In response to my post regarding Cloud (SaaS, really) providers' security, Allen Baranov asked me the following excellent question in the comments:
Hoff,
What would make you trust "the Cloud"? Scrap that... stupid question...
What would make you trust SaaS providers?
Generally, my CEO or CFO. :(
I don't "trust" third party vendors with my data. I never will. I simply exercise the maximal amount of due diligence that I am afforded given prevailing time, money, resources and transparency and assess risk from there.
Even if the data is not critical/sensitive, I don't "trust" that it's not going to be mishandled. Not in today's world. (Ed: How I deal with that mishandling is the secret sauce...)
I then got thinking about the line that Ronald Reagan is often credited with wherein he described managing relations with the former Soviet Union:
Trust but verify.
Security professionals use that phrase a lot. They shouldn't. It's oxymoronic.
The very definition of "trust" is:
trust |trəst|
noun
1 firm belief in the reliability, truth, ability, or strength of someone or something : relations have to be built on trust | they have been able to win the trust of the others.
• acceptance of the truth of a statement without evidence or investigation : I used only primary sources, taking nothing on trust.
• the state of being responsible for someone or something : a man in a position of trust.
• poetic/literary a person or duty for which one has responsibility : rulership is a trust from God.
• poetic/literary a hope or expectation : all the great trusts of womanhood.
See the second bullet above "....without evidence or investigation"? I don't "trust" people over which I have no effective control. With third parties handling your data, you have no effective "control." You have the capability to audit, assess and recover, but control? Nope.
Does that mean I think you should not put your information into the hands of a third party? Of course not. It's inevitable. You already have. However, admitting defeat and working from there may make Jack a dull boy, but he's also not unprepared for when the bad stuff happens. And it will.
I stand by my answer to Allen.
You?
/Hoff
