Technology now makes it easy to access your information anywhere you go on a multitude of devices. Your credit cards are synced on your phone. Your bank account can be accessed through a small tablet or hand-held device. Everything is synced up and at your fingertips in a way that is both convenient and dangerous. Instead of a cyber-thief needing to access multiple accounts to have your information, they now only need to access one account. But there are ways to make yourself safe even, as you enjoy the new benefits of being linked at the touch of a button.

Device Management

One thing you can do for every single device you have is choose a different log in and password. You can allow each device to remember only your user ID, but do not allow the device to store your password. If you were to lose that device, or it gets stolen, you will want your accounts to be protected. Also, lock all devices with a secure password to the device itself. If it falls in the wrong hands you’ll know it’s protected. Do not access your account on untrusted networks. Thieves can pull information from these networks to access your accounts, and this includes seeing your passwords. Set up your devices and accounts so that each time any changes are made to your accounts you’ll be notified. If this includes sending an encrypted text message to your phone, then do that. This will let you know if anyone is trying to access your accounts. Securing your accounts through the deices themselves is your first step in protecting yourself from cyber thieves.

Cyber Protection

Next you’ll want to know that you’re protected once you’re online. The government and credit card companies have been working on this aspect of protection for years. The Web Service Security or WSS, was formed as an Web security standard. The way it works is that organizations that handle cardholder information (such as credit cards, prepaid cards, debit cards, and ATM cards) must live up the standards of protection. These were designed to reduce credit card fraud. This can include requiring entering captcha codes to ensure a human is accessing the account and not a remotely controlled computer. Or it may require you to have back-up security questions on your account. If the deice you use to access accounts is lost or in the hands of a thief, this is the next wall of defense for your identity.

Managing Accounts

You can manage these accounts on your own, or you can hire someone to keep track of them. The happy medium to both would be to install software that can keep track of how your devises and accounts are accessed and alert you to suspicious activity. The cost of the software is generally inexpensive, especially for the peace of mind you get with knowing you’re protected.

While technology makes things easier, it also makes us more vulnerable. Cyber thieves are smart and know how to hack into your accounts. You have to be smarter and protect yourself on every level from them.

Cloud, or more aptly, cloud computing has come a long way since 2006 when Google's Eric Schmidt popularised it for the first time while describing his company's approach to software-as-a-service or SaaS.

Today there is a whole new, or refurbished, industry worth $100 billion that has been built around cloud computing, touted as the next era of IT. On one side the hype around cloud is fading even as more and more enterprises are adopting it, on the other, there are some who have realised that not everything is as rosy as was idolised.

While early adopters such as Netflix and several others tasted success by making the first move to cloud, several others, especially from the enterprise community, ended up being disappointed because they achieved neither cost effectiveness nor less capital expenditure (capex), despite going for an operational expenditure (opex) model. There are several factors which led to such situations. Enterprises tend to oversee a lot of factors or end up making late realisations in terms of what to invest where. Let us see some of such unexpected cost, or hidden costs, which call for additional investment.

1. Opex need not be always the best

The first 'hidden cost' is incurred by believing cloud vendors who claim opex (operational expenditure), and not capex (capital expenditure), is the right way of doing business and that pay-per-usage is the way to go.

People should be careful when someone claims that capex is wrong and opex is the right way of doing IT budgets. Budgets should be a choice made by chief financial officer of an enterprise and not by any cloud vendor. If a company has lots of cash in hand, it can go for opex. Whereas, if a company buys it based on annual budget, such as those in the public sector, it will be difficult for them to finance opex.

If you have been repeatedly told that cost effectiveness is what cloud is all about, think again, because adoption of cloud from a cost perspective is not going to be cheaper option and there are several aspects that need to be considered so as to to optimise cost and other related aspects in an enterprise while on cloud.

In terms of SaaS, the hidden costs fall into three areas. The first is customization, the more you can use SaaS solution as it was designed the lower your costs. Customizations can quickly lead to development and maintenance costs you did not anticipate. This is the most widely made error by enterprises. It is more cost effective to teach your employees to use the SaaS as it is designed than to try to bend it to your processes. This isn't always possible but should be used as a rule of thumb. The second is integration. You will inevitably integrate SaaS services with in-house applications, data stores and other SaaS services. These integrations must be built, managed and maintained. Best practice is to define a clear integration architecture via as few means as possible.

The third area is sprawl because an enterprise buys SaaS for says 15 employees, but when it opens the same to 1,500 employees, suddenly $99 per user could be more than an in-house solution. On the other hand buying an application or product than renting one is as good as buying a house than going for the rent mode.

One can do an upfront investment on storage and network today and own that particular technology. Whereas, in an opex model where you pay a particular amount per month, instead of investing lakhs of rupees upfront in buying that particular technology, they do not own any software, but the data. And, still they have to go through service level agreements (SLAs), tax, interest, and other kind of costs and investment. So, even five years down the line, they do not own anything, which in turn could have resulted in spending more money.

In a high interest country like India, however, opex investment will be more suitable as it frees up capital, which in turn can be utilised for other projects.

2. Pay-as-you-go is not a magic

There are times when CIOs do not realise how much are they shelling since credit card is the usual mode of payment for cloud service.

In public cloud setting, the hidden cost are more related to the fact that usually CIOs are not aware how much of public cloud is being used, because they use company credit cards, which is also used by their developers who develop application on cloud. So, at the end of the day when you combine all these expenditures, the amount is quite significant. Moreover, CIOs do not realise how much will cloud resources cost because cost structure of these resources is quite complex. In cloud, computing, processing, storage, network bandwidth, all of these can add up as expenditure.

There are other aspects as well which can add to the extra costs, such as:
Not activating cloud economics. Not every application is a fit with a pay-per-use platform. The best fit are those that take advantage of the pricing model through either elastic scale or transiency. Elastic scale means the app increases or decreases its resource consumption based on use. Best fit are apps that do this as granularly as possible. Transient apps are those that are not active all the time and can be parked or completely shut off when not in use. Batch work, high performance computing, seasonal or cyclical applications are all good examples. An app that just sits there 24/7 consuming the same resources is usually a bad fit and should be moved either back into your data center or to traditional hosting.

3. Cloud is not just a technology, but also a service

The second 'hidden cost' could come in the guise of the misconception that cloud is first and foremost a technology, rather than a service. Enterprises thus tend to ignore investment required on people and processes in order to make them cloud ready. Technology is just one of the aspects and out of Gartner's 10 parameters of cloud requirements, it features as the eighth one.

Cloud is actually a service and not a technology. Cloud has other aspects like people and process. So when you are looking from a service' perspective, irrespective of whether it is a private, public, hybrid or multiple cloud, process is one of the most important thing which has to be in place.

The robustness and maturity of processes will decide how beneficial or viable cloud services can be to an enterprise. However, in the current scenario, robustness of enterprise processes is very low and in a bid to improve it they end up spending more.

In a scale of one to five, the maturity of processes in Indian enterprises is below two and Gartner believes that it should be at least three for cloud to be beneficial. So a lot of money goes in streamlining processes, implementing best practices, getting right certification, implementing basic stuff such as service portfolio or management or catalogue. And, it may also involve training people in the new processes, getting them certified, maintaining a new process management tool.

On the other hand, a cloud-ready employee will be a lot different from the traditional hardware management, or power and cooling management, or Java or .Net expert. Instead, all these will all be handled by a 'T-Shirt employee', who will do multiple things, including vendor management, SLA management, contract negotiation. So they need to be given additional training.

4. What to invest where

The third 'hidden cost' comes from the lack of transparency in IT budget allocation and understanding as to what enterprises have and what more do they seek from cloud.

In public cloud you do not have any upfront investment, whereas in private clouds you have. What you should understand is to what extent will the new product on cloud be more cost effective than what you currently have. The problem is that many companies do not have good understanding of exactly what costs what, and consumes what sort of resources in the company. Companies have annualised budget, but when it comes to allocation - in terms of which applications are costly, which are the businesses lines that rely a lot on IT resources - things turn out be difficult.

Cloud is also about scale, availability, and uptime; however, there is a hidden element in it, which is downtime. Even a one percent can turn out be a huge expense.

When looking at cloud solutions, there are a few factors that decision makers need to think about. Some of the big ones really concern availability (uptime) and security. Availability really refers to how much uptime the cloud provider will guarantee. Generally, top providers will guarantee almost 99 per cent availability, with 1% of downtime a year. This downtime can be due to external factors such as acts of God (natural disasters, power cuts). Decision makers need to assess the cost to their business of a potential downtime.

Journey to cloud is not a one-day affair. It needs a lot of preparations in terms of bandwidth, network capability, etc so that an enterprise is ready to do its job on cloud. And, this upfront investment is something that you would have not anticipated at the onset of the journey.

It is not very easy when you say you are going from an in-house solution to a cloud based solution. If you are going to move to a cloud-based solution you may have to do a lot of investments that you may call the upfront investments. You may have to increase bandwidth, improve networking capabilities, standardise certain technologies, platforms, buy products such as cloud platform or cloud management solutions, integrate several new systems that may not be so easy to integrate, work with service providers or system integrators who will negotiate on your behalf with multiple cloud. So there is a lot of cost involved in it.

5. Security comes at a cost

Cloud vendors harp a lot on how secure data will be on cloud as against a traditional environment. However, if you are not aware of what security means in different contexts then you are up for surprises. And that makes for our fourth 'hidden cost'.

This is especially true in countries where data protection legislation needs to meet certain criteria. For example in Europe, data protection requires that personal and sensitive data be stored in a highly-secure manner. Other countries typically have less stringent regulatory requirements, so European decision makers need to be sure that they do not fall foul of European compliance by storing data abroad. If a breach occurs, or compliance is not met, companies could face serious fines. In the UK for example, both the Financial Services Authority and the Information Commissioners Office can levy substantial fines for data protection breach. This could cost decision makers a lot of money.

6. Public cloud is not always cheap: Keep a limit

The eighth hidden cost come out of the myth that public cloud is cheap. Things as simple as not turning off systems on cloud, opening up applications for large number of users and several other factors determine the cost to a large extent.

People tend to believe so because most of the time, users are not good at math and the rest of the time they do not maximise the use of cloud resources. In certain cases they create a server on a public cloud and when they are done with, instead of deleting it just leave it as it is and thus keep paying for it even though they are no longer using it. Sometimes, they use a server which is too big for what they are doing.

On the cloud platform front, services tend to have a pay-per-use model that can be positively be affected by application behavior rather than use pattern. Thus the hidden costs to avoid are not turning things off. It is easy to see how pay per use makes your start-up costs low and elastic scaling as traffic rises easy. However, it is just as easy to not pay attention to application use/load patterns when they go the other way. This is where you can save tremendous money, by turning off resources that are no longer needed. Another aspect is that storage grows, and it never shrinks. On a pay-per-use service you are constantly reminded of this, which means you need to actively manage your storage consumption by moving data to lower cost services when they are no longer in constant use, leveraging caching as much as possible and deleting files or copies of files if you don't need them.

7. Not everybody is a cloud provider

Today anyone and everyone is a cloud provider. So it is all the more important to keep vigil and not to fall into the traps of some bogus vendor. This is our last and ninth 'hidden cost'.

It is important to consider the viability of a certain provider. Megaupload is a good example. Although not strictly speaking a cloud provider, it did provide cyberlocker services. It's spectacular shutdown by law enforcement last year put many small businesses in trouble. Unable to access their files, many lost business sales and revenue. The cost of having to go to court and get the data released is heavy, and may not always be successful.

So as we saw there are a lots of ways in which CIOs can be taken unawares when it comes to cloud and its associated cost. However, that does not mean that cloud is not good, just keep in the mind that there is lot more to it, than just what vendors try to project, and what meets the eyes or ears.

We try to uncomplicate the answer to this key question by elaborating on the key features you must not compromise on while purchasing a UTM (Unified Threat Management), how a UTM can benefit an SME in the long run, and also how security maintenance and licensing requirements get simplified through its use.

Unified Threat Management as the name suggests is for those who want a one stop solution for ease of management. This gateway level security solution comprises of features like anti-spam, anti-virus, intrusion detection/prevention, firewall, bandwidth management, VPN, centralised management and reporting. With multiple vendors offering UTM solutions in addition to open source options, there is increasing affinity among vendors to provide product differentiation by adding new features to their product line.

Below we have listed down some must-have features keeping the future of IT security in mind:

Fast processing speed

Most of the UTM vendors sell their product as appliance, a combination of optimized software and hardware. Now with too much pressure on these gateway devices as they have to inspect every packet that goes through them, UTM appliance itself can become performance bottleneck. To enhance performance of appliance vendors are going for multi core processors and utilizing this multicore capability by developing multi threaded UTM operating system.

Gigabit throughput

Though we are still far away from time when we would use Gigabit Internet, it would be better to invest in infrastructure that is capable to handling such speeds as these purchases are not made every year.

User level authentication

Though IP and MAC based filtering in firewall is still common with concepts like BYOD along with addition of new computing devices (smart phones and tablets) into organizational environment providing fool proof security based on IP and MAC is becoming difficult and at times impossible. Here is a brief story of what our IT team highlighted while testing pilot NComputing deployment. As single machine with single IP is shared by multiple users in NComputing IP based firewall became irrelevant. To overcome these very practical issues it is recommended to go for UTM device capable of authenticating user than IP/MAC.

Application Firewall

Application firewalls are capable of blocking particular application and leaving others, this is yet another must have feature in your UTM. Now there are number of P2P applications that are bugging network admins for years, with application firewall blocking them is quite simple, on similar lines other applications with high perceived risk can be better managed with this feature.

Support for both IPSec and SSL VPN

Secure connection to remote location is must these days as increasing number of people prefer working from home to better manage their private life without hampering their professional one. VPN has been technology of choice to enable this very setup, therefore next time when you go for UTM make sure that it supports both client based IPSec and non client based SSL VPN. With increasing popularity of SSL VPN having this feature is must for future usability.

Support for 3G/4G and WAN failover

To give additional Internet failover functionality besides the existing inbuilt WAN failover mechanism, UTM these days also support wireless Internet technologies like 3G/4G etc. Having this additional failover mechanism in place means almost zero downtime even if wired network is down, just plug in 3G capable dongle into your UTM and have additional piece of mind.

How a UTM Simplifies Security Management

There has always been a debate between Unified Threat Management vs the best-of-breed approach. Traditionally, organisations use a point solution to protect themselves against each type of threat. Such standalone, or “best-of-breed”, security strategy often consumes huge amounts of money, resource and management time. Disparate security devices and operating systems come with multiple maintenance and support contracts, multiple upgrade and replacement schedules, multiple licensing obligations, multiple training programs and management resources. All of these add to the cost and complexity of an organisation's security infrastructure, and can have serious negative impact on up-time, availability and performance.

Since firms are now realizing the disadvantages, they are migrating to consolidated security platforms or UTM devices to reduce network complexity and switch Capex to Opex.

How a UTM Scores Over Traditional Security Solutions

UTM technology has several advantages including ease of deployment, use and management; flexibility (the ability to turn on whatever security functionality you need whenever you need it); and high ROI (a single UTM appliance is typically way more cost-effective than several standalone solutions). The fact that the various security functionalities within a UTM appliance is produced by one vendor typically also means better integration and coverage between these technologies. SMEs have been more keen to adopt UTM solutions than large enterprises but the situation has changed significantly in the last few years. With better education and awareness of integrated threat technologies, enterprises now realize that UTMs are not rudimentary or “short-cut” solutions targeting small organizations with few IT resources. More of them now understand that today's advanced UTMs perform better than single-point solutions, and can cover the gaps left unattended by traditional standalone solutions.

While some SMEs in India are still content to just have software protecting their organisations, they need to realise that these do not offer the performance of UTMs and are not able to cover the full spectrum of threats that UTMs can tackle.

The Case for UTMs in SMEs

For SMEs, there are no factors discouraging them from embracing UTMs per se once the benefits are properly explained to them. Some smaller enterprises, however, have significant constraints on technology budgets - some of them still think of IT as an expense rather than an investment. Thankfully, this psyche of small organizations is changing and those adopting IT solutions are embracing solutions that provide cost benefits to them, and UTMs are definitely such devices in the security category. The commoditization of network security is also helping SMEs in this regard. Rather than investing heavily on network security solutions, smaller firms can now have a subscription based model to implement network security on their premises through a managed service provider.

This has allowed organizations to have their IT spend on an Opex rather than Capex model. Going forward, we expect such managed services to become more readily available, thus giving more SMBs the ability to access the same levels of security traditionally enjoyed by large enterprises.

Traditionally, organisations use a point solution to protect themselves against each type of threat. Such standalone, or “best-of-breed”, security strategy often consumes huge amounts of money, resource and management time. Disparate security devices and operating systems come with multiple maintenance and support contracts, multiple upgrade and replacement schedules, multiple licensing obligations, multiple training programs and management resources. All of these add to the cost and complexity of an organisation's security infrastructure, and can have serious negative impact on up-time, availability and performance. Since firms are now realizing the disadvantages, they are migrating to consolidated security platforms or UTM devices to reduce network complexity and switch Capex to Opex.

How to Get the Most Out of Google Docs to Improve your Business Efficiency.

In the past, co-workers shared documents by emailing them to each other. This often resulted in a great deal of confusion, with different versions of each document flying around, changes mysteriously appearing on documents with no indication of who had made them, and people from different mailing lists accidentally getting copied on important documents.

By introducing the suite of online productivity applications that together make up Google docs, Google has made some of these problems a thing of the past. Let’s look at it in more detail.

Basic Features of Google docs:

1. System requirements:

Google Docs is compatible with Internet Explorer version 6 or greater, Firefox version 1.07 or higher (but not Firefox 3) and Safari 3.1 or higher. In addition, you must enable JavaScript and cookies to use the applications.

2. Access:

To access Google Docs, you need to create a Google account. Google accounts are free. All you need is a valid e-mail address — and the willingness to agree to Google’s terms of service — to create one. If you've signed up for Gmail, you already have a Google account.

3. Compatibility:

With an account, users can either create a new document, spreadsheet or presentation, or upload an existing file to the system. Google Docs is compatible with the following file formats:

• Comma Separated Value files (.csv)
• Hypertext markup language (HTML) files
• Microsoft Word, PowerPoint and Excel files (.doc, .ppt or .pps, and .xls, respectively)
• OpenDocument Text and Spreadsheet formats (.odt and .ods, respectively)
• Rich text format (.rtf)
• StarOffice documents (.sxw)
• Text files (.txt)

4. Ownership:

You become the owner of any file you create or import into Google Docs. Owners can edit and delete files and invite collaborators and viewers. Collaborators can edit and export files. The owner can also choose to give collaborators the ability to invite other collaborators into a project. Viewers can look at files and export them, but aren't allowed to make edits.

5. Organization:

The organizational approach for Google Docs is a simple file-and-folder system. You can create folders and subfolders for all your files. Google provides you multiple ways to sort data, including alphabetically or by the latest updates.

6. Storage:

Google Docs users get a lot of storage space with their accounts, but it’s not unlimited. Each account can have up to:

• 5,000 documents of up to 500 kilobytes each
• 1,000 spreadsheets of up to 1 megabyte each
• 5,000 presentations of up to 10 megabytes each

7. Using Google Docs:

1. Multiple people can view and edit a Google Docs file simultaneously. More importantly, they don’t have to worry about creating duplicate copies of the same file.
2. With Google Docs, everyone working on a project makes changes to the same master document. As users make edits, Google Docs tracks all the changes and tags each edit with the responsible Google account holder’s name. That way, the owner of the document can scan changes and see who is responsible for each edit.
3. Google designed Google Docs to autosave almost constantly, preserving each edit shortly after a user makes it. Other users see the updated changes instantly.
4. While working with documents or presentations, users can see who else is in the file.
5. And with spreadsheets, users can click on a tab labeled “discuss” to chat in real time about the project.

Exciting New Features:

1. Google Gears:

This allows users to edit documents offline. Once you reconnect to the Internet, Google Docs automatically syncs the offline copy of your document with the master copy stored in the Google account. If another user has made edits to one of the sections you’ve changed, your changes won’t be implemented. Instead, Google alerts you to the issue and gives you the opportunity to compare your changes against the other user’s edits. If you still want your changes to go into the file, you can copy and paste them into the document.

2. Google Finance:

This allows you to retrieve information about a publicly-traded company. Users enter a company’s stock ticker symbol and request a specific piece of information about that company. The information updates as market conditions change, though the data can lag up to 20 minutes behind actual conditions.

3. Google Lookup:

This is another spreadsheet feature. Let’s say you’re building a table that compares the population of different cities. With the Google Lookup feature, you’d enter a formula, signify the city you are interested in and ask for the attribute “population.” The Google search engine looks for that information and retrieves it. If there are multiple answers for a particular attribute, Google presents all of them to you so that you can determine which one is right for your needs.

As with all Cloud Computing, security is the biggest concern of many users. Google assures users that all data is password-protected and kept private, and also inaccessible to the spiders sent out by Search Engines. Users also retain all ownership rights to their materials.

In conclusion then, Google Docs make the virtual office a reality, as well as allowing greater levels of collaboration, improving efficiency, and saving time, effort and money. Sounds like enough reason to try managing your next project online?

In today’s business environment, collaboration and communication may hold the key to increased productivity and business growth. Google is said to have created a secure, reliable, cloud based computing environment with collaboration technology that can’t be matched by other systems today – let’s look at some of the facts.

Google Apps is a service from Google providing independently customisable versions of several Google products under a custom domain name.

It features several Web applications with similar functionality to traditional office suites – but it runs in a web browser, without requiring users to buy or install software. Users can simply log in to the service to access their files and the tools to manipulate them. The offerings include

• communication tools (Gmail, Google Talk, and Google Calendar)
• productivity tools (Google Docs: text files, spreadsheets, and presentations)
• a customizable start page (iGoogle)
• Google Sites (to develop web pages).

What’s good about Google Apps?

The notion of providing software as services rather than as products offers several key benefits:

• One of the most attractive features is that Google apps requires no hardware or software, and needs minimal administration, creating tremendous time and cost savings for businesses.
• Each user gets 25 GB for email storage, 50 times more than the industry average, so you can keep important messages and find them instantly with built-in Google search.
• 99.9% uptime reliability guarantee with synchronous replication – your data and activity in Gmail, Google Calendar, Google Docs and Google Sites is simultaneously preserved in multiple secure data centers
• Because Google stores all of the files and content centrally, document management becomes far simpler than when distributing files to multiple people and keeping track of different versions.
• Sharing content is as simple as granting someone access, which facilitates collaboration without having to transfer files or worry about software compatibility. It allows students and instructors to forget about the tools and focus on creative ways to use technology in their disciplines.
• Google Sites provides a simple tool for groups to collaborate on developing web pages or whole websites. When a file is complete, it can be “published,” which gives it a unique URL, or it can be exported.

Is there a downside?

The greatest concern about Google Apps and similar services is security.

• Because access rights are shared across the service, users rely to some extent on how carefully others protect their login credentials.
• Given concerns about long-term availability, security, and privacy, storing files on non-institutional servers is a deal-breaker for some colleges and universities.
• For users, the menus and tools may not be consistent from one application to another, and applications running over the web do not work as smoothly and predictably as those running locally.
• Users who find themselves without an Internet connection cannot access the applications or their files.

The Standard and Premier Editions:

Google Apps is free only in the Standard Edition, while you would pay about $50 per user per year to use the Premier Edition. So what does this extra payment get you?

Well, the Premier Edition allows Unlimited User Accounts per organization (as opposed to a cap of 50 in the Standard Edition), and also gives you the use of Google Video and Google Groups. It also offers 25GB email storage per user (only 8GB in the Standard Edition), plus BlackBerry and Microsoft Outlook interoperability, better Business Controls, and 24/7 Support.

The bottom line is that any application is only as good as the way in which it is used – that’s where companies like eSites can customize Google Apps to meet your technical, branding and business requirements, while integrating Google Apps to your existing IT infrastructure.

We couldn’t resist the opportunity to put that in!

Cloud computing is Internet-based computing, whereby shared resources, software, and information are provided to computers and other devices on demand.

Cloud computing represents a major change in how we store information and run applications. Instead of hosting apps and data on an individual desktop computer, everything is hosted in the “cloud”—an assemblage of computers and servers accessed via the Internet. Users can access applications via a browser, while the applications as well as the data are installed and stored on a server.

Clouds often appear as single points of access for all consumers’ computing needs. The major cloud service providers include Microsoft, Salesforce, HP, IBM, Amazon and Google.

End – User Advantages of Cloud Computing:

• Lower computer costs: Since web-based applications run in the cloud, your desktop PC doesn’t need the processing power or hard disk space demanded by traditional desktop software.
• Improved performance: Computers in a cloud computing system boot and run faster because they have fewer programs and processes loaded into memory.
• Reduced software costs: Instead of purchasing expensive software applications, you can get most of what you need for free. This alone may be justification for switching to cloud applications.
• Instant software updates: When you access a web-based application, you get the latest version automatically every time you log in to the cloud – without needing to pay for or download an upgrade.
• Improved document format compatibility: You don’t have to worry about the documents you create on your machine being compatible with other users’ operating systems – all documents created by web-based applications can be read by any other user accessing that application.
• Unlimited storage capacity: Cloud computing offers virtually limitless storage. Your computer’s current 200 gigabyte hard drive is peanuts compared to the hundreds of petabytes (a million gigabytes) available in the cloud. Whatever you need to store, you can.
• Increased data reliability: Unlike desktop computing, in which a hard disk crash can destroy all your valuable data, a computer crashing in the cloud shouldn’t affect the storage of your data.
• Universal document access: Ever get home from work and realize that you left an important document at the office? With cloud computing your documents stay in the cloud, and you can access them instantly wherever you have a computer and an Internet connection.
• Latest version availability: When you edit a document at home, that edited version is what you see when you access the document at work.
• Easier group collaboration: To many users, this is one of the most important features—multiple users can collaborate easily on documents and projects. Because the documents are hosted in the cloud, not on individual computers, all you need is a computer with an Internet connection, and you’re collaborating.
• Device independence: Finally, here’s the ultimate advantage: You’re no longer tethered to a single computer or network. Change computers, and your existing applications and documents follow you through the cloud. Move to a portable device, and your apps and docs are still available – they stay the same no matter what computer or other device you’re using.

Key Operating Features:

• Cost – is greatly reduced and capital expenditure is converted to operational expenditure, which lowers barriers to entry.
• Multi-tenancy – enables sharing of resources and costs across a large pool of users thus allowing for:
1. Centralization of infrastructure
2. Peak-load capacity increases
3. Utilization and efficiency improvements for systems
• Reliability - is improved if multiple redundant sites are used, which makes well designed cloud computing suitable for business continuity and disaster recovery.
• Agility – improves with users’ ability to rapidly and inexpensively re-provision technological infrastructure resources.
• Scalability – via dynamic (“on-demand”) provisioning of resources on a self-service basis. One of the most important new methods for overcoming performance bottlenecks for a large class of applications is data parallel programming on a distributed data grid.
• Security – is often as good as or better than under traditional systems, in part because providers are able to devote resources to solving security issues that many customers cannot afford.
• Maintenance – cloud computing applications are easier to maintain, since they don’t have to be installed on each user’s computer. They are easier to support and to improve since changes reach the clients instantly.
• Metering – cloud computing resources usage should be measurable and should be metered per client and application on a daily, weekly, monthly, and annual basis. This will enable clients to choose the vendor cloud on cost and reliability.

So it’s pretty clear that cloud computing will be the way of the future. It frees you from the tyranny of desktop computing and opens up new forms of group collaboration, adding to mobility, flexibility and ease of use in an increasingly global workplace. Stay connected, folks!

An ATM that you get money out of should be as secure as a bank vault, but just like that ATM has to be filled up everyday by someone - your network can become vulnerable from someone on the inside or outside of the network.

Systems used to be like ATM's - you give the right code and the ATM gave you the cash, then hackers got to them and the security had to be strengthened to the point where hackers now needed an inside man. Guess what, the inside man came in the the form of email phishing scams targeting unknowing consumers to give up the code and then out comes the cash.

Then to give regular firewalls a real workout are blended threats - viruses, worms, trojans, root kits, and other hacks. Running a successful business adds to your responsibilities - more employees, larger networks, larger databases, and possible teleworker VPN options - definitely a job for an appliance that can handle blended threats.

The sights are now on us...

Let's look first at the changes in the SME network security environment and how blended threats have started to trickle down to us little guys. Multinational and large enterprise networks have always fought blended threats - spyware prevention, root kit attacks, spam blocking, intrusion prevention and URL filtering are what the big boys IT departments are using on a daily basis at the gateway to the Internet. Most of the time the IT guy is able to hold back the unknown threats with layered security - yes I said unknown threats. Each one of the threats we know about today became infamous once the damage was done or the attack was blocked to a degree where the loss was not significant. These threats began as unknowns.

And that's the good news, when the big boys trigger technological innovations, the little people always get a taste. The difference is that when an unknown threat attacks our firewall, hopefully we all have some form of security - right, the damages and loss can be catastrophic. But all businesses in the small and medium environments can't have a separate IT department that handles security, storage, compliance and the money to handle downtime due to lost productivity and data. All businesses of any size are looking for ways to effectively prevent attacks right at the perimeter before it reaches the desktop.

Prevent Your SME Network From Looking Like an ATM

Blended threats have met their match when it comes to Unified Threat Management (UTM) devices, our much larger brethren were tired of buying a new security solution every time a new threat popped up it's ugly head threatening the network. Their budgets may look unlimited but the bean counters began complaining about the bleeding edge of security even if they could afford the attacks. Integrated security appliances help answer both IT and CFO's dreams by incorporating everything blended threats can throw at a network - blocking viruses, worms, spyware, trojans, and other attacks without relying on signatures. Signatures are needed based partly on the effectiveness of 'intelligent layered security' and host intrusion detection. Threats are met at the perimeter or rejected by layered security that intelligently adapts to threats before it hits the internal network. This is just a small unified threat management overview to touch upon how it acts as intrusion detection and intrusion prevention devices in one box.

If you think your business is already secure enough and doesn't need a UTM, a combined intrusion detection and prevention appliance, then maybe when the unknown threats attack your network it will keep them away from the desktops in your office. I hope you can sleep well...because your network can never go to sleep.

Juicy Assets, Ripe For Picking...

So here's an interesting spin on de-perimeterisation (removing the boundary between the internal network and the internet)... if people think we cannot achieve this and cannot wait for secure operating systems, protocols and environments but need to "secure" their environments today, I have a simple question supported by a simple equation for illustration:

For the majority of mobile and internal users in a typical company who use the same basic set of applications:

1. Assume a company that:...fits within the 90% of those who still inhouse servers and isn't completely outsourced and supports a users who use Microsoft OS and the usual suspect applications on fat clients and laptops.
   
   
2. Take the following:
   Data Breaches. Lost Laptops. Non-sanitized corporate hard drives on eBay. Malware. Non-compliant configurations. Patching woes. Device Failures. Remote Backup issues. Endpoint Security Software Sprawl. Skyrocketing security/compliance costs. Lost Customer Confidence. Fines. Lost Revenue. Reduced budget.
   
   
3. Combine With:
   Cheap Bandwidth. Lots of types of bandwidth/access modalities. Centralized Applications and Data. Any Web-enabled Computing Platform. SSL VPN. Virtualization. Centralized Encryption. Lots of choices to provide thin-client/streaming desktop capability. Offline-capable Web Apps.
   
   
4. Shake Well, Re-allocate Funding, Streamline Operations and "Security"...
   
   
5. And, Ta Da, You Get...:
   Less Risk. Less Cost. Better Control Over Data. More "Secure" Operations. Better Resilience. Assurance of Information. Simplified Operations. Easier Backup. One Version of the Truth (data.)
   
   

Why? Can Someone Tell Me Why?

I really just don't get it why we continue to deploy and are support platforms we can't protect, allow our data to inhabit islands we can't control and at the same time admit the inevitability of disaster while continuing to spend our money on solutions that can't possibly solve the problems.

Until the operating systems are more secure, the data can self-protect and networks to "self-defend," why do we continue to focus on the fat client PCs which are a waste of time.

If we can isolate and reduce the number of ways of access to data and use dumb platforms to do it, why aren't we?

...I mean besides the fact that an entire industry has been leeching off this mess for decades...

I'll Gladly Pay You For Solution Today...

The technology exists TODAY to centralize our most important assets and allow our workforce to accomplish their goals and business to function better without the need for data to actually "leave" the servers in whose security we have already invested so much money.

Many people are doing that with their servers already with the adoption of virtualization. Now they need to do with their clients.

The only reason we're now going absolutely stupid and spending money on securing endpoints in their current state is because we're CAUSING not just allowing data to leave our enclaves. In fact with all this BlaBla 2.0 hype, we've convinced ourselves that we must. Utter Hogwash.

Relax, Keep Your Firewalls On...

In the case of centralized computing and streamed desktops to dumb/thin clients, the security perimeter still includes our servers and security castles, but also encapsulates a streamed, virtualized, encrypted, and authenticated thin-client session bubble. Instead of worrying about the endpoint, that's nothing more than a flickering display with a keyboard/mouse.

Let your kid use Limewire. Let Uncle Bob surf www. Let wifey download spyware. If my data and applications don't live on the machine and all the clicks/mouseys are just screen updates, what do I care?

Yup, you can still use a screen scraper or a camera phone to use data inappropriately, but this is where balancing risk comes into play. Let's keep the discussion within the 80% of reasonable factored arguments. We'll never eliminate 100% and we don't have to in order to be successful.

Sure, there are exceptions and corner cases where data does need to leave our embrace, but we can eliminate an entire class of problem if we take advantage of what we have today and stop this endpoint madness.

This goes for internal corporate users who are chained to their desks and not just mobile users. Oh, and did I forget to mention the hugely reduced cost of ownership...

What's preventing you from doing this today?

Cyber-crime has become more sophisticated, but there are ways to harden your company's defenses. Businesses are being confronted by a new breed of profit-hungry cyber criminals, focused on accessing confidential data and intellectual property for financial gain. Cyber-crime is no longer an issue of showmanship, perpetrated by hackers keen to disrupt information systems. It has become a serious business and today's cyber-criminals have become exceedingly efficient in their plans to access and exploit business critical information.

More feared than terrorism

The recent Hydraq attacks highlight the targeted nature of today's threats, designed specifically to steal confidential information. According to a recent report into worldwide cyber-crime trends, 60% of identities exposed in 2009 were compromised by hacking attacks. In addition, according to a broad study of large organisations, 90% of Australian and New Zealand enterprises have fallen victim to cyber attacks in the last year.

Enterprises are very aware of the risks of cyber-crime with 43% of Australian and New Zealand (ANZ) organisations rating it as their top business concern. This threat was ranked higher than natural disasters, terrorism and traditional crime combined.

Protecting business critical information from cyber-criminals is complicated due to a number of factors. Firstly, the pace of information growth is accelerating, IT infrastructures are expanding and new computing platforms are being adopted. At the same time, the workforce is becoming more mobile. Employees are accessing and sharing company information at home and on the road, leaving companies more vulnerable to the risk of data loss. It is clear that, in this environment, security professionals have more to manage than ever before.

A simple three-point plan

To protect themselves effectively, businesses now require a focus on security continuity that allows them to continuously respond to internal and external changes.

First, businesses need to take a risk-based and policy-driven approach to security. Information growth continues to expand exponentially. It would be too costly and inefficient to try and secure everything, so businesses should focus on their critical data and assets only. Today's attacks by cyber-criminals and insiders alike often take advantage of weak IT policies that expose information. Companies need more comprehensive and effective policies to control who and what has access to information and infrastructure.

Second, companies should take an information-centric approach to security. Businesses need to know where their important information assets are and who has access to them. And if a company doesn't have a good handle on where their important information is, then they are at risk. It is not only important to know where your information is; you must also make sure that the right things happen as that information flows both within the company, and to and from the company.

Finally, companies need to operationalize their infrastructure management through standardization, workflow and automation. A well-managed infrastructure will ultimately result in a better-protected infrastructure and a safer online working environment.

Protecting key vulnerabilities

Research has shown that cyber-criminals are targeting four key areas of weakness that are putting business environments at risk: poorly-enforced IT policies, poorly-protected information, poorly-managed systems, and poorly-protected infrastructure.

So how can businesses manage the four key areas of weakness and focus on protection that matters? The following tips provide a good starting point.

• Develop and enforce IT policies, and automate risk management and compliance processes. By prioritising risks and defining policies that span across every location, businesses can enforce policies through built-in automation and workflow, and not only identify threats but re-mediate incidents as they occur or anticipate them before they even happen.
  
• Protect information proactively by taking an information-centric approach to protect both information and interactions. It's not enough to know where the information resides - you need to know how it moves and who has access to it so you can protect it. Taking a content-aware approach to protecting your information is key in knowing where your sensitive information resides, who has access, and how it is coming in or leaving your company.
  
  
• Manage systems efficiently. Systems management needs to make an organisation's life easier through standardization, workflow and automation. These are things that can be put in place to make security software do the heavy-lifting on everything from patch management to regulatory audits.
  
  
• Protect the infrastructure and respond to threats rapidly. Companies need visibility into their systems so they can manage them properly and ultimately protect against emerging threats.
  

As the latest report into worldwide cyber-crime trends amply demonstrates, the threat landscape continued to evolve in 2009, with significant growth in both the volume and sophistication of cyber crime attacks targeted at enterprises. The good news is that targeted attacks can be defeated. By taking precautions against the four areas of weakness, organisations can significantly bolster their defences against targeted attacks and defeat the new face of cybercrime.

From the earliest of days, Man has learnt well to defend his assets. But how is this history lesson going to help you secure your servers and ultimately protect your valuable data? Well, we are going to make them as impregnable as the castles of old. Taking a lesson from history's pages though, it seems wiser and more efficient to prevent a loss than to attempt to recover from an attack. Prevention is better than cure.

Sun Tzu, The Art of War
"The art of war teaches us to rely not on the likelihood of the enemy's not coming, but on our own readiness to receive him; not on the chance of his not attacking, but rather on the fact that we have made our position unassailable."

Get Ready for the Intruder

Security is not about simply investing in equipment; it's about putting in a security life cycle that's driven by your business needs. Believe it or not, but your organization could be miles away from being secure even if you have a firewall in place. Conversely, you could have already achieved a high degree of security, even without a firewall. In short, securing an organization requires much more than a firewall. It requires a complete understanding of the security life cycle and how to deploy it.

Most business owners often tend to misinterpret the function of security. Securing an organization does not mean disconnecting all networks and powering down the systems. It is about securing the organization, while enabling it to continue doing its business.

Hence, this involves the human factor, and the machine factor. We address the first by laying down policies, educating users, implementing the policies and finally conducting audits. The second part is addressed using proper tools, both hardware and software, and procedures.

The Human Factor

The organization provides the business needs based on which the access restrictions/rights are defined. So, whether Internet access and e-mail facility are required or not and to what extent, whether remote connection should be allowed on the network, are all driven by business needs. Based on these, a security policy document is created. This doesn't have to be a large and detailed document, so long as it contains the specific areas you would want to address.

Once the policy is put in place, you will want to focus on education, processes, tools, audit and review. Most organizations underestimate the need for user training and education. The best of firewalls and tools can't provide as much security as a well-educated user would. So, spend the resources and time on educating your end users and senior management.

Turn the security policy into actionable items, which is taken care of by the processes section. These include standard operating procedures (SOP) - which detail what is to be done in what situations - and, acceptable usage policies (AUP) which are like do's and don't for various sections of the security policy.

Auditing is a mechanism of ensuring that all stated needs in the policy are indeed implemented. Once again an audit of tools deployed is as critical as the audit of process deployment. If the policy requires installation of anti-virus on every computer in the company, then leaving out the MD's (or any other) computer will dilute all possible efforts to secure your organization.

The Machine Factor

Security breach can happen from either inside or outside your network. Outside threats can come in either through your Internet gateway or e-mail. Inside threats can be from a disgruntled employee or an imposter gaining access to a vulnerable system-the imposter could be a human being or a malicious code like a worm or Trojan that infects an unpatched system. Given the sources of threats, you need to consider four aspects when implementing network security.

1. Firewalls. To protect your network from threats coming from the Internet.
2. Systems management. To eliminate vulnerabilities from servers, desktops and networking hardware such as firewalls and routers.
3. Anti-virus/anti-spam. To protect all systems from viruses and threats entering through spam.
4. Intrusion-detection System (IDS). To do timely detection of suspicious activity on your network.

Physical Security

Security starts within. But, to understand the last level of security (that is physical security) lets suppose: Tom Cruise of Mission Impossible 2 comes inside your server room suspended from the roof. Then opens up you machine's cabinet and takes out or short the battery in your motherboard and sets your BIOS password to default. And then sets the boot devise priority to CD-ROM. After that he boots up the machine with a standard Knoppix CD, mounts your partitions and copies all the important data into a USB pen drive and goes away with his chopper. So now what you will do? And the answer is very simple. After all the effort you have taken for securing your machine over the network.

It is also very important to keep a very tight watch on the physical security of your servers. Well, the concept is quite away from the scope of this article but still you should have security guards and keys and locks at the door of your server room and don't leave any room at the roof top so that Tom Cruise can not climb down from there and hack into your server.

To Summarize

Having a sound IT policy for your enterprise goes a long way to minimizing if not eliminating the risks. Grounding these policies with a good implementation firms up the confidence that your infrastructure will be safe and your data secure for a reasonably long time.

After all, it is not necessary to get a virus attack to lose all your data... You need a little bit of everything - some preventive, some cleaners, some disaster management, a little protective storage-in our management recipe for an optimistic synergy between both technology and requirements.

The total cost of survival does always outweigh the cost of ownership or operation. And that's the way the cookie crumbles!

A thin client (sometimes also called a lean client) is a client computer or client software in client-server architecture networks which depends primarily on the central server for processing activities, and mainly focuses on conveying input and output between the user and the remote server. In contrast, a thick or fat client does as much processing as possible and passes only data for communications and storage to the server.

Thus , thin client computing is a server-centric computing model in which the application software, data, and CPU power resides on a network server rather than on the client computer.

A thin client is a network computer without a hard disk drive, which is designed to be especially small so that it does most of its processing on a central server with as little hardware and software as possible at the user's location, and as much as possible at some centralized managed site. Usually, the embedded OS in a thin client is stored in a "flash drive" or in a Disk on Module (DOM). The embedded OS in a thin client usually uses some kind of write filter so that the OS and its configuration cannot been changed but by Administrators.

Advantages of thin clients

Obviously, boot image control is much simpler when only thin clients are used – typically a single boot image can accommodate a very wide range of user needs, and be managed centrally, resulting in:

• Lower IT admin costs. Thin clients are managed almost entirely at the server. The hardware has fewer points of failure and the local environment is highly restricted (and often stateless), providing protection from malware.
• Easier to secure. Thin clients can be designed so that no application data ever resides on the client (it is entirely rendered), centralizing malware protection and minimising the risks of physical data theft.
• Lower hardware costs. Thin client hardware is generally cheaper because it does not contain a disk, application memory, or a powerful processor. They also generally have a longer period before requiring an upgrade or becoming obsolete. The total hardware requirements for a thin client system (including both servers and clients) are usually much lower compared to a system with fat clients. One reason for this is that the hardware is better utilized. A CPU in a fat workstation is idle most of the time. With thin clients, memory can be shared. If several users are running the same application, it only needs to be loaded into RAM once with a central server. With fat clients, each workstation must have its own copy of the program in memory.
• Lower Energy Consumption. Dedicated thin client hardware has much lower energy consumption than thick client PCs. This not only reduces energy costs but may mean that in some cases air-conditioning systems are not required or need not be upgraded which can be a significant cost saving and contribute to achieving energy saving targets.
• Easier hardware failure management. If a thin client fails, a replacement can simply be swapped in while the client is repaired; the user is not inconvenienced because their data is not on the client.
• Worthless to most thieves. Thin client hardware, whether dedicated or simply older hardware that has been repurposed via cascading, is useless outside a client-server environment. Burglars interested in computer equipment have a much harder time fencing thin client hardware (and it is less valuable).
• Hostile Environments. Most devices have no moving parts so can be used in dusty environments without the worry of PC fans clogging up and overheating and burning out the PC.
• Less network bandwidth. Since terminal servers typically reside on the same high-speed network backbone as file servers, most network traffic is confined to the server room. In a fat client environment if you open a 10MB document that's 10MB transferred from the file server to your PC. When you save it that's another 10MB from your PC to the server. When you print it the same happens again – another 10MB over the network to your print server and then 10MB onward to the printer. This is highly inefficient. In a thin client environment only mouse movements, keystrokes and screen updates are transmitted from/to the end user. Over efficient protocols such as ICA or NX this can consume as little as 5 kbit/s bandwidth.
• More efficient use of resources. A typical thick-client will be specified to cope with the maximum load the user needs, which can be inefficient at times when it is not utilised. In contrast, thin clients only use the exact amount of resources required by the current task – in a large network, there is a good probability the load from each user will fluctuate in a different cycle to that of another user (i.e. the peaks of one will more than likely correspond, time-wise, to the troughs of another.
• Simple hardware upgrade path. If the peak resource usage is above a pre-defined limit, it is a relatively simple process to add another rack to a blade server (be it power, processing, storage), boosting resources to exactly the amount required. The existing units can be continued in service alongside the new, whereas a thick client model requires an entire desktop unit be replaced, resulting in down-time for the user, and the problem of disposing of the old unit.
• Lower noise. The aforementioned removal of fans reduces the noise produced by the unit. This can create a more pleasant working environment.
• Less Wasted Hardware. Computer hardware is very environmentally damaging. Thin clients can remain in service longer and ultimately produce less surplus computer hardware than an equivalent thick client installation.