Cloud hosting enables an SMB to run its websites or any other computing service on one or more virtual servers. Since it is an on-demand subscription model, an SMB pays only for the resources it uses, making cloud hosting an extremely popular and valuable service. Most businesses are looking for ways to keep costs under control and the cloud helps businesses to do so.

It is important to highlight the three types of clouds: private, public and hybrid:

Public clouds: The public cloud is a shared cloud where services are provided as a service over the Internet with little or no control over the underlying technology infrastructure. The benefits of the public cloud are attractive to many as it reduces complexity and long lead times in testing and deploying new products. The public cloud is typically the most cost effective cloud solution for a business.

Private clouds: The private cloud also offers activities and functions as a service but is deployed over a company intranet or hosted datacenter. The benefit of the private cloud is that private cloud owner shares few, if any, resources with other organizations.  Private clouds offer companies the most security and control over implementation.

Hybrid clouds: The hybrid cloud combines characteristics of both public and private clouds.

Whether an SMB chooses the public,  private or hybrid cloud, with proper deployment by the in-house IT department or an outsourced managed service provider, cloud computing can provide many benefits including significant savings, effective IT services and a higher level of reliability.

A recent IDC forecast indicates that server systems for private clouds will have the largest share by 2014, expected to be $11.8 billion.  A private cloud offers centralized network resources at a remote location.  Users are able to securely connect to the network resources from anywhere via the Internet.  Applications and data are processed remotely by the network resources and delivered locally to user workstations.  This reduces local processing requirements, enabling less-expensive local hardware and longer hardware refresh cycles.  Keep in mind, for many smaller organizations with relatively simple network infrastructure and primarily local users, the costs of implementing a private cloud can be prohibitive; for these reasons, the public cloud may be a better option.

For an organization to determine if the private cloud is the best approach for a business, the IT managers need to work closely with key management personnel and consider the following:

1. Are the applications being used by the organization compatible with a cloud-based infrastructure?
2. Do regulations governing business operations allow for cloud-based systems?  Are there compliance requirements for local data retention?
3. Does the cost of design, build and ownership yield a reasonable ROI?
4. Are there efficiencies to be gained through the use of a private cloud?
5. Can the existing infrastructure be leveraged for the private cloud?

Private cloud computing offers the following benefits:

1. Dedicated hardware – If a business has the proper physical security, anti-virus software and firewall rules, it should feel confident its data will be safe; it is directly controlling the cloud.
2. Scalability: Solutions can be implemented and resources can be put to use when the need arises, increasing efficiency and reducing costs.
3. Better resource management: Multiple servers can be virtualized on one physical server, sharing the resources.  The results are many, and include decreased rack space and power usage and more manageable.  If a business has the proper resource management tools installed on the server, the resources can be automatically allocated.  This is an efficient way to manage servers.
4. Virtual servers combined with a storage area network (SAN) can protect against disasters: A business can automatically shift server resources between servers immediately and there will be no downtime when performing maintenance such as adding more RAM, replacing a hard drive or upgrading software.

Time and money may be saved:  Relying on a private cloud may be more affordable and less of a hassle then a business hosting their own servers or purchasing dedicated servers. A business has complete control over what goes on their network.

But, what I was most struck by throughout our All-Hands meeting was that every leader who presented spoke of a leap of faith he or she took with respect to coming to work for Dataprise.  Each shared a unique story of trust and intuition, one of synergy meeting happenstance — and felt it wasn’t necessarily something tangible, but rather a commonality of passion, ethics and integrity.

Today, manned with a staff of over 150 certified network technical consultants and support staff, Dataprise supports over 1,000 organizations with their business technology.  Suffice it to say that innovation comes from the weirdest places. It can come from our clients, our DP team or the UPS guy.  We listen to all ideas and have built an adaptive, progressive business model that encourages thoughtful, intelligent, and democratic discourse.  I am proud of how far we’ve come; I am proud of what we’ve built, and where we’re heading. What’s on the horizon for Dataprise is something I’m excited to be a part of, as new relationships will impact our success and our growth going forward. Dataprise has experienced growing pains like everyone, but being prepared and positioned to tackle the next big problem has lead us to the forefront of our industry.  I can say without a doubt, that our teams are comprised of some of the brightest minds working in IT today. Great thinkers beget great rewards.  And, I can attest, in Dataprise’s case, great teams that (to use a cycling term) draft off the ingenuity of those closest to them gain better positioning in business and in life.  I wrote this month’s blog to say, “thank you” to all at Dataprise, and I promise there’s another gear we’re about to shift into, so get ready…

Designing a strong business continuity plan is dependent upon myriad factors and for this reason companies need to consider running a business impact analysis (BIA). A business impact analysis zeroes in on your business’s most critical processes as well as the effect an outage would have on the business. IT, security, and business leaders should work together to determine the kind of plan necessary and to decide which businesses and systems are most crucial to the company. For one, businesses inherently can’t run without the people. Aforementioned leaders will ultimately decide not only which employees are responsible for declaring a disruptive event, but also need to design a process for communicating and locating or relocating as it were.

For a business continuity plan to take flight, IT service providers must explain why their customers need a plan. Recognition of a problem is the first step toward a pragmatic solution.  For instance, IT companies could encourage retail clients to purchase redundant IT systems that would allow a company to maintain a remote processing infrastructure, and whereby they can maintain critical communication with third-party partners. Business continuity plans and a business impact analysis can determine offsite crisis meeting places, alternate means of communication should phone networks go down, help form alliances with emergency groups and responders, and structure practice runs.  And, although it’s not something I like to think about—a contingency plan that includes a CEO succession plan is one of the most important reasons a company and its members should have these plans in place.

Managed service providers (MSPs) are very capable of building their own solutions, but companies need to consider the cost of managing, assembling, and maintaining custom solutions. In other words, time is money. What is the cost of ownership (TCO) worth to you? The cost potentials need to be paid close attention to. Building a customized solution is a huge time investment, and requires ongoing iterations and redesign to keep up with technology advances. Time is not to be underestimated with respect to creating and managing custom solutions.

Essentially, business continuity planning identifies an organization’s exposure to internal and external threats, and resiliency planning (BCRP) is a roadmap that details or maintains operational components that may be adversely affected. MSPs are not fear mongering.  We’re not proposing you begin stocking up on canned goods. But, life does happen while you’re busy making other plans.  We live in a new world, and we need to transition from a brave one to a smart one.

There isn’t a week that goes by that we don’t hear about a company’s most sensitive information being hacked or for that matter, one’s personal identification, thereby creating havoc on one’s livelihood and beyond.  Just last week, we were hit with the news that the retailer, Zappos was hacked, reporting a data breach affecting upwards of 24 million customers.  Intelligent hackers will hang on to files, incrementally accruing information on victims until they have a profile they can use to open fraudulent accounts.  Data convergence continues to take flight.  As we manage more information via smartphones and tablets for business and personal use, two imperative security measures to help safeguard against identity theft is to use different passwords for multiple retail accounts, and to create separate email accounts for your online retail activity and online financial services communication thus preventing a hacker to trace the identity to your bank account or credit card.

Hackers are increasingly targeting SMBs and penetrating security networks. In 2011, the cost of a data breach reached $7.2 million.  The three main causes of a data breach: Negligence, criminal attacks, and system failure.

In a progressively sophisticated criminal marketplace, one of the newer means of protection is data breach insurance.  Data breach insurance offers coverage for a variety of potential costs associated with a breach such as a legal defense, investigations, crisis management, and liability claims, among others. Terms and coverage can vary from one insurance provider to another.  For instance, The Hartford Insurance Company is selling a data loss insurance aimed at small businesses.  The new coverage is an add-on to the company’s existing business-owner policy. It covers legal liability expenses and offers resources for policyholders to comply with regulatory requirements. Still other insurers offer data breach coverage, which help with potential costs post breach.

There will always be vulnerabilities.  There’s no absolute formula –technology and new regulations are constant and forever changing. But, to help protect your business’s reputation and mitigate financial risk, organizations need to apply technology that meets their need to: control the flow of information across the network; control access to information itself; protect end systems; encrypt information where necessary; expose visibility into activities in the information infrastructure; and where possible meet more advanced security requirements, including, but not limited to data loss prevention.  We need preventive security plans, not just reactive ones.  Ultimately, the requirements of a business will drive the technologies.

Retention benefits your business by mitigating risk, raising the awareness of corporate governance and internal controls, and can improve an organization’s ability to respond to changing business circumstances.  For example, a strong business analytics solution can reduce costs by exposing problems much earlier. Moreover, creating an indexed and searchable email or communications storage system creates a unique company knowledgebase.  Secure archiving stores intellectual property and acts as your business blue print — creating an undeletable record of how your company operates, interacts with customers, etc.

Before discussing with a client about how to implement a customized email archiving plan, it’s first critical to establish an email retention policy, as a retention policy is the basis for most of the technological decisions on a project. An email retention policy keeps archiving projects on track and helps inform most technological decisions along the way.  Additionally, it is also intended to help employees determine what information sent or received by email should be retained and for how long.  For instance, the chosen storage media will depend largely on whether the archiving project is meant solely to reduce the strain on existing storage units, or whether the client also requires it for potential lawsuits or regulatory compliance audits.  Retention policies differ from company to company, and often depend on factors like the regulatory laws that govern each company’s industry, so it’s important to make sure businesses data lifecycle management policies don’t short-circuit its email retention policy.

IM Retention

Equipment choices are changing.  Forecasts of federal IT markets purport mobile Internet and email use will surpass desktop Internet and email use by 2014. Hardware investments will gradually decline as we move toward consolidation, cloud computing, and the move toward less expensive end-user hardware – such as smartphones and tablets.

As we move into 2012, more of the data we access will be hosted.  It has been reported that kids coming out of school don’t have email accounts, but rather live on social networks and messaging products.  And, as files become too large to send via email, downloading services that allow you to share links are vastly quicker and often more smartphone/tablet friendly.

As employees use instant messaging and text messaging on handheld devices more, the risk of an IM or text containing legally significant information is rising. Therefore, companies are starting to look at archiving other forms of communication. Federal compliance includes all records, and that means any material that contains information about a company’s plans, results, policies or performance — anything about a company that can be represented with words or numbers can be considered a business record.

Compliance requirements, security considerations and business needs can all be addressed in a formal, written policy for IM use.  Limiting IM to authorized users, logging and archiving IM conversations covered by regulations, integrating with email archiving, can be accomplished with relevant IT tools.

That said, one of the most important focuses moving into this election year is Privacy.  Yes, unfortunately, it’s likely that an individual or company will be hacked and as a result, will go on the warpath regarding privacy regulation.  Retention and security policies can be managed by auditing any outside firms who have access to your proprietary business data to confirm information is secure. The best offense is having a strong defense.  And, that means executing any additional security measures to protect your most confidential information when and if you need to.

Representatives from all departments in a business should be involved in the development of a plan to ensure all critical systems and processes can recover from any possible data loss activity.

Here are tips on what is needed in a DR “tool kit” to help minimize a disaster’s impact on a business’ IT assets:

1. Inventory all IT assets – Know all the business’ hardware, software and data.
2. Consider server virtualization – By outsourcing hardware dependencies, virtualization minimizes potential lost revenue associated with downtime, outages and failures. It also minimizes upfront capital and operational expenses and provides immediate, tangible and quantifiable cost savings.
3. Offsite data backups are critical – Archives and backups should be stored at an offsite location to ensure that data can be recovered in case of a physical disaster. Businesses already utilizing Cloud technologies should ask important questions about data recovery – is there a service level agreement/are there uptime guarantees, are there protocols in the event of an outage, and is there a backup protocol/scheme? Have an option to switch cloud providers and a plan to recover the company’s information if necessary.
4. Establish processes so backups occur regularly –Businesses need to perform nightly and weekly backups. IT systems can be brought down for a variety of reasons — hardware failure, human error, natural disaster or improper security processes. It is critical to back up data regularly, store extra copies of this data offsite and audit these processes frequently.
5. Create a disaster recovery committee – A committee should include the IT department, IT executives, HR and any other appropriate business managers. The plan should be reviewed at executive meetings to ensure all parties understand the process.
6. Draft the plan – Formally document the DR plan in writing and keep printed copies of the recovery plan in several secure locations, and at the recovery site. If the plan is unknown to those affected, it will be useless when the time comes to initiate recovery operations.
7. Test the solution. Regularly test the Recovery Plan to ensure it is practicable. Testing the plan will also act as a training tool; those representatives who performed the recovery procedures during regular testing will be familiar with the plan and able to perform the required actions, if/when necessary.

An October 2009 study conducted by Radicati Group estimated that the global market for archiving will grow from nearly $2.1 billion in 2009 to more than $5.1 billion in 2013. As a result of this growth, there are options for archiving emails including on a user’s machine, in hard copy or in a cloud environment.

With the cloud, organizations can now access email archiving tools over the Internet for a small, affordable fee. SMBs already on a cloud or entering cloud computing should look at cloud archiving solutions through SaaS for lower entry costs and a nominal monthly subscription. Cloud-based email archiving is budget-friendly with a per mailbox, per month pricing structure. There is no need for expensive hardware or software.

Getting the Inbox Under Control:

1. It is important for businesses to comply with relevant federal regulations including Sarbanes-Oxley Act (SOX), Health Insurance Portability Accountability Act (HIPPA), the December 2006 amendments to the Federal Rules of Civil Procedure, among others. The SOX Act states that all public companies must have a method for storing and managing records. The Federal Rules of Civil Procedure states that businesses that have the potential to be involved in lawsuits must be prepared to turn over email communications, if requested.
2. Email archiving ensures that all information including client communications, documents, records, contracts and invoices are stored, backed-up and protected in a central location on an ongoing basis. This provides easy access to files by all employees, especially those who telecommute or are traveling on business.
3. Archiving solutions have search and discovery tools built into them to ensure that companies can obtain specific information whenever they need to access it, quickly and accurately.
4. Emails can contain important business information that may not be documented in a specific file; email archiving will preserve the knowledge contained in email communication. It is important to work with the HR department to make sure users are complying with company policies.
5. Consult with your Legal department to be certain the archiving method meets any contractual requirements or legal orders. In the future, your business may need to produce historical email records.

Advancements in technology, such as remote access, mobile platforms, and virtual private network (VPN), allow employees to work from virtually anywhere. Whether a business allows employees to work remotely once-a-week or several days per week, it is essential that a business sets up a comprehensive telecommuting plan.

The VPN provides encryption between the employee working on their home/remote connection and the office’s network. To gain access to the VPN, some systems use one-factor authentication which requires a user name and password. Other services use two-factor authentication for added security.

It is also important to consider implementing a network access control (NAC) device. This device queries each PC before granting it network access; it will check if an antivirus tool is installed. The NAC can also check if the PC has a firewall and current security patches.

For businesses that retain credit card information or other confidential data, consider installing a third-party application on company PCs that can disable external USB devices when a user is logged in to an office network via VPN. By doing this, sensitive data prevents a remote employee from downloading client data. If the software detects the presence of an external USB device, it will terminate the connection.

Many small- and medium-sized businesses should utilize cloud-based productivity and collaboration platforms such as Box.net, Dropbox, SugarSync, Google Docs, Microsoft’s Office 365 and Syncplicity as they provide a means of sharing information between remote co-workers. These services are plentiful; they also support green initiatives by essentially allowing telecommuters to share resources.

To ensure a secure telecommuting program is in place, it is important that a business works with a knowledgeable partner who will map out the best strategy and offer the most effective recommendations. The number of telecommuters is only going to continue to grow.

Here are 10 ways a business can best protect its computers, the data and its networks:

1. Create strong passwords: A good password is often underestimated.  The stronger a password the harder it will be to crack even with the latest password-cracking software.  Passwords should contain characters that include a combination of uppercase and lowercase letters, numbers and symbols.
2. Follow IT department recommendations: Install all of the recommended patches and updates; these regular installations will keep computers and networks as secure as possible.
3. Don’t enable the Save Password option: It should be mandatory for the user to enter passwords on all operating systems or application settings. Choose no if a dialog box prompts a reminder about the password.
4. Lock computers: Whether a user is away from his/her computer for a few minutes or a few hours lock the screen. Also, set the computer to lock itself after a specified amount of time idle.
5. Questionable emails: Never open an email that appears questionable; rather forward it to the IT administrator to verify before the email is opened.
6. Use VPN: A VPN (Virtual Private Network) lets remote workers log into the network securely.
7. Get a firewall: A firewall acts as the first line of defense on any network.  Without one, your network is exposed to the world.
8. Scan networks: Networks should be scanned to see what ports are open; if there are open ports that should not be open, go to the firewall to make the necessary revisions.
9. Turn on compatible WPA Encryption: All Wi-Fi equipment supports some form of encryption; encryption technology limits connectivity scrambles messages sent over wireless networks so that they cannot be easily read. Pick the strongest form of encryption that works with the business’ wireless network.
10. Use the Junk Email Filter in Outlook: Since some spam can include potentially harmful viruses that can damage company’s computers and networks, set up the Junk Email Filter to reduce the amount of junk email to the In Box.

A combination of hardware and software security practices will help to reduce the risks and lessen the potential attacks to small businesses computers and networks. A business’ network and data are too important to be compromised.