Protect yourself in the Cloud

By: María Cecilia Hernández

Since the middle of this decade, the concept and practice of cloud computing has been gaining strength in all countries of the world and Latin Americans are no exception.

Although this topic has already been referred to in SECURITY SALES, with extensive introductions and explanations in previous editions, this time experts in the technological field will solve the great question that opens up when a company decides to adopt the modality of work in the Cloud: How safe is it to leave all the data of a company, your programs, your accounting and all your administration in an unspecified place, as abstract as a cloud, on a server in a remote country and in the custody of strange people and companies?

For those who are the first time they hear about Cloud Computing, it is enough to explain that it is a metaphor that refers to a place located in cyberspace from which you can have access to a set of products, services and computer solutions for consumers and companies, which are delivered and used in real time over the Internet.

A concrete example of this system is the email server, which we can access and from which we can operate, with prior Internet connection, from a browser, without having to download a specific file on our computer.

A company that provides this service, located anywhere in the world, is responsible for disposing of all the hardware and software necessary for this purpose, of storing, until the client so decides, all the personal data that he had provided, correspondence, attachments, among others; without any of them taking up hard disk space on the home or company computer.

Be careful
Like email servers, many other resources, software, desktop programs and solutions are provided through the Cloud.

According to Yolanda Ruiz Hervás, international director of communication at Panda Security, most of the services offered from La Nube have strict security measures that preserve information. "However, we must not forget that the very activity of making information travel carries its risks. To this we must add that the client company may not have a strict access and password management policy. Therefore, and although it is always important to have preventive security plans, additional measures must be taken if the company's strategy is based on this type of solutions."

For Juan Camilo Reyes, marketing manager of Etek International Colombia, adopting this modality of work through the Cloud has multiple advantages, among them: "Infrastructure tenure costs such as electricity, investments in hardware, network infrastructure, operating system licensing, server administration cost, etc. are minimized; the risk of long disaster recovery times is reduced, since the third party offering the service must have a business continuity infrastructure; economies of scale are accessible, as the provider with the same infrastructure serves many customers; the costs associated with the change of supplier are reduced."

Other aspects that reduce the value of this way of working are those cited by Juan Camilo Reyes: "In Latin America there are still no high bandwidths that allow the concept to be exploited in an adequate way and, in addition, it is possible that cloud computing does not generate the savings expected in companies that have many users".

Extreme measures
Companies that provide services in the Cloud have reported that they have been working hard to perfect the products and ensure security in them. According to Raúl Aguirre, director of Education of the Latin American Association of Professionals in Computer Security (Alapsi, A.C.)    , technology providers are competing strongly and day by day present various protection solutions, mainly against information theft.

"You cannot stop advancing out of fear, because the culture that does not adapt to technological changes is doomed to die. For example, an employer cannot stop working or exercising his functions just because he is outside his workplace, if you want to be competitive you have to be communicated wherever you are, through the Web and mobile equipment. The Cloud allows you to do this and enables greater responsiveness and decision-making, even in the distance," says Aguirre.

The expert adds that the evolution of technology itself makes life easier for criminals, but ensures that this cannot be a reason for companies to stop their growth. "We are on the way to a better offer, there are already very interesting solutions, what we are looking for is the balance of cost – benefit – opportunity," he emphasizes.

Cloud Protection
The new security solutions that are appearing in the technological scene have an advantage, these are programs that are also available in the Cloud. "Specifically, anti-malware security management solutions can be used at any time and from any web browser, easily and simply managing anti-malware protection and personal firewall," explains Yolanda Ruiz.

The first advantage offered by a security solution like this, compared to a traditional one, is that you do not need to make any investment in advance to implement it.

This is what Ruiz specifies: "Traditional protections require investments in hardware and software, introduce vulnerabilities where failures can occur and entail recurring maintenance and updating expenses. An anti-malware solution, on the other hand, hosts the entire management infrastructure in that of the company that offers the service."

Nowadays controlling and managing mobile or free-lance employees is a cause for concern for administrators. Through these types of cloud security solutions, the administrator can monitor and configure anti-malware protection and personal firewall remotely, regardless of their location or Internet connection. The same manager has visibility of everything that happens in his park and can manage it from a single point and quickly.

BOX
Some recommendations
Juan Camilo Reyes delivers for our readers a series of recommendations that should be taken into account when working in La Nube:

- The company that provides cloud services must have procedures that guarantee the security of the information.

- ISO/IEC 27001 certification is a guarantor of this situation, so it is a good idea to ask the third party to comply with this standard.

- Sign a confidentiality agreement that clearly specifies what the parties will do with each other's information in the event of termination of the contract.

- Make periodic audits of the continuity plans of the company that is hired.

- In all cases it is possible to encrypt the information shared with the third party.

- Security over the service delivery infrastructure is the third party's.

- The possible attacks that arise can be aimed at the theft of information in transit. The other attacks would be directed towards the third, so they must have the necessary infrastructure to stop them.

- As long as possible, powerful authentication systems should be required from the third party providing the service.