For Wright Elementary School District, a three-school K–8 district in Santa Rosa, Calif., security in the cloud is just as important as it is for larger school districts. Wright Elementary made its first foray into the public cloud about two years ago, using it for e-mail and calendars via Google.
Christopher Moghtaderi, district technology coordinator, says to ease security concerns, the IT department deployed Panda Security’s Cloud Office Protection to secure the district’s 160 PCs and notebooks, along with the Google calendar app and Gmail they use daily. The Panda cloud application offers antimalware protection, a personal firewall and remote management capabilities.
“We have a set of notebooks that our staff can take offsite, and we noticed that they weren’t getting security updates. When they were returned to campus, there were viruses and other problems,” Moghtaderi says. “We wanted something that could manage all of those systems remotely while dealing with our cloud applications.”
Moghtaderi also likes that he can manage all 160 systems from one location instead of having to travel to the three district schools.
“If there is a specific problem, I can start a remote session and troubleshoot if the software can’t resolve the issue,” he says. “And I know that the security is always up to date.”
That peace of mind gives Moghtaderi the confidence to explore the school district’s next step into cloud computing: online grading software. “We’re just in the beginning stages, but I’m going to focus on password security with cloud-based apps like that,” he says.
For any organization with software, infrastructure or platforms in the cloud, it’s critical to identify threats and vulnerabilities in real time so they can be acted on and resolved quickly, says Renell Dixon, a managing director at PricewaterhouseCoopers, a global consultancy firm.
“When you’re talking about the cloud, the window of opportunity between the time a threat is located and the time you are fully protected is very small,” she says. “It’s important to put something in place that manages that process in real time by continuously monitoring and fixing problems as they occur.”
Noe Arzate, director of technology at Mount Pleasant Independent School District in Mount Pleasant, Texas, takes a different approach to cloud security. His first cloud project started about two years ago, when the district implemented a private cloud powered by Stoneware's webNetwork. WebNetwork lets organizations create and manage their own private cloud, in which users can access applications and services from anywhere. The system allows teachers at Mount Pleasant ISD to access courses and class rosters, assign projects and communicate with students via a browser on any smartphone, tablet, PC or notebook. Students also can access the system.
The percentage of IT security executives polled who think cloud infrastructure environments are as secure as on-premises data centers
SOURCE: Ponemon Institute, October 2011
From the beginning, Arzate hasn’t been too concerned about security because the cloud is private. However, he does use Trend Micro Deep Security to monitor activity on the district’s servers as well as its externally facing cloud resources.
Eventually, Arzate expects that the district will move to some public-cloud applications, and when that occurs, he says the district will increase its use of cloud-based security tools.
“We’re considering replacing our current collaboration system with Microsoft Office 365, which is cloud-based,” he says. “That means we’ll be using the public cloud, but we’ll be ready for it.”
Cloud Security: Help Is on the Way
Security is the biggest reason organizations hold back from moving to public-cloud services. In response, several of the most prominent security manufacturers have released products to ease these concerns.
One category is cloud-based e-mail security. Products such as Symantec.cloud and Panda Cloud Email Protection offer virus and spam protection, along with content and image control. Symantec also offers a product that delivers instant messaging protection in the cloud.
Cloud-based security for the web is another major category, with offerings that include Trend Micro’s SecureCloud, McAfee Cloud Security, Panda Cloud Office Protection and M86 Secure Web Service Hybrid. These services block malware and spyware and offer policy control and user authentication.
Providers also offer cloud-based security services that deliver continuous-monitoring trend analysis.
“It’s about identifying threats and vulnerabilities and acting on them quickly to prevent problems people are concerned about, like identity theft, denial of service and data loss,” explains Renell Dixon of PricewaterhouseCoopers.