- Computing Services

About us
HomeComputing Services: About BUCSComputing Services: Policies and Guidelines → Storing in the cloud

Advice on storing University of Bath information in the cloud

Commercial and free services such as Dropbox offer convenience and simplicity. However, there are risks to their use and it is important that these are understood so that sensible decisions can be made about the suitability of their use for any given purpose.

You should use caution before storing information on Google Apps, Dropbox, or any other cloud service provider. The following issues need consideration:

These areas are considered in more detail below but, as a general rule, if there are legal or reputational consequences should the information you are storing be lost, stolen, or seen by unauthorised persons or organisations, you should not use a cloud service provider to store, transmit, or process it. Computer Services will not install sharing applications on to PCs where they would prevent an unacceptable security risk, or would otherwise interfere with the network.

Sensitivity

Once data is submitted to the cloud, there are no guarantees as to its security. In fact, there have been many documented examples of security breaches to Dropbox and other cloud services providers. There is no way of irrefutably guaranteeing the security of the data once it is with the cloud provider. Furthermore, your data could be held anywhere in the world. Therefore you will need to consider the nature of the information.  If it includes sensitive personal, non-public information (e.g., addresses, financial information, health information, or confidential educational records) it must be stored on systems that are designed with security in mind and which typically use access control and encryption to prevent unauthorised access. If loss or unauthorised access of the data would be in breach of the Data Protection Act, or cause embarrassment or reputational damage to the University, it should not be placed with Cloud service providers. Even when using cloud services for non-sensitive information, you should always use a different user name and password to your University IT account.

Criticality

You should also consider the criticality of the data. IT equipment fails, and natural disasters can wipe out entire buildings and cloud service providers rarely give any guarantees about the availability of their services.  If you have data that would impact the operation of the University in any way should that data be lost or become unavailable, the use of cloud services should be avoided.

Value and Ownership

The University by its nature undertakes research and produces valuable intellectual property. If you have files or data that have high intellectual or financial value (e.g. original research papers or designs), cloud service providers should not be used.

Research Restrictions

If you are undertaking research, there may be restrictions in place which would preclude the use of cloud technology. These include confidentiality agreements with partner organisations, or research subjects, restrictions as part of your research grant, or import/export restrictions. You should check carefully before submitting files to a cloud service provider and ensure that all parties and stakeholders in the research are satisfied that your handling of the data is sufficiently robust.

Technology

Some cloud technologies require the installation of a local application. The free versions of these are not designed for enterprise use and they can cause issues with the University’s IT environment. Therefore as a general rule, only the web version of these tools should be used and Computer Services may be unable to install or support certain applications (including the Dropbox Windows application) where they are known to cause problems to Active Directory PCs.
If you have any questions about whether cloud storage (at Dropbox or any service provider) is an appropriate tool for your storage needs, please contact the Computer Services Service Desk in the library or on ext. 3535, or click on the ‘Help’ button on the Computer Services web pages.


John Beaver
Assistant Director User Services