Storage and Security: Five Things You Need to Understand update from April 2015

The cloud is vulnerable, but that doesn’t mean you should be. Know where your data is being stored, how it is being transferred and who owns the keys. For example, in a recent major cloud outage a simple SSL certificate was allowed to expire. This then created a global, cascading failure taking down numerous vital public cloud components. Who was the provider? Microsoft Azure. This kind of outage caused number of critical services including XBOX Live to go down; all because the certificate wasn’t renewed. Make sure to keep an eye on certs, and how data is moved between various cloud components. From a storage perspective, creating agility and multi-node storage arrays helps keep your data safer and more resilient.

Software-defined systems can help with security and agility. You’re beginning to abstract data into the logical control layer. This enables greater visibility and data controls. Plus, you can integrate some powerful DLP technologies directly into your data processing environment. Physical storage vendors need to see the writing in the wall and adapt quickly. Already some are introducing powerful, agnostic, logical storage layers capable of direct cloud and data center interconnectivity. Solutions from VMware and Atlantis already include HA, encryption, deduplication, replication, cloud API extensions and more.

Look at new ways to control compliance and data delivery. Fortunately, cloud and compliance have come a very long way. Akamai, Lockheed Martin, Microsoft, Amazon Web Services (AWS) and the U.S. Department of Agriculture are all are running government clouds. To be exact, they are FedRAMP Compliant cloud service providers (CSPs). Furthermore, if you examine the Amazon AWS complaince matrix you’ll quickly see that you can now run cloud-based workloads with PCI DSS, ISO, FedRAMP, and even DoD compliance standards. Here’s another example, Data Gravity recently created a unique unified storage platform which offers insights at the same richness of intelligence, regardless of whether the data is block or file. The software architecture lets IT teams, as well as security, compliance and line-of-business users unlock the value in their data by automatically analyzing information as it is ingested, without impacting production operations.

Never forget the physical aspects of data security. You might be rolling your eyes. But don’t skip this step. Some of the biggest healthcare breaches happened because a locker was left open and a physical disk was taken. Let me give you an anecdotal example. As reported in a recent article, Texas Health Harris Methodist Hospital Fort Worth has put up a notice on its website titled “Microfiche Incident.” That notice goes on to explain how on May 11 a portion of the microfiche meant to be destroyed by its paper-shredding vendor, Shred-it, was found in a park. What did that microfiche contain? Patient names, patient addresses, dates of birth, medical record numbers, clinical information, health insurance information and in some instances Social Security numbers. Now, you might not be trying to secure microfiche, but what about backup tapes? Recovery drives? Laptops with proprietary information which might currently be in a storage locker? Storage environments housing critical pieces of data must be locked down physically. If you’re bound by compliance or other regulations, make sure your cloud provider can abide by these regulations as well.

Your best security platform is only as good as how you architected it. Constant vigilance can’t be the only answer to the ultimate security question. Still, how do you stay ahead? In my experience, constant testing, good policies and architecture reviews are some of the best ways to find holes and problems before the bad guys. Ever-changing protocols, APIs, and other cloud-based elements mean that your storage environment must be agile as well.