Google Apps intrigues IT pros, but security worries remain

Google likes to boast that more than 2 million businesses run Google Apps, but IT pros harbor concerns about security in the cloud and the limited functionality presented by Google tools such as Gmail and Google Docs.

Cloud computing was one of the main topics tackled this week at the Burton Group Catalyst conference in San Diego, but interviews with attendees suggest that Google and other cloud providers have a ways to go in convincing tech pros that their security model is robust.

Google Apps vs. Microsoft Office

Still, the same technology pros are impressed by Google's Web-based collaboration capabilities, even though Google Apps lacks some of the advanced functionality found in Microsoft Office.

"My wife and I use [Google Docs] for everything from budgeting to vacation planning. It actually works great," says Jonathan LaChance, the global network and telecom manager for National Instruments in Austin, Texas.

The ability to collaborate on documents in real time has been useful at work, but LaChance says the limitations of Google Docs become apparent quickly for anyone who needs pivot tables and other specialized spreadsheet functionality.

National Instruments is a Lotus Notes shop when it comes to e-mail, and LaChance himself isn't responsible for the company's e-mail and collaboration systems.

But other IT pros at Catalyst said security concerns related to Gmail would prevent them from moving away from in-house e-mail systems. "There's a lot of good things with Google for our students, but for our faculty and staff, because of security concerns, we've elected to keep it on our own hardware," said Eddie Sorensen, senior director of infrastructure services at Utah Valley University.

Utah Valley is moving from Novell GroupWise to Microsoft Office and Exchange right now. Sorensen says his security concerns are less specific to Google than the cloud in general, and "not having the total comfort with what type of data is going to be out there."

Security questions also seem to be at the heart of delays in a massive Google Apps implementation in the city of Los Angeles, where the police department has expressed concerns about entrusting data to Google.

At Catalyst, one IT pro who works for a major financial services firm but declined to be identified by name in a news story, said Gmail wouldn't fly at his organization because of worries about security.

Brent Starnes, a regional director in Dallas for Logic Trends, a consulting firm in the identity access and management area, said only a few of his company's clients are adopting Google Apps at the moment. Security is the main reason "why we haven't had a lot of momentum," he said. "It's early discussions right now."

Part of the Catalyst conference was devoted to discussing cloud law, and liability in the event of data breaches and other failures.

Drew Bartkiewicz, a Catalyst speaker who runs The Hartford's business to insure companies against cyber risk, gets to decide whether to insure companies against technological failures, and in some cases has rejected multi-million dollar insurance applications because of concerns about tools like Google Apps.

One large client that happened to be "a large city in California" went to The Hartford to insure a project involving Gmail, Bartkiewicz said. (He didn't name the city, but the situation is similar to the Los Angeles Google Apps project). The city was looking for an insurance plan in excess of $40 million, he said.

"I chose not to insure that particular scenario because I still saw too much uncertainty as to who would hold the liability if there was a breach of data," Bartkiewicz said in an interview. "Would it be a [third-party consulting] company implementing Gmail? Would it be the city using the application or would it be Google itself? Given that 2009 was a record year for data breaches we chose to not insure that particular scenario."

Microsoft, of course, is now getting into the cloud business with hosted versions of Exchange and SharePoint, and Office Web Apps, and will face the same risks.

"Microsoft is entering a space where Google already is," Bartkiewicz said. "I'd just say that Google is a larger target as demonstrated by that attack [the one originating from China last year]. But neither one are immune to the business risk. The customers believe they're transferring this risk to a cloud provider and that's not always the case."

So far, Google's terms and conditions have largely been untested by case law, Bartkiewicz says. And unfortunately for customers, most cloud agreements limit monetary damages to the amount of the contract, the cost of which may not cover the cost of losing data.

"Say you put all your jewels and gold and high valued items and money into a bank. If there was a breach and that bank said 'you only paid us $200 a year to manage your assets, so here's your $200, sorry you lost your assets,' that really wouldn't play well with you nor would they be in business very long," Bartkiewicz says.

Despite security concerns related to cloud computing, users at Catalyst did express some interest in Google's applications."I'm not sure that Google Apps is ready to replace Office but it seems like it's getting there for what most people need," said Craig Londraville, campus technology manager at Portland Community College in Oregon. "I guess within probably the next year it will be a competitor for most users who don't need the high functionality that Office can provide."

The Portland college uses Microsoft Office and does not officially support Google Apps, but campus users are unofficially using Google to share and edit documents, Londraville said. He uses Gmail and Docs for personal and business use, for planning personal trips, and editing business documents. "It's pretty convenient in that regard," he said.

Like LaChance, Londraville said he notices formatting problems in Google Docs, but says the issues are "not insurmountable."Google salespeople are pushing the idea that Apps is now a viable competitor to Microsoft Office in the enterprise, LaChance notes.

While LaChance says that "remains to be seen," he doesn't doubt Google's ability. "It's Google," he says. "They seem to be able to do anything they put their minds to."

Follow Jon Brodkin on Twitter: www.twitter.com/jbrodkin

Read more about software in Network World's Software section.