Defining Data Security in 2015 and Beyond

Transcription

1 Defining Data Security in 2015 and Beyond What you need to know about physical and virtual data security in a complex business environment Colocation Managed Cloud & Hosting Services Business Continuity

2 Is Your Data Secure? It s a seemingly simple question with a complicated answer. One need only refer to the devastating Sony hack for corroboration of this fact. As an increasing number of companies adopt cloud-based solutions amidst growing concerns about data security, ensuring your company has a multi-faceted data protection plan and process in place is paramount to business success. Accordingly, research shows that companies are increasing their investment in data security. Gartner predicts that global IT security spending will increase to $76.9 billion in 2015, an additional 8.2 percent increase beyond the 7.9 percent jump it projected for Whether your company is in the finance, healthcare, law or technology vertical, you have a moral and fiscal obligation to keep your clients sensitive personal information secure. It also goes without saying that you don t want your own data compromised or the company s financials and trade secrets divulged. The Global State of Information Security Survey 2015, conducted by PricewaterhouseCoopers, deems cybersecurity a persistent business risk, noting nearly half of survey respondents indicated the perception of cybercrime risk has risen within their organization during the past year. These heightened levels of sensitivity and concern about data security come on the heels of last year s rash of major data breaches. While data security is a business, it isn t everyone s business. Keeping data secure is a complex, multi-layered process and a full-time job. It s about more than the here and now it s about anticipating future business needs and being able to scale solutions to meet those needs. It also requires a strategic blend of online and offline security measures think data centers and digital monitoring. As more companies make data security a primary focus, it is key to remember that developing an effective data security plan addresses more than where data is stored. It also includes clear guidelines for how it is managed and monitored.?

3 Planning for When Not What if When disaster strikes, recovery is often a slow process. As the East Coast saw first-hand with Superstorm Sandy, when disaster strikes recovery is often a slow process. Whether you experience a power outage, are physically barred from entering your place of business, or simply lose your connection to your servers, the impact can include lost time and lost data both of which negatively impact your bottom line. For businesses today, security is about more than making sure data is protected and remains accessible when natural disaster strikes. It s about making sure that data is also secured against man-made threats, including software failure, hardware failure, electrical outages, employee security breaches and cyberattacks. Regardless of the nature of any interruption, companies need to know that they can maintain near-100 percent uptime, keep clients satisfied and data and applications safe. This requires an integrated and proactive approach to data security that is aligned with the company s overall business plan. With the help of trained data security professionals and third-party providers, companies can conduct risk assessments to understand the most likely and significant security threats facing them. They can also work to build new, or update existing, business continuity plans, ensuring that the staff is well-versed in how operations will shift should a data breach or natural disaster occur. It is important to note that business continuity plans, including disaster recovery strategies, should be updated and tested on-site and off-site at least once every year. Remember, as businesses grow and evolve so do their data security needs. For example, if the executive who formerly led your disaster response team has since left the company, the time to discover that he or she is still designated as the disaster recovery plan implementation leader is not when the disruption happens.

4 Physical Data Security Third-party data centers offer scalable solutions with a laser focus on efficiency, cost and performance. This allows C-suite executives and internal technology teams to maintain peace of mind that their data remains secure, allowing them to focus on business as usual. Thinking of Moving Off-Site? If you re transitioning from on-site data storage to an off-premise environment with a data center provider, you ll want to obtain answers to the following questions before making the move: What specific services are and are not included in the proposed data center contract? How will the interaction between servers and other components of the data environment change now that data is stored off-site? Securing the facility in which your data and networks are housed begins with basic requirements. So what does physical data center security entail? For starters, a comprehensive approach to keeping your applications and networks safe in a facility offering the right levels of redundant power, cooling, backup, security and accessibility. An informed decision will deliver the best results. Knowing what to look for in a data center provider and matching its security posture with your company s will best mitigate your risk and offer you the highest level of protection. Many provider-operated data centers do not post the addresses of their facilities on the company website, nor will they have signage on the building itself. They implement strict layered security measures that permit or deny building access. Once inside, visitors likely will need to be granted additional access rights to move about the building. In fact, some areas will remain off limits. Security cameras should be strategically located around the building s perimeter and throughout the site, with bonded security personnel actively monitoring the footage captured on those cameras. Whether storing data in an on-site or off-site data center, uninterruptable power and cooling, onsite monitoring of the facility and redundant connectivity are critical, 24x365. In short, the procedures data centers take to protect a company s sensitive business data are extensive. Tasked with protecting one of a business most important assets data IT infrastructure and managed service providers understand that data access and security are mission-critical for businesses. That is why resiliency and redundancy are top priorities. Their teams of highly-trained professionals use robust technology to protect and monitor clients networks. Additionally, these data security experts are well-versed in the latest intrusion detection tools that protect data and applications. Compliance is another integral component of physical security. Regardless of whether you are using a third-party data center or have opted to build your own, complying with current standards and regulations is critical. At a minimum, one must remain SSAE 16 and PCI-compliant, as well as U.S.-EU Safe Harbor certified. This reflects not only a commitment to the tightest data security, but to helping businesses achieve a higher level of resilience. Who will be handling the data backup and monitoring? Is the facility fully redundant (power, cooling and connectivity)? Is there staff available on-site and around-the-clock to provide support? Is IT the provider s core competency, their only business?

5 Securing all POEs to Your Network Staying one step ahead of cyber attackers and securing a network infrastructure is an ongoing challenge. Companies need to pay special attention to publicly available methods of access to their network. Years ago this simply meant securing the perimeter of the network; now, however, with new BYOD deployments and widely accepted outsourced, cloud, and access-anywhere technologies, companies need to be even more diligent in making sure that all points of entry into their network are correctly secured. Logical Data Security Third-party data centers offer scalable solutions with a laser focus on efficiency, cost and performance. Looking at the current news it s clear that a great deal of threats are still coming from the outside and attacking the perimeter of the network. Most of these attacks exploit a software limitation or another known bug. While the external attacks certainly cause a lot of headaches and carry their fair share of problems, internal-based attacks, which have been responsible for the most recent data leaks, are becoming even more alarming. Based on the information that has been leaked in the most recent from the inside attacks, it is clear that companies are reacting by securing their networks from the outside in rather than from the inside out. It is important to remember that not everyone on your network can, or should, be trusted. You certainly wouldn t let an employee from your engineering department rifle through the accounting department s filing cabinets, nor would you let a visitor have unrestricted access to any office in your corporate headquarters without constant supervision. If these physical separations and safeguards are so important, why is it that companies often allow access to their network without so much as a second thought? Simply put, the latter is not viewed as being a risk. Setting up your employee and guest networks, and your vendor access, needs to be a carefully thought out and well-planned process. It s important to set up the necessary segmentation between working groups and outside groups, and to put checkpoints, logging, and controls in place wherever the different segments are forced to intersect. Define from a business level exactly who needs access to what internal and external resources, document it, and put the necessary controls into place at the network level. As time goes on, be willing to constantly reevaluate this framework and make adjustments to accommodate changes. Being able to leverage products that allow you to see anomalies in inbound and outbound traffic flow are important, being able to block any irregularities goes even further in protecting your network. Designing and a building out an infrastructure that allows for this level of oversight is key for securing nextgeneration, always-available networks. In 2013, the International Data Corporation (IDC) reported that spending on public cloud computing would increase at a compound annual rate of 23.5 percent between 2013 and Yet, for many businesses, the decision about whether or not to move data to the cloud continues to present security concerns. This requires businesses to plan for and implement comprehensive measures to protect data against potential cloud-based security threats. Working with their trusted partners, companies can best determine which cloud environment, public, private or hybrid, is right for them. Data center providers have the most comprehensive and thorough online data monitoring tools to keep data secure. Given the gravity and breadth of the threats, whether in a private or hybrid cloud environment, these same partners constantly refine their threat detection process. Security devices may be found in many of today s data centers as well as in their clients physical office spaces, providing data security wherever there are assets to protect. Regardless of the configuration, reporting is shared between the two to deliver optimal data security and monitoring. On-premises environments are still more likely to be attacked than cloud environments, but there has been a consistent increase in cloud attacks as well. As cloud adoption continues to accelerate, brute force attacks which increased in on-premises environments as well have surged among cloud hosting providers, likely due to the increasing presence of theft-worthy data in the cloud. AlertLogic Alert Logic s 2014 Cloud Security report revealed that cloud hosting provider environments experienced significant increases in security attacks from April 1, 2013-Sept. 30, While brute force attacks increased 14 percent, vulnerability scans increased 17 percent. Malware and botnet attacks were also on the rise.

6 One often overlooked component of logical data security is the impact of employees who use personal devices for business. While many companies have bring-your-own-device (BYOD) policies, security patches and policies frequently exclude these devices. It is important to work with your outsourced IT team to enhance your BYOD policy to ensure compliance with other virtual data protection policies and procedures. Data security is a complex process. Building it correctly demands constant focus on reliability and resiliency. Protecting data requires collaboration between internal IT staff and third-party providers to design, implement, and build efficient solutions that deliver the highest levels of data protection and ROI. Whether outsourcing your data storage to an IT infrastructure and managed services provider for the first time or revamping your company s virtual security policies and procedures, it s imperative to plan for the worst and hope for the best. With cyberattacks on the rise, businesses face the unenviable task of not only protecting their current data, but also developing or obtaining a heightened security posture that is well-suited to handle the increased level of cyberattacks anticipated in Regardless of your industry or current data protection configuration, you need to find creative, costeffective long-term security solutions. About Cervalis Cervalis offers a comprehensive suite of IT infrastructure solutions including managed services, business continuity and disaster recovery, colocation and cloud computing in an enterprise-class environment. The company s skilled professionals, world-class facilities and outstanding customer support provide clients with a secure IT environment that ensures business resilience. Cervalis state-of-the-art and fault-tolerant operations and recovery centers total more than 500,000-squarefeet of space. The company offers worldclass customer support with the technology needed to scale complex environments reliably and cost effectively. Cervalis is compliant with SSAE 16 Type 2 and PCI, as well as U.S.-EU Safe Harbor certified. To learn more about the Cervalis advantage and the company s data centers, please visit or call toll-free to schedule a tour. Colocation Managed Cloud & Hosting Services Business Continuity Copyright 2015 Cervalis LLC. All Rights Reserved.