Last week, I presented at the AIIM 2012 conference on the topic of "the cloud." When it comes to the cloud, there is one issue that raises the most concern; the issue of security. My response to the common question, "Is the cloud secure?" is that security can no longer be used as an excuse to avoid the Cloud. I'd like to tell you why.
In the world of IT, security is a valid and continuous concern. Any machine storing data,whether that machine is connected to the web or not, is a security risk. Even employees in the building wielding thumb drives can be a potential threat to your organization's security.. Unless, of course, you have the mission impossible set-up.
As security is a risk regardless of where your servers are located, why do so many companies cling to the idea that if a server is not on-premise, it must not be secure? In reality, the cloud is actually more secure than on-premise servers.
All cloud providers employ a full-time network operations team monitoring security 24/7, in real time.
When I reached the slide on security during my AIIM presentation, I surveyed the audience. Made up of mostly IT managers, I asked, "How many of you were aware of the recent MS RDP Exploit?" Out of an audience of approximately forty, three people raised their hands. THREE PEOPLE. And I know two of them.
The MS RDP exploit is a very serious security threat and I'm going to go ahead and assume that everyone in the audience works for a company with at least one machine that is connected to the web.
At CloudShare, we knew about the exploit the day it happened. On that same day, we patched our servers, updated the security to our firewall, and notified customers of updates they needed to make. As a cloud provider, it is our responsibility to be ahead of the curve when it comes to security. We're equipped to address a breach quickly and effectively. Our team of geeks in net operations lives to keep hackers out. When it comes to Cloud security, I'm comfortable betting that the cloud is more secure than your corporate network.
Next, is your data. Data protection is a REAL concern for a company using a cloud solution. The concern is twofold. First, can other customers of the cloud provider see your content? Second, can the employees working for the cloud provider gain access?
Generally, cloud providers want to stay in business and your concerns for data security can and should be addressed easily. Ask your provider about their policy. If you receive no response, bail immediately.
What is CloudShare's policy?
First, with respect to other customers, there are several ways we silo user content:
- Trial users are on a completely separate infrastructure than paying customers
- Each client's VMs are on separate networks
- Data from one user to another is segmented and keys matching data to user are kept separate from content
- Cloud Folders utilizes a unique authentication separate from CloudShare authentication
- We monitor, monitor, monitor, and if needed, block!
All data is fragmented so that no user can access another user's data in its entirety. Consider how difficult it would be to de-fragment a hard drive without knowing which pieces of files belong together.
Second, does the CloudShare team have access to your virtual machines? In cases of technical support, it is possible for a CloudShare employee in the IT team to access to your VM, with your permission. We may also run critical patches on your machine, such as the patch for the RDP Exploit. In summary, our policy on employee access is as follows:
- Only the Support team has access to view user machines
- A user machine will only be accessed when requested by that user
Not secure enough? No problem. There is a way to ensure that even the CloudShare support team can't gain access to your data. You can change your passwords on the machine and disable auto-login. Just click on Edit environment > User & Access. If you do this, the only way we can access your VM is if you give us your password.
A vast majority of our users do not populate Virtual Machines with private data because they're using us for pre-production, but regardless, isn't it nice to know just how protected your VMs are with CloudShare?
Bottom line: the cloud is secure and, most likely, more secure than your corporate network.