Dedicated to Providing Insight Into the Enablement of Cloud Hosting Environments.

Cloud Hosting Journal

Subscribe to Cloud Hosting Journal: eMailAlertsEmail Alerts newslettersWeekly Newsletters
Get Cloud Hosting Journal: homepageHomepage mobileMobile rssRSS facebookFacebook twitterTwitter linkedinLinkedIn

Cloud Hosting Authors: Vaibhaw Pandey, Matt Brickey, Harry Trott, Yeshim Deniz, Liz McMillan

Related Topics: Cloud Computing, Memopal, Cloud Hosting & Service Providers Journal, Cloud Backup and Recovery Journal, Platform as a Service, Java in the Cloud

Blog Feed Post

Spying and the Real Risks of Cloud Storage

Security is a holistic effort that starts on-premise and can extend to the cloud.

Unless you‘ve been living under a rock the past few months, you probably have heard about the NSA's PRISM surveillance program and perhaps wondering whether that should affect your business's decisions to store data in a public cloud. Even if you are not worried about the NSA specifically, rumors that agencies can potentially access your data leads to the obvious concern of malicious third parties not being far behind. So what measures can you take to protect your data?

For starters, keep in mind that much of the data stored in the cloud is not encrypted at all. If your data is stored with strong encryption at-rest, like AES-256, you are well ahead of the game. In spite of unconfirmed allegations that virtually any security can be cracked, the reality remains that it takes billions of years to unlock a single AES-256 encrypted cloud storage object using today's technology. Even if we hypothesize third parties have technology that is ahead of the rest of the world, we still have to assume technology advances via standard metrics, such as Moore's Law, which observe that processing performance doubles approximately every 18 months as opposed to improving by quantum leaps.

As a further data point, the NSA recommends AES-256 encryption to protect its own top secret data. For many, this may be the strongest reassurance that this type of encryption is more than suitable for protecting corporate data.

So can a 3rd party gain access to your data in spite of encryption?  In short, yes. A legitimate exposure point is often weak endpoint security. Generally speaking, creating simple passwords for convenience creates security gaps that can be exploited by 3rd parties. For instance, consider where your encryption keys are backed up how they are protected. Are the keys encrypted and who has access to them? As a general rule, keys should not be stored with your data or left managed unencrypted by a provider who stores all of your data.

Consider also that if your on-premise security has cracks and fissures, creating an air-tight security strategy around cloud storage does nothing to make on-premise endpoints any stronger. For instance, are there external access points to your network via VPN? Are there tight access controls to critical data that is shared with authorized individuals across your organization? It is important to close any and all access routes to prevent a 3rd party from potentially accessing your data.

The bottom line

Security is a holistic effort that starts on-premise and can extend to the cloud. Done right, a hybrid cloud storage environment can be as secure as a tightly controlled on-premise environment. However, keep in mind the old adage that your environment is only as secure as its weakest link - even social engineering is a real threat. Make sure your entire IT environment is audited and checked on a regular basis.

Recent events have heightened focus on data security in the cloud. Rather than viewing this as a negative, consider instead the positive impact, as more organizations are becoming aware of the appropriate security measures they need to take to protect their data and vendors are stepping in to provide more robust security solutions.

The post Spying and the real risks of cloud storage appeared first on TwinStrata.

Read the original blog entry...

More Stories By Nicos Vekiarides

Nicos Vekiarides is the Chief Executive Officer & Co-Founder of TwinStrata. He has spent over 20 years in enterprise data storage, both as a business manager and as an entrepreneur and founder in startup companies.

Prior to TwinStrata, he served as VP of Product Strategy and Technology at Incipient, Inc., where he helped deliver the industry's first storage virtualization solution embedded in a switch. Prior to Incipient, he was General Manager of the storage virtualization business at Hewlett-Packard. Vekiarides came to HP with the acquisition of StorageApps where he was the founding VP of Engineering. At StorageApps, he built a team that brought to market the industry's first storage virtualization appliance. Prior to StorageApps, he spent a number of years in the data storage industry working at Sun Microsystems and Encore Computer. At Encore, he architected and delivered Encore Computer's SP data replication products that were a key factor in the acquisition of Encore's storage division by Sun Microsystems.