How secure is your critical data in the cloud?

The good news is that vendors are putting standards in place to govern the security of data in each phase: the virtual or transport phase, the physical storage, and user access via a Web interface. This assists organisations with compliance and reduces the complexity thereof.

Backing data up to the cloud makes use of many of the policies applied in traditional tape- and disk-based backup solutions. Both use backup management software to prioritise and schedule backups, and both ensure offsite storage of data to protect organisations against disaster. Cloud backup offers a few other advantages. It removes the need to manage physical hardware by automating the process and is generally highly efficient. However, given the vulnerability of data in the digital realm, is it as safe? Scrutinising the process provides some assurance.

Data security in the cloud - in transit, in storage

Storing data in the cloud usually starts with the provider collecting an initial data 'ingestion' on disk, and storing it in a vault. From here on, backups are iterative. Furthermore, some suppliers provide a server device at the client's premises establishes a secure tunnel along which data is transported. An 'agent' on the device should use unique codes to connect to a vault in the cloud via proprietary ports owned by the cloud backup service provider. Once data is backed up in a vault (the physical vault could be local or international), the vault itself should be backed up, with a secure mirror copy of the vault stored in another location which excludes any single point of failure.

Data security is taken very seriously by vendors and providers. To ensure data is safe, only outbound connections (from the company to the vault) are established by the server. Each time a connection is made between the vault and the agent software, public key encryption is used for mutual authentication, authenticating the agent to the electronic vault, and the vault to the agent.

In addition, data should be encrypted during transmission and remain encrypted while stored. The level of encryption required is the 256-bit Advanced Encryption Standard (AES) - the current gold standard for encryption. As the customer holds the encryption keys, the data cannot be accessed by the service provider or anyone else. Furthermore, industry-standard Secure Sockets Layer (SSL), offered by some vendors, is used for communication between the software agent and the vault, ensuring any modification of data can be identified, therefore preserving the integrity and confidentiality of the data.

These measures implemented by best-of-breed vendors ensure the integrity of data transport and storage, but how secure is the Web interface used by the organisation to schedule backups and access stored data? A number of safeguards should be in place here too.

Cloud backup solutions - Web user interface security

For storage in the cloud, one of the benefits is that users can access data from anywhere using a Web browser. The challenge is to prevent insider attacks via this interface and to prevent damage being done by unauthorised users with stolen passwords. This is achieved by a number of means:

• Communication between the user and the agent software being encrypted using SSL,
  
• The contents of backed up data files not being accessible via this interface with backed up data only being restored to the computer it originated from,
  
• Backup policies and passwords not being set via the user interface, and
  
• Limited authority being granted to users of this interface.

With security applied to virtual access to data, a final question remains: what of the physical security of data stored in the vaults of the solution provider. Besides duplication of vaults in different locations, standard physical security safeguards are put in place by some vendors at reputable data centres.

Physical security of data backups 'in the cloud'

In terms of the physical security of data, there are clear standards in place at data centres. These requirements cover the security of the facility, as well as its contents. They include 24x7 security guards, as well as 24x7 internal and external environmental monitoring alarms. Where credit card data is stored, compliance with the Payment Card Industry Data Security Standard (PCI DSS) and the ISO 27001:2013 information security standard is mandatory.

In selecting a provider of cloud backup services it is particularly important to request proof of compliance best practice data centre standards, as well as PCI DSS compliance if customers' credit card details are stored. Failure to meet these requirements could result in unpleasant fines for the both the provider and the owner of the data being stored.

The future of cloud backup

The benefits of using cloud storage in combination with, or to replace traditional tape and disk storage strategies can be significant for SME's. However, organisational needs and environments, as well as existing investments, will dictate strategies. What is certain is that the uptake of cloud storage will continue to grow as organisations realise its value and become more aware of the security surrounding this solution. In addition, many SME's will be attracted to the opex nature of SaaS expenditure compared to the capex plus opex costs of alternatives such as tape backups.

If you are ready to take the first steps toward cloud storage, the most important questions to ask are:

• Does the service provider make use of proven, intelligent software that offers suitable levels of security?
  
• Are the data centres where the data is to be stored suitably protected?
  
• Can the service provider prove compliance with industry standards?

If the answers to all three questions are 'yes', ask three more:

• Does the solution on offer make use of proven technology; is the brand reputable?
  
• Is the service provider skilled and knowledgeable?
  
• Does the service provider have a good track record?

You want peace of mind that your data is protected, compliant and secure. These questions will put the right foundations in place.