In an increasingly digitalized world, the efficient and secure use of cloud services presents companies with the decision of how and where to store and process their data. There are various options, ranging from local server solutions and hybrid cloud solutions to services hosted entirely in a cloud.
First of all, there is always a solution for every company, regardless of size and number of employees, that is perfectly adapted to the needs of the organization, be it data availability, performance or compliance requirements. These options are often combined to find the best solution for the company.
At first glance, local server solutions often seem to be the right solution for companies when it comes to having maximum performance and control over their data. However, it should be noted that local server solutions require a very high initial investment. The main costs here are for the server hardware, which should be redundant, i.e. available in multiple versions, for reasons of reliability. An equally large item is likely to be the configuration, installation and virtualization of the server components, which should be carried out by data center experts to ensure that the initial installation is carried out correctly in terms of security and that the availability, confidentiality and integrity of the systems are guaranteed from the outset.
Even the best hardware is useless if it is not configured correctly according to the current state of the art. The functionality of the systems does not certify the correctness of the configuration. In addition, there are costs for electricity and the maintenance of an in-house server room, which should be equipped with air conditioning as well as access controls and a redundant power and internet supply.
Without any high initial investment in server hardware, companies have the ideal opportunity to outsource all services, such as the provision of virtual servers for a wide range of applications, to a cloud provider. Cloud environments are hosted in data centers. A distinction is made between private cloud and public cloud, with the private cloud infrastructure usually offering higher data protection and security standards as well as data control.
The main advantage compared to the local server variant is that the company does not have to worry about installing the software, a large number of systems are available in the event of a hardware defect, no replacement investments are required and the cloud provider's data center hardware is absolutely scalable.
For the company, this means that the virtual server hardware can be adapted to the needs and development of the business (number of employees, performance) at any time. Data centers are usually connected to Internet nodes (in Germany, for example, DE-SIX), which enables direct peering with a large number of peering providers. This increases network performance, supports the global reach of services (particularly useful when networking global locations) and offers reliability.
The central question that often arises for the end user: What about control over my data?
When choosing the right private cloud provider, the end user should make sure that it is clearly defined where their data is located and, above all, who has access to it.
When it comes to data control, there are always uncertainties among some big players, often public cloud providers, on the market.
The example of Office 365 makes it clear where Microsoft is heading and what consequences this will have for users: The classic Outlook with email and calendar function is to be replaced by the new Outlook Web App by the end of 2024. For most users, it is probably unclear that Microsoft will store the login data of the accounts directly on Microsoft servers in future and will therefore also have access to these accounts and their content, even if the accounts are not with Office 365 (e.g. IMAP accounts from a third-party provider).
The switch to the new Outlook app is to be completed by 2025 at the latest. From a data protection perspective, this step can be classified as questionable.
Every user of Office 365 services should answer the question for themselves whether they want Microsoft to have the access data for their email inboxes. Isn't email access data one of the most personal access data?
The majority of Microsoft Office 365 users are probably unaware of the Microsoft hack from 2023. A Chinese hacking group managed to steal the Microsoft master key. This gave the attackers access to almost all services and data stored in Microsoft cloud services for weeks.
The final report from CISA (US Cybersecurity and Infrastructure Security Agency) shows that Microsoft itself is responsible for the security incident and is accused of failing in the area of cybersecurity. In theory, this would have been a reportable security incident for every Microsoft user from the perspective of the GDPR.
