Small/Medium Businesses: Security is at the forefront

As a IT consultant to several SMB's (Small Medium Business), I talk to owners everyday about their needs and concerns about their IT infrastructure. Most of the time the conversation is about increasing productivity through the use of technology.  Right now the hot topic there is cloud technology.  They feel they need to be  more efficient with processes and avoid creating redundancy.  The one thing that is not a big topic is security.

No offense to SMB's but I am not sure that these owners are fully aware of what is really going on with cyber-security.  A lot of small and medium shops treat their IT security as if they have nothing to worry about.  Now I am not here to say that all of them are not security aware, however they read something in the news about a security breach at a large company but think that will never happen to them.  Hackers do not discriminate.  If you have data and a internet presence you are a target.

The key to SMB security is to synergize business objectives and productivity with security.  Just because you lock down your IT infrastructure does not mean you cannot do business.  You just have to find a way that works best for your company.  Its easy to be productive if you have no controls on the infrastructure, however its the lack of those controls that could produce a security breach or incident that will cause you not to be productive.   I believe there is a way for all of these areas to coexist.

SMB security has some challenges that are different from enterprise security.  Sometimes SMB IT personnel are great administrators but may be unaware of security threats that may exist.  They are in charge of a lot of areas for the business and there is no security department like in enterprise companies to help them. Therefore while they are solving business needs and doing day to day brake it and fix there is just not the time to maintain up to date security.

So what is a SMB to do?  Where do they start?  Over the next month and a half I am going to be exploring 6 key areas for SMB security. 

Key Areas of SMB Security

1) SMB Threats and Vulnerabilities

2) Security Policy

3) Security Awareness

4) Internet Access

5) BOD (bring your own device) Security

6) Auditing Administrative, Technical, and Physical controls

Hopefully if you are a SMB this series may get you to re-evaluate your security needs and have a better understanding of your security needs.

Thank you and if you have any questions during the series please feel free to email me at wpruett@centriq.com

- Tom Pruett, Cisco & Security Expert; MCT, CTT+, CISSP, CWNA, CEH, CHFI, CCSI, CCNA, MCSE LinkIn with Tom

Cloud Intelligenece Conference: Keynote Speaker Announced!

Centriq Training is pleased to announce Paul Mattes, Microsoft U.S. Director of the Windows Azure Platform and Technical Computing, as the 2012 Cloud Intelligence Conference Keynote Speaker!

This one day conference will be held on April 12, 2012 at the Overland Park Convention Center. 

Mr. Mattes' Microsoft teams are responsible for working with customers and partners to identify and deliver solutions based on Microsoft’s cloud computing assets and High Performance Computing software. He has over 25 years experience in a diverse set of disciplines including software architecture and engineering, data center operations, enterprise sales management and strategic business consulting. Learn more about him here.

This event is ideal for IT professionals, business decision makers and executives from all types of technology backgrounds. Some topics will include Public Cloud, Private Cloud, Hybrid Strategies, Cloud Security, Virtualization, Migration and Information Architecture. Seating is limited. To learn more or register for this event, please visit www.centriq.com/CloudIntelligence.

For questions or more information on the event contact your Account Executive at 913-322-7000.

- Jessica Oliver, Director of Operations LinkIn with Jessica

Centriq Announces Cloud Intelligence Conference

We at Centriq are pleased to announce, along with Microsoft,  it will host the 2012 Cloud Intelligence Conference to be held at the Overland Park Convention Center on April 12, 2012. 

This one day conference will cover a variety of powerful network computing information management strategies for businesses of all levels. Some topics will include Public Cloud, Private Cloud, Hybrid Strategies, Cloud Security, Virtualization, Migration and Information Architecture.

Attendees will have the choice of four tracks, with 4 sessions each, in the 2012 Cloud Intelligence Conference including:

• Cloud Roadmaps and Overviews for Executives
• Infrastructure as a Service (IAAS)
• Software as a Service (SAAS)
• Platform as a Service (PAAS)

This event is ideal for IT professionals, business decision makers and executives from all types of technology backgrounds. Seating is limited. To learn more or register for this event, please visit www.centriq.com/CloudIntelligence.

For questions or more information on the event contact your Account Executive at 913-322-7000.

- Jessica Oliver, Director of Operations LinkIn with Jessica

Exchange Updates!

The Microsoft Exchange team has updated their popular Exchange 2007 Component Poster for Exchange 2010. For those of you that haven’t seen either, both are linked at http://msexchangeteam.com/. 

While you're there check out Office 365 - Microsoft's exciting new business solution for the cloud just announced today! 

http://msexchangeteam.com/archive/2010/10/19/456652.aspx

- Bob Reinsch, Microsoft Exchange/Windows 7 Expert; MCT, MCITP LinkIn with Bob

Cloudy with a chance of outsourcing?

If you are not yet familiar with cloud computing, the basic idea is that instead of buying your own servers and creating your own infrastructure to manage and deliver your data and services, you can hire a third party to do it for you. The provider can then add processing power and storage capacity as your needs change, theoretically reducing the headache of scaling it yourself.

Amazon was an early arrival on the cloud computing scene with the Elastic Compute Cloud service. Google Apps was launched by Google as a way to develop software online and run the apps on the monster hardware at Google.

The idea of not owning and managing IT infrastructure can be very appealing to small and medium sized businesses and can be a great solution in some cases. The main benefit is if the cost of running your business from the cloud is less expensive than doing it yourself. It usually is.

But there are many concerns about security and justifiably so. What business wants to have sensitive data out of their direct control? Which businesses can legally put that sensitive data (like maybe your patient records) out on a cloud service? Many vendors are working on ways to make the customer data more secure in the cloud, but most experts agree that it is best to keep the important data close to home inside a private IT infrastructure and only send the less sensitive data, stuff that is probably already out on a web facing server, to a cloud solution provider.

Even Microsoft has been experiencing some pushback from experts who are not employed by the software giant, as I witnessed recently at the TechEd conference in New Orleans, a venue used by Microsoft to train and promote their products. Many of the speakers at the conference spoke at great lengths about the dangers of cloud computing, security being the first concern and availability being the second. What if the cloud provider needs to bring down the network, reboot a server, change a public IP address, any of which might interrupt your service? Can your business afford to lose internet presence and for how long? How long can your business function without an application or some data? These are some of the concerns expressed by the "non-koolaid drinkers", as one speaker put it.

Personally, I think it is a great idea. Much of our data is not too sensitive to be out there and there are ways to secure data out in the public domain. Which companies truly have data that is too sensitive to allow capture by random internet hackers? Of course some companies have true, legitimate security concerns but I think most have little to fear. And as far as availability, there are many ways to have multiple copies of your data and applications available to avoid being placed at the mercy of one cloud provider by using more than one provider and I expect we will see many solutions proposed and implemented in the coming year.

I do know that Microsoft's SQL Azure, a cloud solution for databases, is very easy to set up and connect to (for a pretty reasonable fee) and that many small companies will jump at the opportunity to have a serious, professional and scalable database solution for a fraction of the cost to do it yourself. The process to set it up was described to me by one Microsoft employee:

"First you export your data to a text file or something like that, send it to us, pay the fee and we send you the connection information." When I asked him to elaborate he said "That's all there is to say..."

It just doesn't get any simpler.

Since the vast majority of businesses are small businesses, I fully expect Microsoft Azure (web services) and SQL Azure (database services) to do a fair bit of business in the next business cycle, and many will choose to cloud compute.

- Peter Trast, SQL Expert; MCITP DBA, MCITP EA, MCT LinkIn with Peter