Unfortunately the Cloud doesn’t really change this, good password protocols are as important in the Cloud as they were in an on-premise world and potentially even more so.

In the Cloud security report we wrote for CloudU, we spent a bunch of time talking about what Cloud users can and should do to ensure they keep themselves safe, at least when it comes to passwords. It’s always worthwhile reminding people of stuff that, frankly, they should know about anyway – sometimes it’s the most obvious things….

So to that end, here’s our checklist for good approaches to password in the Cloud;

• Complexity – the more, the better. Combinations of letters, numbers, cases and special characters wins the day here 9and please don’t use “password” as your password!)
• Expiration – A fancy way of saying that you shouldn’t use the password you used for your first email address in high school when you’re 45. Passwords should be refreshed regularly (kind of like your underwear)
• Differentiation – The Lord of the Rings was all about One Ring to Rule Them All, passwords aren’t like this so please don’t use the same password on the 53 gazillion social sites you’re a member of
• Minimum requirements – A system that would allow me to chose the password “1” is just plain dumb. Administrators need to introduce minimum password requirements into their policies
• History – There’s nothing worse than users who have a revolving door policy to passwords, alternating between the two same passwords every time a change is required. Keep ‘em fresh is the best approach

Follow our guidelines and your cloudy (and non-cloudy) life will be a whole lot safer.

This series of posts are companion pieces to the CloudU series of educational material. We’d love you to join in some of our webinars or read the whitepapers the CloudU homepage is – here – and you can register to have updates sent to your inbox (in a non-spammy way of course!) there.

I often hear how Cloud is insecure from people who claim that unauthorized access is a real and significant risk for users of Cloud Computing. It always kind of frustrates me as, in my (admittedly somewhat biased) view, Cloud is as secure, if not more so, than traditional IT.

In our Cloud security whitepaper on CloudU, we spent a bunch of time talking about why Cloud Computing is in fact potentially significantly more secure than traditional models of IT delivery while at the same time pointing out the fact that there’s still stuff that organizations need to think about when using Cloud.

At the same time however we were totally realistic about the fact that there are still some things that end customers need to think about in terms of security. Sometimes the most useful thing for folks making a change is a simple checklist of things to think about and so, to that end, here’s our picks of things to think about when moving your organization to the Cloud;

• Firewalls – Customers still need to think about controlling the traffic in, and out, of their organization. Hardware and software firewalls ensure your traffic can bunch through, but the baddies are kept at bay
• Patches – You may be using lots of Cloud applications, but it’s still a safe bet that you have some desktop applications or, if not, at least some operating systems. These all need to have the latest versions of software running on them
• Backups – Unless everything you have is on the Cloud, you need to think about backing up your data, preferably off-site
• Controlling access to the Cloud – there’s no use being hyper secure if your employees leave mobile devices sitting around the place that people can access your sensitive data from. You need to think about policies and password protection for any device accessing your data
• Staff security – your biggest threat comes form within. Hire your staff well and make sure they don’t put you at risk, either maliciously or otherwise
• Passwords – the bane of our existence. Such an important area that we’ll come back to this one for more detail

Ensure these six points are dealt with, and you’re all set to enjoy a safe and rewarding Cloud experience.

We’re covering all things Cloud at CloudU, our Cloud Computing educational series. We’d love you to sign up to receive whitepapers and webinar invitations.

Cloud Computing, like marriage, is an example of a situation needing ongoing work from both parties to make for success. It was the over-arching theme of the CloudUreport we published recently which took a deep look at Cloud Security. In the report we reflected on the fact that, rather than the traditionally held view that by outsourcing IT, end users can forget about security, Cloud security is truly a two way street with both parties needing to bring something to the table.

There seems to be conflicting messages going on from vendors – the traditional vendors decrying the security issues raised by the Cloud, while the Cloud vendors seek to ignore the security issues that Cloud does indeed raise.

It was interesting then, given the conflicting messages, to read a blog post recently. In the post, Jon Oltsik tells of presenting at a Cloud conference in Washington DC and having the overwhelming feeling that Cloud security concerns are real, this despite the contrasting view of former Federal CIO Vivek Kundra who perceives that;

Oltsik reflects on recent research that suggests that 43% of respondents in one particular survey rated “data security and privacy concerns” as their top issue when it comes to Cloud Computing. This perception isn’t helped any by well-meaning, but ultimately unhelpful comments on the risks involved in Cloud Computing. A good example of this popped up recently with an emotive article titled “Cloud’s Shady Side”.

The article talked about a new initiative being discussed in new Zealand that would see a Cloud code of practice developed to help protect customers. In the article mention was made of the security risks of Cloud Computing, especially to small and mid sized businesses who might put “all the business data and personal information of clients in a Cloud without having good controls or knowing where it was”.

What the article fails to mention is the fact that the biggest security risk to small and mid sized businesses comes not from outside parties looking to steal or nefariously use their data, rather it comes from insidious risks such as;

• rogue employees looking to cause damage to the organization
• losses from the failure of poorly maintained systems

Yes, Cloud Computing, like any system that relies on more than information stored in one person’s memory, has security risks. But these risks are both manageable, and relatively low compared to the alternative. Cloud users need to understand what they need to do to keep themselves safe in the Cloud, but understanding and planning for the risks is different from putting Cloud in the “too hard” basket.

Cloud security is a two way street – both vendors and customers have a part to play in keeping it safe but, notwithstanding this fact, Cloud is still the best option for a number of SMB use cases.

This series of posts are companion pieces to the CloudU series of educational material. We’d love you to join in some of our webinars or read the whitepapers the CloudU homepage is – here – and you can register to have updates sent to your inbox (in a non-spammy way of course!) there.