The cloud \u2013 solution of the XXI century<\/strong><\/h2>\nCloud is a\u00a0modern IT environment that answers the need for flexible business support. It provides a\u00a0configurable resource shared with various entities in\u00a0order to\u00a0launch IT business solutions dedicated to\u00a0them, separated from other cloud users. Cloud services may be\u00a0delivered using different models, the most popular ones include: IaaS<\/strong>: Infrastructure as\u00a0a\u00a0service, PaaS<\/strong>: Platform as\u00a0a\u00a0service, SaaS<\/strong>: Software as\u00a0service, the remaining two, less popular, are: MBaaS<\/strong>: Mobile “backend” as\u00a0a\u00a0service\u00a0 and FaaS<\/strong>: Function as\u00a0a\u00a0service.<\/p>\nNowadays, the cloud has been commonly identified with public solutions where many companies share the resource with access via the Internet, and this solution shall be\u00a0discussed in\u00a0the further part of the article. However, it should be\u00a0kept in\u00a0mind that there are also private hybrid solutions.<\/p>\n
Year by\u00a0year, more Polish companies decide to\u00a0use various options for cloud services. What convinces them to\u00a0do\u00a0it are, most of all, no\u00a0need for investing in\u00a0their own infrastructure, easy scalability and flexible use. The price of cloud services is rarely an obstacle in\u00a0making the decision to\u00a0switch into them.<\/p>\n
The main problem and barrier for the unconvinced is the concern about security, especially about data loss or\u00a0leakage. Ironically, especially in\u00a0the case of small and medium-sized companies, migration to\u00a0cloud may be\u00a0safer than the solutions installed in\u00a0local server rooms.<\/strong><\/p>\nThe concerns are much exaggerated<\/strong><\/h2>\nA good cloud is, among all, a\u00a0location secured against unauthorized access, 24h infrastructure monitoring, protection against DDoS attacks, environment updates, backups, a\u00a0team of qualified specialists, etc.<\/p>\n
Nevertheless, we\u00a0need to\u00a0remember that transition to\u00a0the cloud does not mean moving the responsibility for the security of the provider.<\/strong><\/p>\nUsing cloud does not relieve us from this responsibility but allows to\u00a0move part of the tasks concerning security onto the provider. It is crucial to\u00a0be\u00a0fully aware of the provider\u2019s obligations and to\u00a0ensure completing the remaining tasks. This allows to\u00a0avoid the so-called grey area which nobody cares about, and this makes it the weakest link and first thing to\u00a0threat the security.<\/p>\n
Devil is in\u00a0the detail<\/strong><\/h2>\nTask division depends on\u00a0the type of services we\u00a0use. The below-presented figure presents the standard share of responsibilities, as\u00a0for used services: \u00a0<\/em><\/p>\n![\"cloud](\"https:\/\/soflab.pl\/wp-content\/uploads\/2019\/05\/cloud_01-1.png\")
<\/p>\n
Based on\u00a0ENISA materials<\/em><\/p>\nWhen we\u00a0move the server contents to\u00a0the cloud from a\u00a0service room (IaaS service), the provider is the party responsible for physical security, power, air conditioning or\u00a0network. Still, the responsibility for security of many components comprising our solution, such as\u00a0for instance operating the system, database, application, data or\u00a0access to\u00a0the solution is on\u00a0our side. If we\u00a0decide to\u00a0use CRM as\u00a0SaaS service instead of moving it into the cloud, our liability limits to\u00a0managing the access to\u00a0the application. With the decrease in\u00a0our responsibility, the number of tasks we\u00a0gave away to\u00a0the provider increases, as\u00a0illustrated below:<\/p>\n
![\"cloud](\"https:\/\/soflab.pl\/wp-content\/uploads\/2019\/05\/cloud-02.png\")
<\/p>\n
Based on\u00a0ENISA materials<\/em><\/p>\nIn every case, no\u00a0matter which services are in\u00a0question or\u00a0what is the task division, security involves availability assurance, data confidentiality, and integrity<\/strong>, where:<\/p>\n\n- availability<\/strong> \u2013 stands for the possibility to\u00a0use company resources on\u00a0the basis of rules preserving the continuity of operation;<\/li>\n
- confidentiality<\/strong> \u2013 preventing access by\u00a0unauthorized individuals or\u00a0systems;<\/li>\n
- integrity <\/strong>\u2013 certainty that the data was not unlawfully altered.<\/li>\n<\/ul>\n
If you need a\u00a0security audit, contact our expert.<\/a><\/h3>\nMake a\u00a0conscious choice<\/strong><\/h2>\nBefore you make the decision to\u00a0use the cloud:<\/p>\n
\n- Analyze the current situation of the company, type of processed data, check whether there are any limitations (e.g. resulting from RODO).<\/strong>
Consider whether you want to\u00a0move the entire IT environment or\u00a0to\u00a0use hybrid solutions (to\u00a0move only part of the resources). Also, it is good to\u00a0identify the people with access to\u00a0the resources, verify their personal data and current privileges. Many companies make necessary authorizations but hardly ever makes sure the workers still have them even after they are no\u00a0longer needed. Minimum and only necessary authorization is one of the key issues in\u00a0security.<\/li>\n- Determine which services (IaaS, PaaS, SaaS) you need.<\/strong> What needs to\u00a0be\u00a0developed from scratch and what can be\u00a0replaced, e.g. with SaaS services (CRM system, circulation of documents, etc.);<\/li>\n
- Plan security mechanisms,<\/strong> including:\n
\n- the above-mentioned rule for minimum and necessary privileges;<\/li>\n
- work based on\u00a0roles, e.g. to\u00a0avoid the common practice of connecting user\u2019s and administrator\u2019s privileges on\u00a0a\u00a0single account;<\/li>\n
- MFA (Multi-factor authentication ) implementation, functionality that forces the user to\u00a0provide extra identity authentication, apart form login and password. It may be, for instance, using an extra USB key, or\u00a0retyping the code sent to\u00a0the user\u2019s mobile phone.<\/li>\n<\/ul>\n<\/li>\n<\/ol>\n
All these mechanisms are well-known and commonly used within an on-premises infrastructure where it is often possible to\u00a0access the resources only within the network. Therefore, it is even more important to\u00a0remember about them in\u00a0terms of cloud solutions where access is possible everywhere via Internet connection.<\/p>\n
Along with the reduction of wide access to\u00a0the services it is worth implementing other mechanisms such as\u00a0allowed devises, locations or\u00a0login time, and many more.<\/p>\n
Moreover:<\/p>\n
\n- Make sure the data is properly secured when at\u00a0rest. Most service providers store data in\u00a0a\u00a0disturbing form, encrypted using their own keys. If it is too little, check if you can use your own keys (it requires further management), or\u00a0put the highly sensitive data already encrypted in\u00a0the cloud.<\/li>\n
- Data sent between the users, business partners should be\u00a0transferred as\u00a0encrypted files, via e-mail or\u00a0dedicated links which requires identity authentication.<\/li>\n<\/ul>\n
\n- Determine how many and which cloud services you need<\/strong> and provide a\u00a0list of service providers that are able to\u00a0provide them.<\/strong><\/li>\n
- Choose the provider<\/strong>, check at\u00a0least:\n
\n- Does he\u00a0support solution development and migration?<\/li>\n
- How can you increase or\u00a0decrease your need for resources? What is the change duration tame?<\/li>\n
- Where will your data be\u00a0stored? It is especially important in\u00a0terms of RODO. Sometimes, depending on\u00a0the services, one provider stores data in\u00a0various locations, also outside the EU.<\/li>\n
- How does the provider care about security? Does he\u00a0have a\u00a0security policy, allow for internal audits, present reports drafted by\u00a0independent auditors? Does he\u00a0have security certificates issued by\u00a0independent organizations such as\u00a0ISO\/IEC 27017?<\/li>\n
- Does the provider allow to\u00a0monitor the used services? On\u00a0what level?<\/li>\n
- Is there a\u00a0notification process for users informing them about failures and scheduled works? If and how you can influence the time of scheduled works?<\/li>\n
- How can you report problems and whether the operator guarantees the time of taking the notification and solving the problem (SLA)?<\/li>\n
- How often and how is backup made? What does the process of restoring the data look like? When dealing with highly sensitive or\u00a0significant in\u00a0terms of business data it is good to\u00a0verify if there is a\u00a0possibility to\u00a0export it to\u00a0an external system, e.g. at\u00a0another could provider.<\/li>\n
- Sometimes it is necessary to\u00a0resign from the used cloud. It may happen due to\u00a0various reasons, such as\u00a0provider\u2019s downfall, lack of newly required functionalities, or\u00a0prices inadequate to\u00a0the market level. Such a\u00a0situation requires checking whether the provider offers data access via standardized interfaces, stored in\u00a0known formats. Alternatively, if he\u00a0ensures tools allowing data conversion. The lack of such mechanisms may lead to\u00a0Vendor Locking which prolongs the time and increases the effort and cost of the solution which surpasses the benefits.<\/li>\n<\/ul>\n<\/li>\n
- Think if your organization has enough competence to\u00a0choose the best services<\/strong> for your needs, plan the architecture and conduct migration, and then to\u00a0provide maintenance. If not, employ specialists or\u00a0provide your workers engaged in\u00a0the project with appropriate training, or\u00a0find a\u00a0reliable and experienced partner.<\/li>\n
- Plan migration.<\/strong> In\u00a0what order and what should be\u00a0moved? Start with less critical resources form the business point of view.<\/li>\n
- Prepare internal communication in\u00a0the company.<\/strong> Projects concerning migrating data to\u00a0the cloud very often set not only technological or\u00a0operational challenges but also require facing the lack of acceptation or\u00a0negation from prospective recipients. This is a\u00a0natural reacting for changes. In\u00a0order to\u00a0mitigate the resulting risks, you should:\n
\n- Prepare a\u00a0detailed communication plan involving all people and collecting feedback. It will allow for a\u00a0fast reaction when problems occur, to\u00a0adjust actions to\u00a0the current situation, plus, it will increase the engagement and co-responsibility for the project among the workers.<\/li>\n
- Prepare and pass knowledge about new solutions for future users and administrators.<\/li>\n
- Plan the support for users after solution launching.<\/li>\n<\/ul>\n<\/li>\n
- If your users intend to\u00a0work in\u00a0a\u00a0crowded space, make sure the Internet connection is fast enough.<\/strong> After data migration, the slow connection often becomes a\u00a0bottleneck.<\/li>\n
- Evaluate risks.<\/strong> Moving into the cloud environment may cause extra risks, new for the own infrastructure. It is required to\u00a0conduct an analysis of the new threats, classify them in\u00a0terms of occurrence probability and their influence on\u00a0business activity. Next, you need to\u00a0plan and implement mechanisms that will allow to\u00a0monitor them. It is good to\u00a0get acquainted with the provider\u2019s offer who very often provides necessary tools.<\/li>\n
- Update or\u00a0create a\u00a0security policy and make sure that users know it and understand it.<\/strong><\/li>\n<\/ol>\n
No\u00a0more or\u00a0no\u00a0less?<\/strong><\/h2>\nA defined aim, a\u00a0good plan, a\u00a0set division of duties, proper execution, and we\u00a0are safe in\u00a0the cloud. It seems like a\u00a0perfect time to\u00a0relax. Not at\u00a0all. Security is not a\u00a0state that can be\u00a0reached once and forever. It is a\u00a0constant process: following the changes everywhere around, monitoring threats, preparing to\u00a0prevent them, verifying security efficiency, fixing vulnerabilities and continuing to\u00a0follow the changes. It is a\u00a0never-ending work, no\u00a0matter if we\u00a0use our own resources of the cloud.<\/p>\n
More about our offer of audits and security testing. \u00a0<\/a><\/h3>\n <\/p>\n
Written by\u00a0Marcin Szyd\u0142owski, CITO, Soflab Technology Sp. z\u00a0o.o.<\/em><\/p>\n <\/p>\n
Fotografia\u00a0Philipp Birmes\u00a0\/ Pexels<\/p>\n
[\/et_pb_text][\/et_pb_column][\/et_pb_row][\/et_pb_section]<\/p>\n","protected":false},"excerpt":{"rendered":"
Although the cloud is becoming more and more popular in\u00a0Poland, moving into it is still quite a\u00a0challenge for many Polish entrepreneurs. The following guidebook is for those who still hesitate or\u00a0wonder if it is worth doing, or\u00a0have no\u00a0idea how to\u00a0prepare for it. The cloud \u2013 solution of the XXI century Cloud is a\u00a0modern IT environment […]<\/p>\n","protected":false},"author":23,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_et_pb_use_builder":"on","_et_pb_old_content":"
Although the cloud is becoming more and more popular in Poland, moving into it is still quite a challenge for many Polish entrepreneurs. The following guidebook is for those who still hesitate or wonder if it is worth doing, or have no idea how to prepare for it.<\/h2>\nThe cloud \u2013 solution of the XXI century<\/strong><\/h2>\nCloud is a modern IT environment that answers the need for flexible business support. It provides a configurable resource shared with various entities in order to launch IT business solutions dedicated to them, separated from other cloud users. Cloud services may be delivered using different models, the most popular ones include: IaaS<\/strong>: Infrastructure as a service, PaaS<\/strong>: Platform as a service, SaaS<\/strong>: Software as service, the remaining two, less popular, are: MBaaS<\/strong>: Mobile \"backend\" as a service and FaaS<\/strong>: Function as a service.\n\nNowadays, the cloud has been commonly identified with public solutions where many companies share the resource with access via the Internet, and this solution shall be discussed in the further part of the article. However, it should be kept in mind that there are also private hybrid solutions.\n\nYear by year, more Polish companies decide to use various options for cloud services. What convinces them to do it are, most of all, no need for investing in their own infrastructure, easy scalability and flexible use. The price of cloud services is rarely an obstacle in making the decision to switch into them.\n\nThe main problem and barrier for the unconvinced is the concern about security, especially about data loss or leakage. Ironically, especially in the case of small and medium-sized companies, migration to cloud may be safer than the solutions installed in local server rooms.<\/strong>\nThe concerns are much exaggerated<\/strong><\/h2>\nA good cloud is, among all, a location secured against unauthorized access, 24h infrastructure monitoring, protection against DDoS attacks, environment updates, backups, a team of qualified specialists, etc.\n\nNevertheless, we need to remember that transition to the cloud does not mean moving the responsibility for the security of the provider.<\/strong>\n\nUsing cloud does not relieve us from this responsibility but allows to move part of the tasks concerning security onto the provider. It is crucial to be fully aware of the provider\u2019s obligations and to ensure completing the remaining tasks. This allows to avoid the so-called grey area which nobody cares about, and this makes it the weakest link and first thing to threat the security.\nDevil is in the detail<\/strong><\/h2>\nTask division depends on the type of services we use. The below-presented figure presents the standard share of responsibilities, as for used services: <\/em>\n\n\n\nBased on ENISA materials<\/em>\n\nWhen we move the server contents to the cloud from a service room (IaaS service), the provider is the party responsible for physical security, power, air conditioning or network. Still, the responsibility for security of many components comprising our solution, such as for instance operating the system, database, application, data or access to the solution is on our side. If we decide to use CRM as SaaS service instead of moving it into the cloud, our liability limits to managing the access to the application. With the decrease in our responsibility, the number of tasks we gave away to the provider increases, as illustrated below:\n\n\n\nBased on ENISA materials<\/em>\n\nIn every case, no matter which services are in question or what is the task division, security involves availability assurance, data confidentiality, and integrity<\/strong>, where:\n
Nowadays, the cloud has been commonly identified with public solutions where many companies share the resource with access via the Internet, and this solution shall be\u00a0discussed in\u00a0the further part of the article. However, it should be\u00a0kept in\u00a0mind that there are also private hybrid solutions.<\/p>\n
Year by\u00a0year, more Polish companies decide to\u00a0use various options for cloud services. What convinces them to\u00a0do\u00a0it are, most of all, no\u00a0need for investing in\u00a0their own infrastructure, easy scalability and flexible use. The price of cloud services is rarely an obstacle in\u00a0making the decision to\u00a0switch into them.<\/p>\n
The main problem and barrier for the unconvinced is the concern about security, especially about data loss or\u00a0leakage. Ironically, especially in\u00a0the case of small and medium-sized companies, migration to\u00a0cloud may be\u00a0safer than the solutions installed in\u00a0local server rooms.<\/strong><\/p>\n A good cloud is, among all, a\u00a0location secured against unauthorized access, 24h infrastructure monitoring, protection against DDoS attacks, environment updates, backups, a\u00a0team of qualified specialists, etc.<\/p>\n Nevertheless, we\u00a0need to\u00a0remember that transition to\u00a0the cloud does not mean moving the responsibility for the security of the provider.<\/strong><\/p>\n Using cloud does not relieve us from this responsibility but allows to\u00a0move part of the tasks concerning security onto the provider. It is crucial to\u00a0be\u00a0fully aware of the provider\u2019s obligations and to\u00a0ensure completing the remaining tasks. This allows to\u00a0avoid the so-called grey area which nobody cares about, and this makes it the weakest link and first thing to\u00a0threat the security.<\/p>\n Task division depends on\u00a0the type of services we\u00a0use. The below-presented figure presents the standard share of responsibilities, as\u00a0for used services: \u00a0<\/em><\/p>\n Based on\u00a0ENISA materials<\/em><\/p>\n When we\u00a0move the server contents to\u00a0the cloud from a\u00a0service room (IaaS service), the provider is the party responsible for physical security, power, air conditioning or\u00a0network. Still, the responsibility for security of many components comprising our solution, such as\u00a0for instance operating the system, database, application, data or\u00a0access to\u00a0the solution is on\u00a0our side. If we\u00a0decide to\u00a0use CRM as\u00a0SaaS service instead of moving it into the cloud, our liability limits to\u00a0managing the access to\u00a0the application. With the decrease in\u00a0our responsibility, the number of tasks we\u00a0gave away to\u00a0the provider increases, as\u00a0illustrated below:<\/p>\n Based on\u00a0ENISA materials<\/em><\/p>\n In every case, no\u00a0matter which services are in\u00a0question or\u00a0what is the task division, security involves availability assurance, data confidentiality, and integrity<\/strong>, where:<\/p>\n Before you make the decision to\u00a0use the cloud:<\/p>\n All these mechanisms are well-known and commonly used within an on-premises infrastructure where it is often possible to\u00a0access the resources only within the network. Therefore, it is even more important to\u00a0remember about them in\u00a0terms of cloud solutions where access is possible everywhere via Internet connection.<\/p>\n Along with the reduction of wide access to\u00a0the services it is worth implementing other mechanisms such as\u00a0allowed devises, locations or\u00a0login time, and many more.<\/p>\n Moreover:<\/p>\n A defined aim, a\u00a0good plan, a\u00a0set division of duties, proper execution, and we\u00a0are safe in\u00a0the cloud. It seems like a\u00a0perfect time to\u00a0relax. Not at\u00a0all. Security is not a\u00a0state that can be\u00a0reached once and forever. It is a\u00a0constant process: following the changes everywhere around, monitoring threats, preparing to\u00a0prevent them, verifying security efficiency, fixing vulnerabilities and continuing to\u00a0follow the changes. It is a\u00a0never-ending work, no\u00a0matter if we\u00a0use our own resources of the cloud.<\/p>\n <\/p>\n Written by\u00a0Marcin Szyd\u0142owski, CITO, Soflab Technology Sp. z\u00a0o.o.<\/em><\/p>\n <\/p>\n Fotografia\u00a0Philipp Birmes\u00a0\/ Pexels<\/p>\n [\/et_pb_text][\/et_pb_column][\/et_pb_row][\/et_pb_section]<\/p>\n","protected":false},"excerpt":{"rendered":" Although the cloud is becoming more and more popular in\u00a0Poland, moving into it is still quite a\u00a0challenge for many Polish entrepreneurs. The following guidebook is for those who still hesitate or\u00a0wonder if it is worth doing, or\u00a0have no\u00a0idea how to\u00a0prepare for it. The cloud \u2013 solution of the XXI century Cloud is a\u00a0modern IT environment […]<\/p>\n","protected":false},"author":23,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_et_pb_use_builder":"on","_et_pb_old_content":"The concerns are much exaggerated<\/strong><\/h2>\n
Devil is in\u00a0the detail<\/strong><\/h2>\n
<\/p>\n<\/p>\n\n
If you need a\u00a0security audit, contact our expert.<\/a><\/h3>\n
Make a\u00a0conscious choice<\/strong><\/h2>\n
\n
Consider whether you want to\u00a0move the entire IT environment or\u00a0to\u00a0use hybrid solutions (to\u00a0move only part of the resources). Also, it is good to\u00a0identify the people with access to\u00a0the resources, verify their personal data and current privileges. Many companies make necessary authorizations but hardly ever makes sure the workers still have them even after they are no\u00a0longer needed. Minimum and only necessary authorization is one of the key issues in\u00a0security.<\/li>\n\n
\n
\n
\n
\n
No\u00a0more or\u00a0no\u00a0less?<\/strong><\/h2>\n
More about our offer of audits and security testing. \u00a0<\/a><\/h3>\n
Although the cloud is becoming more and more popular in Poland, moving into it is still quite a challenge for many Polish entrepreneurs. The following guidebook is for those who still hesitate or wonder if it is worth doing, or have no idea how to prepare for it.<\/h2>\n
The cloud \u2013 solution of the XXI century<\/strong><\/h2>\nCloud is a modern IT environment that answers the need for flexible business support. It provides a configurable resource shared with various entities in order to launch IT business solutions dedicated to them, separated from other cloud users. Cloud services may be delivered using different models, the most popular ones include: IaaS<\/strong>: Infrastructure as a service, PaaS<\/strong>: Platform as a service, SaaS<\/strong>: Software as service, the remaining two, less popular, are: MBaaS<\/strong>: Mobile \"backend\" as a service and FaaS<\/strong>: Function as a service.\n\nNowadays, the cloud has been commonly identified with public solutions where many companies share the resource with access via the Internet, and this solution shall be discussed in the further part of the article. However, it should be kept in mind that there are also private hybrid solutions.\n\nYear by year, more Polish companies decide to use various options for cloud services. What convinces them to do it are, most of all, no need for investing in their own infrastructure, easy scalability and flexible use. The price of cloud services is rarely an obstacle in making the decision to switch into them.\n\nThe main problem and barrier for the unconvinced is the concern about security, especially about data loss or leakage. Ironically, especially in the case of small and medium-sized companies, migration to cloud may be safer than the solutions installed in local server rooms.<\/strong>\n
The concerns are much exaggerated<\/strong><\/h2>\nA good cloud is, among all, a location secured against unauthorized access, 24h infrastructure monitoring, protection against DDoS attacks, environment updates, backups, a team of qualified specialists, etc.\n\nNevertheless, we need to remember that transition to the cloud does not mean moving the responsibility for the security of the provider.<\/strong>\n\nUsing cloud does not relieve us from this responsibility but allows to move part of the tasks concerning security onto the provider. It is crucial to be fully aware of the provider\u2019s obligations and to ensure completing the remaining tasks. This allows to avoid the so-called grey area which nobody cares about, and this makes it the weakest link and first thing to threat the security.\n
Devil is in the detail<\/strong><\/h2>\nTask division depends on the type of services we use. The below-presented figure presents the standard share of responsibilities, as for used services: <\/em>\n\n
\n\nBased on ENISA materials<\/em>\n\nWhen we move the server contents to the cloud from a service room (IaaS service), the provider is the party responsible for physical security, power, air conditioning or network. Still, the responsibility for security of many components comprising our solution, such as for instance operating the system, database, application, data or access to the solution is on our side. If we decide to use CRM as SaaS service instead of moving it into the cloud, our liability limits to managing the access to the application. With the decrease in our responsibility, the number of tasks we gave away to the provider increases, as illustrated below:\n\n\n\nBased on ENISA materials<\/em>\n\nIn every case, no matter which services are in question or what is the task division, security involves availability assurance, data confidentiality, and integrity<\/strong>, where:\n