|
security in the cloud
how is your data kept secure in the cloud?
This information summarises ThinkGrid's security policies with regard to how we protect your data and keep it safe. Cloud computing offers numerous advantages when compared to storing data locally in an office. Many of these revolve around physical and electronic security, as well as backup and disaster recovery.
Physical Security
ThinkGrid utilizes Tier 3 & 4 data centers. Data centers are chosen both for network peering and also for physical security and redundancy options. ThinkGrid only uses data center vendors with ISO 27001 certification for physical security. Access must be restricted and controlled, typically with proximity card or biometrics.
Data Resilience
ThinkGrid uses purely diskless processing engines, ensuring all data is centrally stored on a Storage Area Network (SAN). Storage Area Networks offer much greater resilience than traditional hard drives because they store (stripe) data access multiple drives in a SAN shelf for resilience and speed. Typically, the SANs used by ThinkGrid have between 20 and 240 live drives. Centralized storage is also much easier to secure and protect.
As a policy, ThinkGrid also copies (replicates) its Storage Area Network data to an alternate data center in the same country. This equates to having an offsite and real time copy of any data stored in the primary site. In the case of a total failure of a data center or Storage Area Network - which is very unlikely - ThinkGrid can quickly recover data and provide it to customers, or restore to alternative systems (default policy).
Electronic Access to Services
All of ThinkGrid’s access points to services are encrypted through the use of SSL (secure socket layer) at least 128-bit encryptions. This provides encryption for all data which is being sent to and from ThinkGrid’s network, such as email, desktop data and passwords etc. For desktops a connection broker is used to provide encryption through RSA RC4 for key strokes and screen data. Customers may also request VPN (virtual private network) access to a collection of services such as Hosted Desktops. This is a cost option, but can be provided with PPTP or Cisco VPN with a permanent point to point tunnel or dial-up VPN.
Electronic Intrusion Detection and Logging
To protect data and security, ThinkGrid uses a TripWire intrusion detection system (IDS). IDS is used to log and look for unusual network and user behaviour within the ThinkGrid internal network. IDS is deployed on both internal and external networks and has a number of automatic triggers to alert engineers to unusual behaviour and to isolate potential problems. ThinkGrid employs a policy to log user access to any of the services.
PCI Compliance
ThinkGrid is recognised as a PCI compliant organisation and insists on regular checks from McAfee. A copy of the latest report can be requested.
Data Ownership
ThinkGrid ensures security and privacy of your data by being accredited with the Data Protection Agency registration number Z7879408. We comply with the principles of the Data Protection Act 1998 and the Privacy and Electronic Communications (EC Directive) Regulations 2003. The eight principles relating to the processing of personal information are:
Fairly and lawfully processed
Processed for a limited time
Adequate, relevant & not excessive
Accurate
Not kept longer than necessary
Processed in accordance with your rights
Secure
Not transferred to countries without adequate protection
Your privacy and security is of utmost importance to us. We will always follow these principles and ask you how you would like us (or our partners) to communicate with you. The Information Commissioner regulates compliance with the Data Protection Act. The information may also be provided to security or credit checking companies, public authorities if required by them, or as required by law.
Customer Data
You can be confident that your data is safe and will always be available to you and only you, reducing business risk. Our managed service protects you from the ever changing threat of viruses and loss of data. We take full responsibility for ensuring that proper security measures are in place to protect your data. Customers have access to their own private data at any time, with which they can copy, backup and store copies themselves if required. None of the data is stored in proprietary format.
Data Ownership
At all times the data stored within ThinkGrid’s services is the property of the customer.
In the case of service termination, the data can be provided to the customer on DVD or other portable digital media, subject to a chargeable support service fee. This data will only be kept for a maximum of 7 days while it is filtered out of the backup archives.
|
United Kingdom
Ireland
Australia
