Wednesday, August 19, 2009

New Cloud Value Proposition – Improving Data Security

While it may seem counterintuitive, storing data in the cloud can provide some companies an enhanced level of security, depending upon their existing infrastructure and security policies. Short of starting from ‘scratch’ with the corporate data infrastructure, many security problems can be effectively addressed through the implementation of a proven, secure cloud storage infrastructure, as offered by Bycast StorageGRID software, which can enhance security processes.

In reality, many companies know what they should be doing but can’t get it implemented, often for cost or complexity reasons. Another reason is good old-fashioned denial. Like insurance, data security can be put off or ignored, especially in a tough economy, without consequence - until something happens.

Or the problem may be as simple as getting people to follow the rules, especially those with the power to circumvent those rules. The cloud can be an enabling technology, giving many of these companies a path to implementation of the security measures they know they need but are having trouble implementing. For example, data security issues frequently involve error or complacency about data protection processes by internal personnel. According to a recent InformationWeek white paper on Data Loss Prevention (DLP):

“The Achilles heel of DLP is that the people with access to the most sensitive data are also the people who are powerful enough to exempt themselves from enforcement tools and policies.  Senior managers and sales staff often will not allow policy to interfere with their personal convenience and often give short shrift to advice and education about data security.”

   "Risk Intolerant: Defense in Depth and the Rise of Data Loss Prevention", InformationWeek Analytics, June 2009  http://dataprotection.informationweek.com/

This doesn’t mean that all security issues can be blamed on employee carelessness. In general, all data put into the cloud is that much less data that is available ‘in plain sight’ on the corporate storage infrastructure; to the people who may be part of the problem. The cloud can provide the kind of structure that will reduce errors and complacency with data security procedures.

Specifically, the cloud can provide the following to improve data security:

Encryption

Everyone knows they should be encrypting data, but so far, only a minority actually do. The issues include cost, performance penalties and basic uncertainty of risk/reward. Data encryption involves deciding which data to encrypt, where in the infrastructure to encrypt and the management of encryption keys. Like other infrastructure details, the cloud takes the effort out of implementing encryption. Data is encrypted at the point of ingest into the cloud and remains encrypted throughout its lifetime, even as it is transported between nodes or physical storage locations in the cloud. The key management is structured and cloud providers can maintain a set of keys to lower the risk of inaccessible data should the end user lose the keys. Or, keys can be kept by the end user, exclusively, to provide the maximum level of security.

Elimination of Backup

Through defined policies, data is replicated and stored in multiple Tiers and at multiple sites throughout the cloud environment. This eliminates the need for traditional primary site backup altogether which reduces security risks along with overall data access, handling and transport.

Elimination of Disaster Recovery

The cloud also removes the need for DR as data is virtualized and stored in multiple physical locations. This removes another copy of data from existence and eliminates an entire set of procedures that expose it to potential loss during both the storage and retrieval.

Safe File Sharing and Collaboration

Since cloud storage is a virtual environment, collaboration is built-in. It eliminates the risk of ad hoc transfers as people share data by less secure means; like private email, USB drives, etc.

Controlled Access

The cloud enables implementation of a ‘need to know’ structure for existing data. In most organizations, more people have access to data than probably need to. Moving data to the cloud institutes another layer of password protection allowing the list of authorized users to be reduced to the essential personnel.

Elimination of Off-site Tapes

Similar to the DR discussion above, the cloud’s virtualization and replication functions make the recording of a separate set and removal of tapes for off-site storage obsolete. This reduces the potential risk of loss or theft and removes the need to implement tape encryption to protect against such occurrences.

Partitioning

Data from different departments or locations can be partitioned within the cloud to provide another layer of security and reduce unauthorized user access. Data partitioning can also be desirable in order to keep a corporation’s divisional assets separate from each other so the corporation can more easily keep subsidiary organizations operating independently, can more easily spin out divisions into subsidiary companies, divest the assets, etc. In addition to security, it can also make business sense.

Audit and Reporting

Records of data movement ‘transactions’ and users who access the data are kept by cloud administration. These data can be reported and exported for security auditing.

What about the risks from unauthorized access outside the organization? What external security measures do cloud providers offer?

If the cloud is a private cloud, then edge and infrastructure are both inside the firewall; no security concerns. If it is a public cloud, then access is via a strongly-encrypted VPN connection; no security threat. If the cloud is a hybrid cloud, then edge is inside the firewall and infrastructure is outside the firewall. In this case the filesystem gateway resides inside the firewall and all data is transferred to the infrastructure via strongly encrypted HTTPS connection; again, no security concern. Secure cloud infrastructures implement strong encryption of data BOTH while in transit AND while at rest. If either one of these two states was missing there would be security concerns about moving and storing data in the cloud. One could make the case that the weakest link in any of these scenarios is the customer’s firewall. It may be easier to hack into the company and steal non-cloud data than to hack into a cloud.

Most cloud providers store data from multiple clients on the same physical volumes. This could be a security risk, except that partitioning logically separates each client’s data set. And, most cloud providers offer dedicated volume storage for clients that want it – albeit at a higher cost. Also, since all data is encrypted prior to transport to the cloud, it’s unreadable by others without the encryption keys.

A security concern when implementing multi-tenancy is loopholes that allow clients to browse each other’s filenames (even if they can’t read the encrypted files). Simply uncovering filenames can give insight into a company’s internal strategies. So proper multi-tenancy involves more than simply protecting clients' data from being read by other clients, it’s about seeing exported file shares, extracting audit logs, etc. The data of one client must not only be protected against reading by other clients but also stored such that the existence of other customers' data cannot be snooped, transaction logs cannot be snooped and other exported file shares cannot be browsed or even discovered; yet a client can still collaborate across multiple sites and share data across their enterprise.

For many organizations, the cloud may be a solution to improving data security. It provides a simple route to data encryption, along with secure remote file sharing and an audit trail of user access. The cloud reduces extra copies and the handling of data through the elimination of backup and DR requirements, including off-site storage of tapes. For companies with personnel whose carelessness or complacency exposes them to security risks, the cloud removes data from the corporate infrastructure altogether, reducing access and putting it in a more secure environment.

Eric Slack, Senior Analyst