential. Whether working with multiple service providers or just one, ensure that each connection is either delivered through a different medium or at least routes through a different central office. This ensures that, even when there are issues in the local area, diversified Internet connections may not both be down at the same time, allowing everyone to continue working with cloud products.

Microsoft has made some changes in recent years that are driving most law firms toward subscription models for both their Windows desktop operating systems (Microsoft 365) and their productivity solutions like the Office Suite (Office 365). Years ago, companies with 250 people or more could get enterprise agreements for the Microsoft solutions they used. More recently, Microsoft raised the minimum number of licenses to 500, effectively forcing the small- and medium-sized law firms toward these new subscription models.

Many of the tools that come with these subscriptions go unnoticed or under-utilized by firms that have already moved to the Office 365 model. One of the most powerful tools works with Exchange Online and can be used to prevent sensitive information from being sent in email messages. This same component can prevent sensitive information from being shared through OneDrive or SharePoint as well.

Moving to the cloud is no simple process. Depending upon which option is chosen, firms may own the software or just their data. An important consideration is the security and privacy of data stored on personal devices.

For firms that have BYOD (bring your own device) policies in place, migrating to the cloud requires careful consideration. Choosing solutions that require data to be downloaded or uploaded to and from personal devices would require additional products and resources to ensure the security of that data. Are all the devices encrypted? Is there a way to prevent download of data to unencrypted devices? Some solutions offer a feature called containerization. In this model, a secure encrypted container is created for the application and its data on the device, ensuring the security of the data stored within. This also ensures that, when a shareholder or an employee leaves, firm data can be wiped from the device without eradicating personal information like photos and music.

DaaS is one type of containerized solution that works well for firms with BYOD situations. The entire desktop, including all applications, is provided to devices. All data stays within the virtual desktop and never contacts the device used to access it. Another advantage to these solutions is that product integrations continue to work regardless of the location from which the system is accessed. These solutions work well for firms whose shareholders are partial to Apple® products since they are device agnostic. Even though most legal applications are designed for PCs, they can be accessed from a Mac® through a virtual Windows desktop.

Firms that provide equipment to their shareholders and employees have more freedom to choose different cloud options. Firm equipment can be controlled centrally and set up to be remotely wiped. It can also be returned upon leaving the company, ensuring that no firm data leaves with the departing shareholder or employee.

While it does present advantages to outsource all of these services, it is still the firm’s responsibility to maintain the security of client data. This means several things. First, do some due diligence when selecting cloud providers. Second, going with cloud products does not mean IT assistance is unnecessary. With some Cloud products, merely signing up with their service does not mean your data is now safe. Often additional configuration is required to ensure that the product meets client security requirements. The Office 365 system is a prime example of this. It has many wonderful features that will prevent sensitive information from being shared outside the firm, but these features are not enabled by default. Finally, it still sometimes requires bringing in outside expertise to optimize workflows and ensure that new systems are optimized for efficiency.