WHITE PAPER: WEB-HOSTED ARCHIVES – HOW SECURE?

The scare stories

My company offers web-based document archiving solutions and I’m often confronted with the objection that the security is inferior to that of data held on in-house servers. This is a myth which not only unjustly dogs progress, but can lead to wrong and potentially disastrous decisions being made.

We hear, almost on a weekly basis, stories of confidential data being lost and security compromised. Consider all the well-publicised examples of security breaches from the last couple of years, the most notable is that of Gary McKinnon, still resisting extradition to the USA for hacking into the Pentagon computers, but there is a constant stream of reports of yet another a memory stick, CD or laptop, containing sensitive data, being lost or left in a public place.

Every one, without exception, has been a case of negligence involving or successful attack on the security of computer records held on in-house servers. Try, in vain, to find similar examples of breaches for web-based data. There are very good reasons for this.

Cloud Computing

This is the term applied to data and programs being held at indeterminate locations “somewhere in cyberspace”. and remotely accessed and executed.

People think of the web as being universally available to all and therefore a cloud computing application will allow universal access to data. This is not so. There are two cloud computing scenarios (well, in fact, three if you count various flavours of hybrid solutions as a third) – public and private. The first is well-publicised with public-domain data being accessed via freely accessed programs – the best-known examples being the likes of Google and Facebook. The second, however, is restricted to certain users or groups of users who, by application of various levels of identity verification depending on the sensitivity of the material, alone can access the programs and data.

Buying goods on-line is probably the most widely used example of this latter case, and despite many reservations in the early days, when does one ever hear of problems associated with the security of such transactions?

Hackers

Let us look at the biggest potential threat – hackers. If your networks are closed with no access to or from the internet, then you are perfectly safe, but these, if any still exist, are rare indeed. If somebody wants data contained on your servers badly enough, he or she will find a way to get to it – they know where you are physically and can easily enough work out a way in via your well publicised web site. No-one knows the physical location of your web-hosted archives. The very term “cloud computing” implies they could be in any one of millions of servers anywhere in the world. (In practice, we must assume not outside of the EU, otherwise they would not be covered by UK data protection legislation.) What is more, no-one is going to publicise either whereabouts or even URL of your archive site, so where does a hacker start?

The most vulnerable time for threats of this nature are when the data is in transit between the server and you. However, 128-bit encryption is a very simple low-cost remedy that ensures that anyone illicitly tracking data traffic picks up meaningless garbage.

Another thing to consider. Your systems may be protected by the best firewall technology money can buy, but the hacker’s technology also advances apace. Is it likely that your internal IT people are going to be on the ball all the time for something that is not your core business? Whereas for a large hosting organisation it IS their core business and they cannot afford a security breach which would totally destroy their credibility.

Another memory stick goes missing!

The next problem is staff who need to copy data from the server to pass to another party for entirely legitimate purposes. One way would be to send by email, but that is quite rightly rejected as unsecure and besides which, the attachments are often to big to send in this manner. So the favoured method is to copy onto a memory stick, CD/DVD or external hard drive and physically take it. Ninety nine times out of a hundred, this causes no problem, but the one hundredth is where the medium is left in a fleeting moment of mental lapse and is the one that makes the headlines. With a web-based system, it is easy to give temporary permission for people to see just the documents you want them to see and the data is never moved from the system.

So what of the disgruntled ex-employee, hell-bent on mischief? Well to protect in-house servers it would require a major network and firewall configuration each time an employee left to ensure security, whereas for your web archives, it’s just a matter of removing their permissions. If they have the foresight to copy data for nefarious purposes before they leave, then that is another problem and one equally affecting local and remote servers.

Conclusion

It is generally recognised in the IT industry that cloud computing is the future and the overwhelming economic advantage over expensive in-house installations is pushing it forward at an accelerating pace, despite security misgivings.

I’ll be the first to admit that with the best will in the world, the greatest vigilance, and the most advanced protection techniques, cloud computing security can never be absolutely 100% secure, but it is more so than most alternatives.

Location of voluminous archive data, which would otherwise consume server space and clog up networks, is a very obvious candidate and it is important to recognise that these misgivings are very largely misplaced. Failure to do so, not only denies an organisation the advantages, but lays it more open to the very attacks it fears.

This article was written by Bob Darby, Managing Director, Merlin DMS Ltd and further details may be obtained by contacting him at bob.darby@merlindoc.com or via the contact page on the company web site, http://www.merlindoc.com.