The Lawyers Weekly - Forensic Accounting & Fraud, 2012

A issue for business

canadian businesses working in the cloud are worried they
may be at risk of a data breach —and they well might be,
according to the results of a survey released earlier this year.

 more than half of the small-
and medium-sized-business
owners and it decision makers
surveyed for Primus business
services reported being
concerned with the security of
hosting in the cloud.
 Forty per cent of those who
expressed concern said they
would feel safer if cloud services
had full firewall protection and/or
if the cloud was a single-
tenant environment.

 Forty-eight per cent said around-the-clock
management and alerting would quell
their anxieties.

 Despite their worries about doing
business in the cloud, 60 per cent of
participating companies invest less
than 10 per cent of their budgets in
data security and 74 per cent do not
have secure off-site storage for critical business
data. more than 70 per cent do not continuously monitor
or manage their data.

“Service providers can locate hardware nearly
anywhere in the world without compromising their
ability to service anyone with an Internet connec-
tion,” said Hélène Deschamps-Marquis, a partner in
Blakes’ Montreal office. “Similarly, service providers
have the flexibility of hiring staff or licensing certain
functions across borders. In this context, forensic
investigators necessarily struggle with questions of
jurisdiction and are forced to co-operate with inter-
national law enforcement agencies.”
The nebulous location of information poses im-
portant real-world problems for investigators. For
example, said Dara Nevin, senior director of liti-
gation support services at McCarthy Tétrault LLP
in Toronto, “it’s not always clear whether domestic
laws apply.”
Chain of custody is also an issue. “It’s like a crime
scene,” said Eric Boehm, a partner in the Toronto
office of Borden Ladner Gervais LLP. “You’re looking
to make sure there is no monkey business. You have
to maintain the integrity of the data. In cloud com-
puting, it may be scattered over 100 hard drives.”
In fact, Ing said, “with cloud computing, it may
not be possible for forensic investigators to get their
hands on the physical devices or media containing
the potentially relevant information.”
Securing and collecting data also pose problems in
the cloud. “There are a wonderful set of collection
tools, but they presume you can go to a machine.
That’s not always the case in cloud computing,”
Nevin said.
Volume is an issue as well, said Boehm, whose fo-
cus is on technology law. “In the cloud, there could
be millions of documents to sort through. You need
to do your due diligence.”
“When you do your due diligence,” added Per-
cival, “look at it from the perspective of what are
your regulatory requirements and what does the
law require.”
Two other problems are facing forensic profes-
sionals working in the cloud: shared hardware and
fragmented information. The former refers to one of
the major benefits of cloud computing: the fact that
service providers can store information from mul-
tiple users on one piece of hardware. This is known
as multiple-tenancies, and it can present numerous
problems. “[H]ardware generally is not designed to
handle multiple-tenancies, making the clean extrac-
tion of one particular user’s information difficult,”
Deschamps-Marquis said. “Moreover, confiscation
of hardware is made all the more difficult where in-