
By Nicos Vekiarides | Article Rating: |
|
November 12, 2013 03:43 PM EST | Reads: |
1,803 |

Unless you‘ve been living under a rock the past few months, you probably have heard about the NSA's PRISM surveillance program and perhaps wondering whether that should affect your business's decisions to store data in a public cloud. Even if you are not worried about the NSA specifically, rumors that agencies can potentially access your data leads to the obvious concern of malicious third parties not being far behind. So what measures can you take to protect your data?
For starters, keep in mind that much of the data stored in the cloud is not encrypted at all. If your data is stored with strong encryption at-rest, like AES-256, you are well ahead of the game. In spite of unconfirmed allegations that virtually any security can be cracked, the reality remains that it takes billions of years to unlock a single AES-256 encrypted cloud storage object using today's technology. Even if we hypothesize third parties have technology that is ahead of the rest of the world, we still have to assume technology advances via standard metrics, such as Moore's Law, which observe that processing performance doubles approximately every 18 months as opposed to improving by quantum leaps.
As a further data point, the NSA recommends AES-256 encryption to protect its own top secret data. For many, this may be the strongest reassurance that this type of encryption is more than suitable for protecting corporate data.
So can a 3rd party gain access to your data in spite of encryption? In short, yes. A legitimate exposure point is often weak endpoint security. Generally speaking, creating simple passwords for convenience creates security gaps that can be exploited by 3rd parties. For instance, consider where your encryption keys are backed up how they are protected. Are the keys encrypted and who has access to them? As a general rule, keys should not be stored with your data or left managed unencrypted by a provider who stores all of your data.
Consider also that if your on-premise security has cracks and fissures, creating an air-tight security strategy around cloud storage does nothing to make on-premise endpoints any stronger. For instance, are there external access points to your network via VPN? Are there tight access controls to critical data that is shared with authorized individuals across your organization? It is important to close any and all access routes to prevent a 3rd party from potentially accessing your data.
The bottom line
Security is a holistic effort that starts on-premise and can extend to the cloud. Done right, a hybrid cloud storage environment can be as secure as a tightly controlled on-premise environment. However, keep in mind the old adage that your environment is only as secure as its weakest link - even social engineering is a real threat. Make sure your entire IT environment is audited and checked on a regular basis.
Recent events have heightened focus on data security in the cloud. Rather than viewing this as a negative, consider instead the positive impact, as more organizations are becoming aware of the appropriate security measures they need to take to protect their data and vendors are stepping in to provide more robust security solutions.
The post Spying and the real risks of cloud storage appeared first on TwinStrata.
Read the original blog entry...
Published November 12, 2013 Reads 1,803
Copyright © 2013 SYS-CON Media, Inc. — All Rights Reserved.
Syndicated stories and blog feeds, all rights reserved by the author.
More Stories By Nicos Vekiarides
Nicos Vekiarides is the Chief Executive Officer & Co-Founder of TwinStrata. He has spent over 20 years in enterprise data storage, both as a business manager and as an entrepreneur and founder in startup companies.
Prior to TwinStrata, he served as VP of Product Strategy and Technology at Incipient, Inc., where he helped deliver the industry's first storage virtualization solution embedded in a switch. Prior to Incipient, he was General Manager of the storage virtualization business at Hewlett-Packard. Vekiarides came to HP with the acquisition of StorageApps where he was the founding VP of Engineering. At StorageApps, he built a team that brought to market the industry's first storage virtualization appliance. Prior to StorageApps, he spent a number of years in the data storage industry working at Sun Microsystems and Encore Computer. At Encore, he architected and delivered Encore Computer's SP data replication products that were a key factor in the acquisition of Encore's storage division by Sun Microsystems.
![]() Apr. 26, 2018 10:45 AM EDT Reads: 5,694 |
By Liz McMillan Apr. 26, 2018 10:30 AM EDT Reads: 2,968 |
By Liz McMillan ![]() Apr. 26, 2018 10:00 AM EDT Reads: 5,748 |
By Elizabeth White ![]() Apr. 26, 2018 09:45 AM EDT Reads: 6,715 |
By Pat Romanski ![]() Apr. 26, 2018 08:45 AM EDT Reads: 8,908 |
By Pat Romanski ![]() Apr. 26, 2018 08:45 AM EDT Reads: 3,891 |
By Liz McMillan ![]() Apr. 26, 2018 07:45 AM EDT Reads: 4,165 |
By Pat Romanski ![]() Apr. 26, 2018 06:00 AM EDT Reads: 5,246 |
By Yeshim Deniz Apr. 26, 2018 05:45 AM EDT Reads: 366 |
By Elizabeth White ![]() Apr. 26, 2018 05:15 AM EDT Reads: 6,190 |
By Pat Romanski ![]() Apr. 26, 2018 05:00 AM EDT Reads: 4,448 |
By Elizabeth White ![]() Apr. 26, 2018 05:00 AM EDT Reads: 3,609 |
By Liz McMillan ![]() Apr. 26, 2018 05:00 AM EDT Reads: 6,297 |
By Yeshim Deniz Apr. 26, 2018 03:00 AM EDT Reads: 3,259 |
By Elizabeth White ![]() Apr. 26, 2018 02:45 AM EDT Reads: 7,081 |
By Pat Romanski ![]() Apr. 26, 2018 01:45 AM EDT Reads: 16,344 |
By Liz McMillan ![]() Apr. 26, 2018 01:15 AM EDT Reads: 5,117 |
By Elizabeth White ![]() Apr. 26, 2018 01:00 AM EDT Reads: 7,709 |
By Pat Romanski ![]() Apr. 25, 2018 11:45 PM EDT Reads: 2,066 |
By Elizabeth White Apr. 25, 2018 11:45 PM EDT Reads: 7,107 |
By Liz McMillan ![]() Apr. 25, 2018 11:00 PM EDT Reads: 3,762 |