Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

In an era of ubiquitous broadband, smart-phones, and users who manage multiple computers and devices, it just makes sense to move your email, photos, documents, calendar, notes, finances, and contacts to awesome web applications like Gmail, Evernote, Flickr, Google Docs, Mint, etc.

But transferring your personal data to hosted web applications may have its potential pitfalls, risks that get lost in all the hype around cloud-centric new products like Google's new Chrome OS, etc. (No personal offense :) )

But with the good comes the bad. When you decide to move your data into the cloud, there may be some gotchas..

So what are the problems that can arise in cloud computing?

Personal interpretations will be better rather than picking up some risklist from Google :P


migration rejected from May 28 at 15:51

This question came from our site for professional and enthusiast programmers. Votes, comments, and answers are locked due to the question being closed here, but it may be eligible for editing and reopening on the site where it originated.

closed as off-topic by Jim B, mdpc, Flup, yagmoth555, dawud May 28 at 15:51

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions on Server Fault must be about managing information technology systems in a business environment. Home and end-user computing questions may be asked on Super User, and questions about development, testing and development tools may be asked on Stack Overflow." – Jim B, mdpc, dawud
If this question can be reworded to fit the rules in the help center, please edit the question.

17 Answers 17

From the Berkley cloud computing blog:

Recently, a colocation facility owned by Core IP Networks LLC was raided by the FBI and the entire datacenter was shut down. "Millions of dollars' worth" of computers, many owned by other companies colocated in the datacenter that had no connection to the companies being investigated by the FBI, were confiscated and those sites went offline. Some of the companies subsequently went out of business. Spreading one's cloud application over multiple physical datacenters may protect against natural disasters, but if those datacenters are all operated by a single provider or in a single jurisdiction, customers might still be exposed to other business continuity disruptions such as this one.

One would think that the courts would become more sensitive this with a little education as cloud-computing becomes more popular. I guarantee that no court would shut down all Google or Yahoo data centers for any reason. – Christopher Sep 17 '09 at 19:22
Christopher: there has been some talk of enacting laws that would require vital internet services such as google search to meet the same uptime/failover/disaster recovery specifications as the telephone system. So you may get your wish, though not quite as you envision. for the record, I'm against any such laws, even for the telcos. – rmeador Sep 17 '09 at 19:36
@rmeador: The telephone company is a natural monopoly, and generally a government-granted one in addition, so there's a lot more justification for regulating them. Internet search is not a natural monopoly. I can't pick which phone company serves my house with its land line, but I can always switch to Bing. – David Thornley Jan 21 '10 at 17:54
@David: in my town, I can choose any one of at least 3 phone companies for my landline. Several years ago, legislation was enacted which apparently requires telcos to lease their phone lines to competitors. – rob Feb 25 '10 at 19:55
@Chris: The phone company is a monopoly, because it's hard to run indefinitely many physical connections to houses. There are other ways to get monopolies, such as lock-in and network effects (cf. Microsoft Windows), but they don't apply nearly as much for search. It would take a hefty investment to take market share away from Google, but Google itself was an upstart in Internet search, where there were several dominating companies (like Lycos, Altavista, and Yahoo). – David Thornley Feb 14 '11 at 21:59

Somebody else has all your data. While the odds are good that they're better than you are at security and backups, it does mean additional exposure for sensitive data. Whatever privacy policy they've got it won't make up for the loss caused by other people seeing your business negotiations or full credit information or that picture of you and the chipmunks or whatever.

Further, you can have your data compromised remotely, whether by accident, illegal act of somebody else's employee, subpoena, bankruptcy (whose data is it, legally?), or whatever, without having a clue what's going on.

+1 "you can have your data compromised remotely, whether by accident, illegal act of somebody else's employee, subpoena, bankruptcy (whose data is it, legally?)" and the list goes on. – Chris S Aug 6 '10 at 13:02
The thing is that, for most people, having even a remotely competent company in charge of their data is vastly better than leaving it up them - in case you've never had users, people outside the security industry (well, and often inside it, too) have a tendency to ignore any precautions they've been taught, particularly if it's the slightest bit inconvenient. – Xiong Chiamiov Nov 24 '12 at 20:35
@XiongChiamiov The problem is that skilled hackers target datacenters more than individual devices. So by handing off your data, you both improve security practices around that data (hopefully) and exponentially increase the number of people gunning for it. One could plausibly argue that the second factor rises faster than the first. – astralfenix May 16 at 8:49

One of the big potential benefits of cloud computing is automatic scaling. Have a site that only gets moderate traffic most of the time, but now and then really gets hammered? You only have to pay for the architecture to support the busy cycles when you use it rather than all the time.

The hidden risk here is cost: it's very easy to mis-configure this such that an unplanned busy period or other glitch really ramps your costs up well beyond what you were prepared for.

I'm reminded of mammoth phone bills some people get. – David Thornley Sep 17 '09 at 19:06

From what I hear, big roadblocks for companies who are thinking of adopting cloud computing include:

  • availability: Google seems well-equipped to handle this, but there was the Gmail outage which I think was last week. Time = money if there is an outage.
  • control of data and data security: how comfortable are managers & IT folks when it comes to handing all of their data over to a separate company to safeguard?

Also, technologies in general come and go. Cloud technologies are evolving rapidly, and companies are probably waiting to see which way to go.

For your second point: a heck of a lot more comfortable than they should be, in many cases. – David Thornley Sep 17 '09 at 19:06
+1, Data Control: You give them all your valuable data and then hope they don't lose it all… – Chris S Aug 6 '10 at 13:00

"So what are the problems that can arise in cloud computing?"

Who do you trust most with your data (which covers all aspects of your digital life)?

Yourself, or some giant corporation which may well be persuaded (or forced) to share all your data to an authoritarian government one day. They'll probably share it (with your permission) with data deepminers (the service could be 'free' at a cost).

You'll also lose the ability to erase parts of your data...

So: cloud computing (taken to the extreme) could annihilate your privacy.

+1, Can't be sure they've erased their backups; which can be a huge liability if you get sued. – Chris S Aug 6 '10 at 13:01

This is a really good question. Cloud hosting of enterprise data seems to be a polarizing topic whenever it comes up in technical circles. Opinions range from gushing optimism to vehement hatred of all things cloud, so it's kinda hard to get the middle-ground picture on things.

That said, I've been involved with a number of enterprise migrations to cloud hosted solutions and here's the common sticking points that I've noted:

Data Retrieval

Long-term data retention and retrieval are easy to overlook when you're looking to move 'into the cloud'. Consider a scenario: It's 5 years later, and you want to move from your current provider to something different (another vendor's cloud, or back to a local software stack). How do you get your data out of the current system? How usable is the data going to be once you've got it?

With an in-house software stack, you bought the license, so you can restore the stack at a later date and restore your data if you absolutely have to. With a cloud solution, you have to ensure that you a)have an extract of the data and b)have some way of presenting that data. This is of particular concern if the data in question is required for any regulatory compliance reasons.

The bigger players in the various areas of cloud hosting are starting to improve their approach to this by exposing more APIs for data retrieval and settling on more standard formats. That said, you need to do your homework around this and ensure that the retrieval mechanisms you may require are present, and that they remain present as the product evolves. This brings me nicely on to my next point which is.

Platform Consistency

One of the touted benefits of cloud hosted software stacks is that development and improvement of the system is iterative, and the hassle of updating the system is entirely offloaded to the vendor. Of course, this also means that the update cycle is taken out of your hands, so changes in the way the system works can pop up without warning.

A good way to identify elements of your IT infrastructure as suitable for cloud hosting is to look at a system and ask 'Are we using this in a standard manner that's mirrored in other organization?'. Common examples of this are Email (most businesses use email in the same manner) and corp website serving (which has kinda been 'in the cloud' for decades).

A great example of the potential to get burned by this just happened: Google Wave's had the plug pulled on development, and it looks pretty likely that it'll cease to exist as a discrete tool in the near future. Some businesses are already invested in wave as a collaboration tool within their organization, and those must now find a new way of conducting that aspect of their business. So you should consider the question of 'what happens if that neat widget that saves the finance guys hours of manual work gets removed next week?'


While many cloud vendors tout stability and uptime as core advantages of cloud solutions, few seem willing to wrap their SLAs (if they even exist) with proportionate breach compensation. The big players have a lot of customer confidence in the reliability of their systems, seemingly on the basis that they're too big to fail. But is that really the case? There are numerous instances of large vendor cloud solutions failing. When you get down to the smaller players in the game, how can you even begin to evaluate the robustness of a vendors cloud solution? They are inherently hidden away and unknown.

So there's a strong need to look at any cloud solution from a DR perspective and say 'OK... assume this service disappears off the face of the earth one morning. How would the business suffer, and what would we need to do to recover from an indefinite outage? How long would we wait before we attempt to restore some form of service internally?'. These are all the kinds of questions you ask about your internal system when generating a DR process, but with a cloud-hosted solution you may not have sufficient options to adequately cater for DR, and it may not be wise to assume that a cloud solution will achieve the up-time you require.


So here's a scenario: You purchase 25 user licenses for a cloud-hosted email system. You reach your license limit, and an employee leaves and a replacement employee come on-board. What happens when you set that new employee up on the system? You'll have to either purchase an additional user license, or re-use the user license from the exiting user. But what about that exiting user's email? Does it all go up in smoke? Is there some kind of long-term freeze you can put on the account and free up the license? Again, this is a tricky one, vendor-specific, and you might not hit the issue until you've been running your new system for months. But it's a gotcha.

Full Disclosure: My employer Fronde is heavily invested in cloud solutions, and has ties to Google. Everything in this post is my opinion and not necessarily that of Fronde.

On the subject of data retrieval, there may well be legal requirements. Where I am all financials, as well as a lot of other business data, must be retained for a minimum of 7 years. Our laws also make it mandatory to retain that data in a physical store. – John Gardeniers Aug 6 '10 at 13:12

In addition to my other answer:

Companies are generally pretty cautious about selling off private information. Many times, they're prevented by law, but not always and not for all information.

But it's a different story when the company bankrupts and has debt collection agents knocking on their doors. Now, selling what they can to get the most out of their dying business looks pretty good, regardless of their customers (because, hey, they won't be customers for much longer!)

There are holding companies that buy old customer information from dying businesses. Can you imagine what would happen if Google bankrupted and they decided to throw the 'do no evil' out the window?


There is a potential for data misuse that some people may or may not see that well. What can Google do with all that GMail data? What could Microsoft do with stuff on Live Mesh? How confident are you that there isn't something else happening with all that data?

There is also the potential eventual hacker story about how someone broke into some cloud services and got personal information used for criminal purposes like identity theft.


No Internet connection. When your tubes get clogged. You won't be able to access your data, unless you have it set for offline browsing.

Service Hiccups. When Gmail went down, many people didn't have access to their email.

And so on.


Security and Assurance.

From a very practical standpoint, and an issue I've found first-hand, it is difficult to assure your customers you are keeping their credit card and personal information safe.

To that end, requirements that are necessitated by the Payment Card Industry (such as PCI-DSS and the like), are hard to meet because third parties need to be brought into the security picture.

Imagine if Amazon outsourced its entire web stack to a third-party cloud. Not only does it have to figure out for itself (and its customers) that security is in fact soundly implemented, it also needs to assure PCI (Mastercard, JBC, Discover, etc.) that the card data is being handled securely. It is not an easy task.


Lack of log files. Seriously, on Google Apps we had 8 email accounts disappear. We have several admins and one of them may have deleted the accounts but no-one is owning up to it. We may have had an account break-in to one of those admin accounts, but no-one is owning up to that (assuming they even noticed). Google may have accidentally done something bad.

But we have absolutely no idea since there are no log files. Nothing to indicate exactly when the account was deleted, or by whom (and by extensions other logs that would show where that person was logged in from and when).

But the service could easily provide those logs (as Gmail now does, I believe), just as many home-grown applications don't ever get around to adding logging capabilities. Cloud has nothing to do with it. – Xiong Chiamiov Nov 24 '12 at 20:39

I know a lot of cloud providers take security very seriously, yet there is always the issue that your data is existing on someone's hardware at a remote location. Depending on your scenario, this may be a legitimate concern.


it just makes sense to move your email, photos, documents, calendar, notes, finances, and contacts to awesome web applications like Gmail, Evernote, Flickr, Google Docs, Mint, etc.

What a load of nonsense. Next you'll be telling us to get rid of our personal computers and use Internet kiosks, because that is an exact equivalent to trusting all your files to some faceless "cloud", over which you have absolutely no control.

Any data over which you don't have complete control is no longer your data, as many individuals and companies have already learned.

As for

ubiquitous broadband

You seem to think that everyone has a massive pipe to the Internet, complete with unlimited traffic. While that may be true for some, it's certainly not the norm on planet Earth. Nor can the very vast majority of people rely on their Internet connection to be always up.


When you host on your own bare metal or in a private cloud, you have full access to the hardware and to the host OS to know how hard the box is being pushed.

When you're in a public cloud, your cloud provider is financially incentivized to stuff as many customers as they can into a single box. You really don't know what percentage of the hardware you're given or how many "noisy neighbors" are going to slow you down, and it's in their best interest for their sales people to keep telling you their service is wonderful.

It's very difficult to diagnose intermittent application performance issues when you don't know how loaded the hardware is at any given moment, and without full knowledge of the application, it's very difficult to point a finger back to them.

What does "100% CPU" really mean when you see it, if the concept of a "CPU" itself is a moving target? When things are slow, maybe you need a database index. Maybe your user in Japan is experiencing latency today. Adding platform availability to that equation is one extra complication that I'd rather avoid when possible.


Development time can increase very much, mainly because browser compatibility and security concerns.

This seems like a problem related to web-based applications in general, not cloud computing. – tadman Sep 17 '09 at 19:23

Getting back to the old days of dumb terminals and thin clients.

Except for the part where users may carry their terminal everywhere they go, conveniently, and in their pocket. – jscott Sep 3 '11 at 15:02