Other things that definitely help raise the bar are: controlling access to files inside the company and across to clients, keeping logs of who has accessed what and making sure the data record is immutable so that you can reverse any changes if struck by ramsonware virus (i.e. CryptoLocker). I’m happy to put you in touch with customers that can give you first hand experiences with some these vulnerabilities.
NoteVault
From Peter Lasensky, CEO:
NoteVault is using Amazon Web Services because Amazon is far more secure than what a company can build themselves. Security is so complicated these days that it is better to utilize a team of experts like only a company the size of Amazon could put together to secure data.
Security is about more than password protection. As we saw with the Sony breach, it only took a user name and password to bring them to their knees.
Companies need an IT network that has intelligent monitoring. Amazon, for example, tracks downloads because they get paid for it. Alerts on unusual activity can set off automatic alarms that could help companies “nip the problem in the bud” with early detection of a breech.
Panzura:
From Andy Knauf, vice president of IT at customer, Mead & Hunt:
“I feel the best way to protect your company's assets from cyber attack is always knowing who has access to your system.
More times than not the attack comes from internal, and not keeping your internal records current could cause harm to your system. It's safe to say, most of us use the best firewalls we can find and try and education our users by making them use strong passwords to keep our systems protected. But what happens when you do everything right and somehow your system is still compromised? Your backup is your only savior when your system is compromised, and that is only as good as the system you use to back up your data.
We decided more than a year ago to trust all our data to Amazon AWS ,which is encrypted to everyone other than our company but can be recovered by them because they have access to the physical media.
We also placed Panzura controllers in all our offices because files are secured at rest and in transit. Panzura is only company that is using FIPS 140-2 compliance and stores unique blocks, and the data is obfuscated. Because your data is on Amazon and you're using Panzura you are protected not only from an internal attack but external as well.”
Sage Construction and Real Estate
From Jon Witty, vice president and general manager:
Security is especially important as more and more construction firms are using mobile devices and applications to exchange information between the field and back-office financial and operations systems. Software vendors must provide these remote capabilities with built-in security. Data security safeguards that should be a part of every cloud-based application architecture include:
—Development on a reliable application hosting platform (Microsoft Azure as a leading example) that assures the highest levels of data integrity, availability, and confidentiality.
—Regular third-party audits. We use Comsec, a global information security consulting firm.
—Encryption for any data that flows from mobile applications to back-off systems.
