Given the increasing use of cloud-based services, it is important to analyze the measures that must be followed to ensure the integrity of the information; as well as learning to take advantage of the functionalities it offers for the implementation of better security systems.
by Alejandra García Vélez
Cloud applications are part of people's daily lives, they are increasingly accessible and popular. Therefore, it is not surprising that the field of security is one of the most benefited from the prospect of integrating these services with surveillance platforms.
Luis Pico, security engineer from Cisco Central America, the Caribbean and North South America, and Fernando Esteban, sales manager for Mexico, Central America and the Caribbean at Axis Communications, were the two experts invited to this edition of the magazine VENTAS DE SEGURIDAD to talk about the subject.
Alarms and surveillance in the cloud
Fernando Esteban was in charge of giving some light on the punctual use of cloud systems in the security industry. His first contribution was to explain that depending on the region of the world it is possible to speak of a greater or lesser penetration of these services.
In the case of the United States and Europe, they began to be implemented a couple of years ago, not necessarily for video, but especially for alarm monitoring. But, it would not be until 2011 when the issue of video hosting would begin to take hold.
In that sense, Esteban affirms that "the video in the cloud appears in 2011 as a real commercial scheme. Thanks to it we are reaching a market that was not reached before, now it is possible a transition to IP video in those circuits of less than 16 cameras that traditionally operated in an analogous way. "
The Axis official also added that cloud video storage is growing at a rapid pace. Proof of this is that his company ended last year with a little more than 35,000 video channels in the cloud in the United States.
"It is definitely a technology that is on the rise, from our position as manufacturers we see it as a market trend. The main reason for its increasing implementation is that in addition to providing greater security, it also lowers costs," says Esteban.
Among the most relevant factors to achieve this penetration of video in the cloud, are the improvement in access and price of bandwidth in the region, as well as the technological evolution that allows greater video compression without losing quality.
Similarly, Esteban says that for end users the advantages are several. Among them, it explains that it reduces the risk of data corruption or loss of information by not having the information in a local DVR susceptible to being damaged, deleted, or modified.
Secondly, it mentions remote access, the ability to view video from anywhere as a very useful feature. And, of course, the economic aspect, since with this type of services it is common that the initial investment of buying the system from scratch is not necessary, but that companies already manage leasing models for the hosting service.
Finally, given the concern for the integrity of the images and data transmitted, the official affirms that the protection mechanisms in both transmission and storage are superior to that of analog video.
"In analog video with simply intercepting a cable you can see and even replace the video, while in the cloud you have various protection systems, such as encryption or the use of security keys, which in my opinion are much more secure tools than having a physical DVR in a house or business."
Data control
Although the usefulness that cloud services can have to complement ip video surveillance installations almost perfectly is undeniable, it is also noteworthy their use in other fields and industries for information storage.
Precisely, when delving into the topic of data storage it is important to emphasize information security. In that sense, security services for email and for an organization's web traffic are increasingly used.
Virtual Remote Desktops are also available and gaining popularity, which, explains Pico "allow medium and large companies to reduce TCO (Total Cost of Ownership) by unifying employee services in a virtual environment that allows to considerably simplify the deployments, scalability, control and management of the ICT infrastructure".
There is no denying the advantages that it brings for an organization to bet on these systems, in the first instance because they allow to face in a simpler way the challenges in terms of scalability of applications and servers, also provide connectivity to users who need remote access, at any time and from any device.
In addition to the above, they allow to reduce the maintenance of infrastructure, make easier migrations to new versions of operating systems and generate greater control over the state of presentation of information.
Nor should we forget the importance of implementing protection measures for cloud systems. Pico explains that normally the information is guarded locally by organizations, with technical means of protection that allow to have control over the information repositories of the company, for that access controls are established to the communications infrastructure and access to physical spaces, but now, as the information is taken out of the company and taken to the cloud, there are different challenges.
"Companies must apply these initiatives according to a risk analysis and assessment. As we know, the information of companies is one of the most valuable assets, and when storing and taking information to the cloud, you must have full control of the risks associated with these services, guaranteeing the adequate implementation of measures that allow drastically reducing the probability of a security incident", Says.
Pico also points out that some of the most relevant risks for this type of service are the loss of confidentiality of the information, its integrity and the breach of government regulations. Faced with the last point, he points out that the above is especially sensitive when information is stored on servers located in countries with regulations different from those of the company's host country.
Faced with the above, it is important to point out some useful strategies to ensure the security of data and information hosted in the cloud. The best strategy, says Pico, is an adequate analysis and evaluation of risk, which will allow choosing the best control measures available in the market.
In addition, it emphasizes that contracts, service level agreements and operational service agreements must allow any incident that may arise to be remedied. In the same way, evaluate the capabilities of the company that offers these services, to guarantee an adequate management and control of the data by it.
Finally, it emphasizes that technology must be addressed in three key perimeters; first in the end-user environment. In this sense, it must be guaranteed that the user who connects to the cloud, regardless of the device they use, complies with the security requirements of the company.
Secondly, attention should be paid to the access scheme; that is, define the form of communication to the cloud, for example with the choice of a VPN system (Virtual Private Network) based on the most secure encryption protocols that are currently on the market, such as IPSEC/AES-256/IKEV2, Suite B and TLS among others.
Additionally, take into account application acceleration solutions with an emphasis on traffic from the user to the cloud in order to improve the response speed of all this flow of information.
And finally the virtualized environment, which can be segmented with the use of firewalls, also apply consistent access rules, generate inspection controls for the traffic that reaches the cloud, in order to detect anomalies in the flow of data and anticipate the detection of problems in the performance of applications, guaranteeing the availability of services.
