In the early hours of Friday morning, millions of users were unable to access Microsoft on-line services because of a major service failure. Perhaps the most serious issue was the loss of Office 365 – Microsoft’s cloud-based applications suite. Following the previous disruptions at Amazon and Google, the incident is causing people to question whether moving to cloud-based solutions is really such a good idea. More generally though, the incident highlights three central themes in risk management.
Firstly, Friday’s events serve as a reminder that one can never outsource risk. By moving from hosting applications internally to accessing them over the internet one does not get rid of the risk of applications failing; one merely transfers management of that risk to another party. That said, there is a strong argument that specialist firms such as Microsoft, Google and Amazon should be much better at managing these risks than the rest of us so you may, at least, be able to significantly reduce the risk by moving to a cloud-based solution.
So why are people now turning against cloud computing? That question leads us to two other themes in risk management.
Failure of a large provider of on-line applications receives significant media coverage in a way that failure of a company’s own data centre does not. It is therefore easy for people to recall an example of a problem at Microsoft or Google which leads them to infer that they happen relatively frequently. In addition, we are generally more comfortable with risks where we are (or, more accurately, we believe that we are) in control. These two effects will both tend to bias people against cloud computing in the same way as people tend to worry more about air travel than travelling by car, even though we know that it is safer.