Cloud compliance, data protection top reasons for encryption

Date: Apr 23, 2015

Cloud computing has changed many aspects of enterprise operations in recent years, but one thing it should never alter is a company's commitment to data security. The cloud can be a great business resource, but only when proper steps have been taken to ensure that information remains protected.
The most popular way to ensure this security is by using cloud encryption, according to Rich Mogull, founder of Securosis.
"One of the best tools that we have at our disposal to protect our information as it's moving around in the cloud … is encryption," Mogull said during a recent SearchCompliance webcast titled Pragmatic Cloud Encryption.
But in order to use encryption correctly, companies must understand how it benefits their cloud computing model, Mogull explained. The first step is determining how company data is stored in the cloud. This will depend on the cloud provider and whether the cloud computing model is Infrastructure as a Service (IaaS), Platform as a Service, or Software as a Service.
In IaaS, for example, there is physical storage followed by layers of abstraction and management, and then either volume storage or object storage. Mogull describes volume storage as a virtual hard drive, whereas object storage is like "a file system with an API layered on top."
The architecture may change for each cloud computing model, but the need for encryption does not. In part one of this webcast, Mogull discusses the four main reasons for encryption when it comes to IaaS cloud models. The first is to protect snapshots -- these information back-ups become extremely portable once in the cloud and could leave data exposed if not encrypted.
The second reason he gives is to protect against cloud administrators who may be able to see company data. Mogull describes this as a "low risk," but is still a concern for some companies.
The third reason, on the other hand, is one of the most important and obvious reasons for encryption: to achieve compliance. Often, regulations such as HIPAA/HITECH require cloud encryption for a company to be compliant.
Mogull's list of reasons for encryption ends with the discussion of protecting against what he calls "seizure spillage" in IaaS. Since cloud computing has a "shared tenancy" model, company information in the cloud could be exposed if the cloud is seized. Encryption, however, would help protect that information.
Watch part one of this webcast to learn more about the basics of cloud architecture and how encryption is vital to cloud computing security. Then visit SearchCompliance to view part two, where Mogull continues his discussion on pragmatic cloud encryption for the digital age.
Let us know what you think about the story; email Ben Cole, site editor. For IT compliance news and updates throughout the week, follow us on Twitter @ITCompliance.

Six must-have features when storing data in the cloud

By Staff Writer / April 15, 2015

Cloud storage prices are flirting with free, and capacity limits are on the rise. Just this past March, Google announced its Cloud Storage Nearline service that costs a penny a month for 1GB of storage. Service providers are dropping prices mainly because they can; technology advances – particularly for data that doesn’t need to be accessed often or quickly – has significantly increased storage efficiency, making it possible for providers to offer next-to-nothing prices. But if enterprises are going to take public cloud storage services seriously, they’ll need more than vast bins of low-priced storage to make it work.

“I think the biggest misperception we get when we talk to customers about cloud storage in particular is they view it as complete outsourcing,” said Henry Baltazar, senior analyst serving infrastructure and operation professionals with Forrester, in a webinar. “They think of it as `Okay, if I pull out my credit card, my problems are going to go away.’ And there’s really nothing farther from the truth. You still have a lot of things you have to care about.”
As such, many cloud service providers are offering value-add features, while add-on products such as cloud storage gateways, file sync and share, and hybrid backup are also becoming popular. These are the kinds of features and functions that differentiate one cloud from another. And enterprises should carefully evaluate them when making their decisions. Among the most important considerations are:
Security – Managed users access, authentication, and encryption are essential to protecting data regardless of where it’s stored; this is especially true when moving data outside the confines of the corporate data center. Reporting features for compliance are also necessary.
Redundancy – Having data stored at different geographical locations for redundancy just makes good sense, even if that means a hybrid approach where data is stored in the data center and backed up in the cloud.
Disaster recovery – Essential in case of natural, machine, or human-driven events. Enterprises can adjust these features based on their tolerance for downtime and data loss. If that tolerance is close to zero – for, say, financial services firms that execute trades for clients – those companies must be prepared to pay for advanced capabilities.
Collaboration tools – Employees and partners need fast, simple access to files. Tools that let them drag and drop files in folders, share files with simple links, and manage access to files keep them productive.
Administrative tools – For enterprises to maintain control over their data, they’ll want to be able to do things like manage permissions, set policies, and establish expiration dates for files.
Mobile access – With the explosion of mobility in the enterprise, providing fast, secure access to cloud-based storage from a variety of devices is essential.

http://www.thoughtsoncloud.com/2015/04/six-must-have-features-when-storing-data-in-the-cloud/

Cloud and security

Monday, April 27, 2015