Earlier today I attended a session at Softworld about Cloud Computing. This had a panel of users and vendors (providers). What was clear when they contradicted each other was that even these "experts" don't know all they need to know about cloud computing - and I mean "need to know", if they (and you) are to gain the benefits without excessive pain at some stage.
That's not a criticism of these people, as the cloud is a relatively new fangled thing. However for those of us who have been using SaaS (Software as a Service) applications in front line business for over ten years, we have had our parts bitten, and know first hand what matters.
One of the comments that remained unchallenged was on the matter of security, in terms of access. This was along the lines of that old chestnut "
We've been using internet banking for years, so SaaS is safe." We've also been using SaaS ervices such as Hotmail, and every now and again it and similar systems get hacked.
The difference? Like GoogleMail and many others, Hotmail relies only on a userid and password, where the userid is public knowledge - typically the email address. Many business SaaS systems similarly only use a userid and password. At the other end of the spectrum, the banks have at least one extra level of security, such as random digits from a PIN or second password, and/or the need for a physical device. Chalk and cheese.
So what does a confidential application like payroll use? Dennis Keeling gave the opening keynote address at Softworld this morning. Turns out he is an HR and payroll specialist, as part of a broad knowledge of the packaged software market. He tells me that for larger organisations, remote access to payroll services is typically by userid and password, but always in combination with a "private cloud" secure internet pipe. Without that, he would expect some additional level of security, such as random digits from a pin number (like some of the banks do).
For smaller businesses, here are a number of internet payroll services. These talk about various security methods, such as 128-bit SSL (secure socket layer) encryption, as is used by the banks. Nonetheless.here are some incidents of
web payroll systems being hacked, to try and make immediate fraudulent electronic payments.
In an ordinary accounting system, there is often an equivalent mechanism for supplier and staff expenses payments. Good access security in these systems is therefore vital.
IN CONCLUSION
A simple user id and password is not as secure as the internet banking systems, nor as secure as the better payroll systems.
There will be many applications in a business where a userid and password combination is adequate, given the low potential consequences of unauthorised access. But there will also be applications, such as Accounts Payable, where some additional level of access security is a must.
For more "myth busting", see last week's article "
SaaS Cloud Computing - The Hype, The Truth and The Wardrobe"
.