ICYMI: Cloud vs. On-Prem Security
What's the difference between cloud and on-premises security? Find out what the panel of experts from iCorps' ALA Lunch & Learn had to say in this video.
[Chris Stephenson - Moderator] So, then here's the fun part. As we've been moving more and more to the cloud, to save money, efficiencies and so on, and also just engage with our companies over cloud, where does security play in the cloud space versus on-prem, behind my firewall? So I might have a Fort Knox that Justin's built for me behind the firewall, but most of the world we're now engaging
is in the cloud. And even some of our pieces of our networks, so to speak, are in the cloud. Where does that put us on track as far as security? Are we less secure? Are we more secure? I've heard people actually argue it both directions. So Justin, do you want to start us off?
[Justin Walker - Sophos] So the interesting thing about kind of moving things up to the cloud is, the cloud itself is very secure. But the problem is, you know when we're talking about Microsoft or Amazon, or whatever cloud provider it might be, their responsibility is the security of the cloud itself. For the things that you're putting into the cloud, that is your responsibility and our responsibility.
Alright so, the infrastructure, the back end of what builds, you know, Azure and AWS is really strong and built on a really successful architecture, but when you start to put assets up there, it's only as well guarded as you choose to guard it. You know, if you have weak passwords, poorly patched systems, or poorly implement third party applications, there's a lot of vulnerabilities that can still be inherent in what the end-users and companies are putting up there in the cloud. And so that's where we all come into play. You know, on the Sophos side, we have—we treat the cloud just like any other endpoint. So you can spin up our firewalls up there, we can spin up our endpoints if you're doing PDI, our server protection or server infrastructure, and it's just an extension of the network at that point. It shouldn't really be treated any different from the assets you have on-site. You know the uptime will be very good because of the high availability of, you know, names like Microsoft and Amazon. The big thing is, you know, it's the stuff that you're putting up there ultimately being treated just like any asset that you have I think internally.
[Jeffery Lauria - iCorps] Actually, one of the things too—I met with someone yesterday, at a very large company to talk about their email in the cloud, and I asked them "How do you back it up?" And they go "What do you mean back it up? It's in the cloud I don't need to back it up. Microsoft has my back." Microsoft doesn't have your back. At the end of the day, that data that sits in the cloud. Office 365, Google Apps, SalesForce, it doesn't matter, those companies back up their stuff, not your stuff. So we have a partner here with Datto that has solutions to back up your data in the cloud. So, you know, to your point, if you back it up on-prem, you should back it up in the cloud as well. But I do agree the cloud is probably the most secure platform. It is—when you see, you know, some data was lost from Amazon, it's because the user that was configuring it misconfigured it. It wasn't anything to do with Amazon, nothing to do with them, nothing to do with Microsoft, it is the people configuring it, you know, pressing the buttons. Those are the ones that are making it less secure.
[Lauren Looney - Datto] And I'll add on too. It's interesting, so both Google and Office 365, in their SLAs, have language in there that specifically recommends having a third party back-up of their information. And I think, maybe 30-60 days they might be able to have recovered, but you know, even on their end, they're saying you should back up these things. They're like look, we're not going to have your information stored here, but that's kind of in the fine print. So, you know, it doesn't all go back to them.
iCorps Video Library