With the advent of increased bandwidth, customer demands and competitive pressures, many software vendors are looking at alternative delivery models for their packaged products. As such, the Software-as-a-Service (SaaS) business model has garnered a lot of interest, but vendors say the uptake is being hampered by the perception that data hosted by a third party cannot be secure. However, Hubert Wentzel, Divisional Director, EOH Consulting, says that the multi-tenant architecture employed by most SaaS vendors offers sound security and real cost advantages.
“Multi-tenant” is not a new concept, Wentzel says. It has become a buzzword in line with SaaS gaining popularity, and to outline the value of this architecture, he explains the basics of a hosted SaaS solution.
“There are three layers to this: a presentation layer, an application layer, and finally the database layer – which relates to your multi-tenant architecture. All your data is stored in your database layer, with the intelligence residing in the application layer. While some of the arguments against SaaS will warn that your database layer can be compromised, you will in fact be able to engineer the level of security you require for this data by working with your applications vendor. Despite being one of many ‘tenants’, you will be able to choose the policies put in place and define the level of encryption required for your data. Once you have encrypted the data, nobody without authorisation will be able to use it. This aspect of data ‘insecurity’ is thus something I believe people need to explore – potential users don’t research it enough before making their decision regarding SaaS.”
Apart from offering sound security, multi-tenant architecture also offers real cost advantages through its various “schema” options. A schema acts as a shelf in a cupboard. While you might want an entire “cupboard” to store your data, a customised shelf might actually be far more appropriate. If you decide on this single schema option, it will be structured with the metadata requirements of your data, and within this “shelf” itself you will be able to store your data securely.
“Another schema option to consider is that of sharing one with someone else – possibly other departments for example,” Wentzel says. “In this instance, you’ll be given a unique key to access your particular shelf contents securely. Going back to our cupboard analogy, in this instance you’ll now choose the colour of your hanger – with the green hangers being protected from the blue hangers and vice versa. If you have data that is very sensitive, such as medical records, using this type of schema to secure it will still be far more cost-effective than bringing the whole application in-house.”
Most attractive though, Wentzel adds, is the pay-for-use model supported by most SaaS vendors. Long gone are the days of being forced into purchasing your software/business systems outright. SaaS allows for business system costs to be operationalised (like the bureau service from yesteryear) making high-end business systems so much more affordable for SMEs.
In conclusion, Wentzel says that perhaps it’s time for CIOs to finally start challenging the outdated perceptions so often associated with SaaS. By exploring issues of data storage and security with vendors, companies are sure to find that they will not only be able to secure their data appropriately, but also store it cost-effectively while simultaneously benefiting from the other advantages SaaS brings.
Hubert Wentzel
Divisional Director
EOH Consulting
Great article. One of the clearest pictures of what SaaS offers. I’m a true believer in SaaS and have seen how secure they are.
Ex. I use NetDocuments for document management and they use dual redundancy data centers. One is at Lexis Nexis and the other is at some commercial bank in Utah. I have no concerns about my security. However, when I move to SaaS, I ensure security and like SaaS offerings that have been around for a little bit (Salesforce.com, Bill4Time, google). I don’t like to be the first user if you know what I mean…
Another way to look at it is, that SaaS providers can offer you better security than you yourself might be able to. This is because they develop expertise managing infrastructure and providing security and backups, which you yourself might not, since it is not your core business. But it is important that you opt for credible and sustainable SaaS providers.