Mark Houpt, CISO at DataBank was recently a featured guest on Open Spectrum’s I Love Data Centers podcast with Sean Patrick Tario. Mark discusses all things data and data center security to help listeners understand the roles of data center providers and clients to protect their data.
Listen to the podcast below.
This podcast first appeared on Open Spectrum and can be downloaded on iTunes and Google Play Music. Mark Houpt, DataBank CISO, brings over 25 years of extensive information security and information technology experience in a wide range of industries and institutions. Mark holds an MS-ISA (Masters Information Security and Assurance), numerous security and technical certifications (CISSP, CEH, CHFI, Security +, Network+) and qualified for DoD IAT Level III, IAM Level III, IASAE Level II, CND Analyst, CND Infrastructure Support, CND Incident Responder, and CND Auditor positions and responsibilities. Mark drives DataBank’s information security and compliance initiatives to ensure that the company’s solutions continuously meet rigorous and changing compliance and cyber-security standards. Mark is responsible for developing and maintaining the company’s security program roadmap and data center compliance programs.
Digitalization has rapidly led to digital transformation, and today, it’s an ongoing initiative for all businesses. The cloud is an excellent option for organizations looking to migrate, improve, or replace legacy systems, or adopt a hybrid strategy, all of which pave the way for innovation opportunities. It’s convenient that public cloud offers a path to achieving digital transformation faster and more effectively, plus, it’s a highly efficient way to power mission-critical applications while simplifying IT.
According to IDC, the market is expected to achieve a five-year compound annual growth rate (CAGR) of 21.9%, with public cloud services spending totaling $277 billion in 2021.
Most businesses rely on the cloud for some function of IT, and those who don’t plan to eventually. The great cloud migration represents a fundamental shift in how enterprises provision and manage IT infrastructure. Here’s the question: hyperscaler, or partner?
Hyperscaler vs. Cloud Partner: What Are the Differences?
There are benefits to both hyperscale clouds and cloud partners. Either way, making the commitment to migrate mission critical applications and workloads to a third-party cloud provider requires the right platform and right method. As part of your strategic roadmap, you’ll need to delve into your infrastructure and applications to determine the levels of resiliency, security, scaling and compliance support required, as well as what resources you’ll need for ongoing management. Effective cloud migration strategies, rehost, refactor, re-platform, determine how quickly organisations capture cloud value.
Let’s take a look at some of the differences between hyperscalers and full service data centers (cloud partners) based on the factors below for comparison:
Technical Expertise
Hyperscaler: Engaging a hyperscaler for your cloud needs will require you to “bring your own experts.” You’ll need to have, or hire, adequate internal IT staff who can handle deployment and management.
Cloud partner: Working with a full service data center is a force multiplier for your own IT staff. A robust cloud partner will be fully staffed, including cloud architects and security engineer experts who remain available through the lifecycle of the engagement.
Cloud Options
Hyperscaler: Large-scale providers offer public cloud options exclusively, which isn’t always a great fit for businesses with more specific requirements.
Cloud partner: A true cloud partner offers public, private, hybrid, bare metal, and dedicated options, plus a myriad of other solutions, like managed services, to complement your cloud environment on demand.
Hyperscaler: Hyperscalers are generally not going to offer much in the way of support for your compliance requirements. Typically, they’ll check a few boxes, but the majority, if not all of the burden, will fall on your business.
Cloud partner: An expert cloud provider will offer comprehensive control coverage to help you meet your compliance requirements. Ideally, you’ll have a CISO and a team of compliance and security experts available to ensure ongoing compliance and audit preparedness, as well as assist with answering any questions you may have.
Ongoing management
Hyperscaler: In this scenario, you won’t have many options for management. Hyperscale cloud providers usually offer costly, tiered management services, most often via point solution providers. Technology is changed frequently as a result.
Cloud partner: A full service data center comes with comprehensive managed service options, including monitoring, recovery, around-the-clock U.S.-based tech support, patching, backups, and security. Cloud experts will also keep up with evolving technologies and keep you abreast of any changes.
Holistic view of environment
Hyperscaler: These kinds of development portals are usually overly complicated and non-intuitive, which makes spinning up and managing resources cumbersome, costly and difficult.
Cloud partner: A high-quality cloud provider will offer a more sophisticated portal with real-time analytics, including security, managed services, role based permissions, and up-to-the-minute audit support.
Perceived cost
Hyperscaler: Notice the word “perceived.” Going with a hyperscaler may start out less, but costs can quickly escalate and become difficult to manage and predict.
Cloud partner: In a partnership scenario, your provider will gain transparent and consultative understanding of existing challenges in order to develop a cloud solution that can cost effectively adapt to evolving needs, plus, you’re always in the know.
Your Cloud, Your Way, Today and for the Future with DataBank
When it comes to data center providers, colocation and connectivity are important. However, flexible access to any cloud, as well as solutions specifically designed for your changing needs, is just as critical. In the pursuit of cloud migration, your business deserves a truly consultative engagement and a customer-centric experience.
Here at DataBank, we offer highly secure public, private, and hybrid options without ever sacrificing performance. We’re FedRAMP certified and offer support for your compliance requirements. For customers who wish to use hyperscaler cloud resources, we offer turnkey access via Megaport. Further, regardless of your chosen solution, you can include proactive managed services for handling varied application workloads.
If you’re looking for to pave your path to the cloud, DataBank is here for you. Reach out to a cloud specialist, or call us at 1.800.840.7533 to speak to an expert today.
On September 11, 2018, Adobe released security updates to ColdFusion 2018, 2016, and 11. The purpose of these security updates is to patch a vulnerability that could lead to arbitrary code execution. On September 28, 2018, Adobe has determined that CVE-2018-15961 is being actively exploited in the wild which specifically allows for unrestricted file uploads. All customers running ColdFusion 2018, ColdFusion 2016, or ColdFusion 11 should update their installs with this security patch.
What is the severity of this exploit?
Adobe has raised the severity to level 1 for ColdFusion 2018 and ColdFusion 2016 as this is actively being exploited in the wild as of September 28, 2018.
Is my server affected?
If your server is running ColdFusion 2018, ColdFusion 2016, or ColdFusion 11, your server may be affected. To check, log in to your ColdFusion admin for each instance and navigate to Server Update > Updates. From there, click Check for Updates. Below is an example for ColdFusion 11:
My server is affected. What do I do?
First, read the release notes as ColdFusion will need to be running a specific version of Java for the patch to work properly. If Java is not updated and the patch listed above is run, your server is NOT protected. Java being patched is a prerequisite to the patch.
For ColdFusion 2018, Java must be JDK 8u121 or higher.
For ColdFusion 2016, Java must be JDK 8u121 or higher.
For ColdFusion 11, Java must be JDK 7u131 or JDK 8u121 or higher.
After checking the Java version and ensuring it is updated, go back to ColdFusion admin for each instance. Find the specific update and click Download and Install. The process will download the installer and install it for you. ColdFusion will need to be restarted after this is completed to ensure the patch is up-to-date.
Lastly, after patching, navigate back to ColdFusion admin for each instance. Click Server Update > Updates. From there, click Check for Updates and ensure there are no further updates. If there are other updates, repeat the process.
What if I need help applying the update? Will DataBank Support perform this update for me?
DataBank Support stands ready to assist if needed. To obtain support, navigate to our Customer Portal and submit a ticket or call us at 855.328.2247 and we will be glad to assist.
The Risks of Depending on a Single Hyperscaler
As digitalization progresses, enterprises are increasingly relying on the cloud for simplicity and efficiency. According to Gartner, the worldwide public cloud services market is expected to grow 21.4% in 2018, bringing it to a total of $186.4 billion.
While the public cloud brings promises of numerous benefits, such as reduced operational costs, improved workforce productivity, operational resilience, and business agility, it has to be used strategically. Migrating all of your workloads into a single hyperscaler may not be the best move for getting the most out of the cloud. It’s a great option to offload hassle and costs, but you need to choose the right clouds and redundancy options for your needs.
A few reasons why putting all of your eggs in one cloud can be risky:
Vendor lock-in
Risk of DDoS attacks
Lack of reliability
Potential for downtime (CIO from IDG)
Why Your Cloud Strategy Must Include Redundancy at Multiple Levels
Now, we’re not discouraging the use of hyperscalers. We’re just saying that having nimble options for redundancy alternatives in your data center is ideal.
Let’s review the recent Microsoft Azure outage that, due to a lack of availability zones, caused an automatic shutdown of hardware. After lightning during a storm caused a voltage swell in utility feeds that powered one of the Azure data centers in Texas, cooling systems were knocked out, and as air temperature rose, the hardware shutdown was triggered. Ultimately, the outage affected close to 40 Azure services in the South Central region, as well as multiple other locations. Unfortunately, those services either relied on the storage systems that failed or had dependencies with services that relied on them (Data Center Knowledge).
The above example took place before Azure introduced availability zones, and demonstrates the potential consequences of relying on a single cloud. It is key for businesses to make sure their cloud strategy includes redundancy at multiple levels. Using a single public cloud provider does not guarantee redundancy, as evidenced by the Azure outage.
Enabling a Cloud Redundancy with Data Center Cloud Connections
If you’re looking to get the most out of the cloud, broadening your portfolio may be a good tactic for putting your environment in a more resilient position. Relying on a public cloud connection through a reputable data center is one way to establish a single interconnection point for cost-effective multi-region and multi-cloud redundancy.
Cloud Direct Connect, for example, is a secure, fully private connection between customer infrastructure located in DataBank data centers and hyperscale cloud providers. DataBank is partnered with Megaport, a leading provider of SDN-based elastic interconnection solutions, to facilitate access from DataBank data center locations to a wide range of providers on the Megaport network. With Megaport-enabled Cloud Direct Connect, DataBank colocation or managed services customers can connect directly to a range of public clouds.
If you’re looking for a way to establish better redundancy, DataBank can help you strategize. Contact us online or call us at 1.800.840.7533 and speak to a cloud specialist.
What is Storage as a Service?
Not to be confused with cloud storage, Storage as a Service allows businesses to rely on a third-party to store their data (Techopedia). It’s an easy, cost-effective way to manage backups, as well as forego hiring additional personnel and purchasing hardware or physical space.
When managed internally, attending to storage and backups often involves storing tapes offsite. StaaS allows your IT admins to meet the same needs using SLAs with a StaaS partner. In many cases, cost is determined per-GB and per-data-transferred. Customers transfer their data to the StaaS partner on a schedule either via the internet or the partner’s wide area network. Storage partners will usually provide clients with a portal they’ll need to access stored data; typically, such portals can also be used to perform backups, transfers or restores. Storage as a Service is a cloud computing delivery model that provides on-demand, scalable cloud storage with pay-per-use billing.
Who Can StaaS Work For?
StaaS can work well for a number of different customers, from small businesses to enterprises who are seeking to optimize their disaster recovery strategy—it all depends on the objectives you’re looking to achieve. Generally speaking, StaaS is an excellent option for the following candidates:
Small to mid-sized businesses
Organizations who are having difficulty adding storage due to budget constraints
Those struggling with negatively impacted application performance as a result of a lack of database storage
Businesses who require multiple tiers of storage
Decision makers seeking to mitigate disaster recovery risks
Customers with limited IT personnel
The Benefits of StaaS
Object storage advantages make it the natural backbone for storage-as-a-service offerings targeting unstructured data workloads. Storing files remotely instead of locally comes with plenty of advantages for the right users.
Cost-effective, efficient solution for storage: running out of local SAN space is an annoying, potentially expensive problem. StaaS becomes a sort of SAN on-demand solution with multi-tier storage options from high performance to long-term archival.
Deploy rapidly and save money: short SLAs ensure you’re online in no time while saving on capital for expensive hardware
Fully supported, fully managed service: eliminate the need to hire additional IT personnel or strain your current resources
Encrypt and replicate off-site: Reduce risk via physical and virtual security
Relying on a Partner for Storage
If you’re experiencing symptoms of being burdened by the many tasks that accompany storage, or you’re looking for ways to refocus the efforts of your IT personnel, StaaS is definitely worth considering. Storage is a major component of IT operations, and it has the potential to save you time and money with the right strategy. Start by looking for a reliable, proven StaaS partner to help you.
Often times, small to medium-sized businesses take advantage of StaaS to realize costs savings and give time back to the IT team. If you’re looking for ways to save on storage and allow your IT personnel to focus on projects that directly contribute to the success of your business, a StaaS partner is a great option.
DataBank can help you find the right Storage as a Service solution for your business. DataBank Storage as a Service provides quick turnaround of secure, resilient, redundant, and encrypted storage for DataBank colocation customers. The solution physically resides in existing colocation facilities, ensuring security and compliance.
If you’re looking for a partner in storage, DataBank can assist. Reach out to us to talk about Storage as a Service, or call us at 1.800.840.7533 and speak to a StaaS specialist.
