How to securely web enable access to CIFS / SMB File Shares

One of the predominant use cases that many companies have is to enable file access to SMB file shares that live behind the corporate firewall , or indeed  are hosted on IaaS infrastructures (such as Amazon FSX or Azure Files), without the need for a VPN and without reconfiguring permissions whilst using Active Directory or LDAP for authentication and also ensuring that data is secure and compliance legislation is satisfied.

This has of course become even more of a requisite during the recent Covid-19 pandemic in which there is a pressing need to enabled. such access for remote workers.

Global storage Metamodel

Accessing files over CIFS/SMB network over VPN using a mobile network is possible but access can be patchy, clients apps limited and it is often extremely slow.

The File Fabric enables this using its built in CIFS / SMB connector. This blog post will step through how to web enable SMB file shares.

Continue reading “How to securely web enable access to CIFS / SMB File Shares”

Facebooktwitterredditpinterestlinkedinmailby feather

Solving the ‘Working From Home With Large Files Problem’

lockdown workingThe shift from working from an office to working from home / remotely due to the pandemic looks like it is here to stay for many companies, even post pandemic. End users have had to cope with moving from being always connected via a high speed line to SMB shares to working across consumer broadband from B2B2C file services. Prospects and customers have helped us create a pretty clear picture of the problems this has caused them and below we outline the top three things that we have been told:

Continue reading “Solving the ‘Working From Home With Large Files Problem’”

Facebooktwitterredditpinterestlinkedinmailby feather

Using WinSCP to sync data to Amazon S3, Azure Blob and other Storage clouds over SFTP

winscpAs pre sales engineers there are often times when we need to enable a prospect or customer to connect to the Enterprise File Fabric based on their specific infrastructure and requirements, often impacted by security and architectural topologies.

Recently I had to enable a customer to be able to synchronise local data from a windows server. Normally I would install the File Fabric’s sync app for Windows but there was a security requirement that meant no new software could be installed on this server, it was locked down.

Continue reading “Using WinSCP to sync data to Amazon S3, Azure Blob and other Storage clouds over SFTP”

Facebooktwitterredditpinterestlinkedinmailby feather

Enterprise File Fabric Case Study – Service Provider: Storing Sensitive Data in The Cloud

S&M Cloud, part of the multinational S&M Services and Systems Group, provides cloud services to the world’s leading companies. Their challenge was to support their customers, medical organizations in particular, moving large amounts of personal and sensitive data to cloud storage. An earlier system was not reliable, and difficult to manage.

Continue reading “Enterprise File Fabric Case Study – Service Provider: Storing Sensitive Data in The Cloud”

Facebooktwitterredditpinterestlinkedinmailby feather

How to Enable Remote Employees to Securely Access On-premises Company Data in Under 1 Hour

Interest in letting employees to work from home has never been higher and will remain high even after the Covid-19 virus has run its course.  For Companies large and small  the key challenge is how to make Company data available remotely in a way that is easy for employees to use without compromising on information security.  The Enterprise File Fabric™ offers an unmatched set of features to support secure remote working.  In this post we’ll see how to set up the File Fabric in less than an hour to provide secure remote access to on-premises data, be that SMB, NAS / SAN or Microsoft DFS shares.  The best part is that data is not copied or removed anywhere, it remains in the same secure place and the File Fabric provides web scale secure access  to it .

Continue reading “How to Enable Remote Employees to Securely Access On-premises Company Data in Under 1 Hour”

Facebooktwitterredditpinterestlinkedinmailby feather

Getting started using the Enterprise File Fabric with BlockChain for Secure Governance and Compliance of Company Files

The purpose of this post is to outline how the Enterprise File Fabric can be used with a BlockChain HyperLedger solution to provide guaranteed non tamper audit reports for the corporate file estate.

Blockchain is a distributed databased for maintaining records (called blocks) in which the data in the block cannot be altered retrospectively.  HyperLedger is one of a number of projects that use blockchain at its core and is a specification for how a trusted network should work. In this example we use Fabric but there are others such as Sawtooth Lake, Corda R3 and Iroha.

The Enterprise File Fabric provides a unified multi-cloud content repository for all company data, whether stored on-cloud or on-premises. The solution supports over 60s storage endpoints including object storage such Amazon S3, IBM COS, Google Storage, Microsoft Azure, as well as traditional on-premises storage such as Windows Filers, NAS / SAN, and other more common storage solutions such as Box, DropBox, Office 365 etc.

Continue reading “Getting started using the Enterprise File Fabric with BlockChain for Secure Governance and Compliance of Company Files”

Facebooktwitterredditpinterestlinkedinmailby feather

Cloud Computing Use Case: Working with Amazon S3 data from a terminal over SFTP

We quite often assume that when working with Cloud data it will be from the web or from mobile “on the go” devices. To be fair this can often be the majority of cases, but the Enterprise throws up all sorts of different use cases and I thought it would be useful to go over one of the more esoteric ones.

One of the customers that use the Storage Made Easy on-premise Enterprise File Share and Sync Cloud Control product is a medical company. They use the SME product as a hybrid on-premise cloud product that is able to offer storage locally and on Amazon S3. Both sets of storage use the Amazon S3 API. The SME Appliance is able to make local storage accessible over an S3 compatible API and then off-board this storage to Amazon S3 as required. This meant that the companies scripts and applications could easily work locally and with Amazon S3 with very minimal configuration changes.

Hybrid Cloud S3 API

Their field staff quite often find themselves in a situation where, when working remotely, their only means of access is using a terminal ie. there is no direct web access and mobile devices are blocked and cannot be turned on.  In the past this meant that the consultant used to carry around CD’s / DVD’s in which information that may be required is burned off.

The consultants did however have direct  access to terminals which were internet enabled.   As the SME EFSS product also include a protocol gateway this mean it was possible to get direct terminal access to remote files using SFTP.

Cloud Storage SFTP

 

As the SME EFSS Gateway product integrated with the companies Active Directory services then terminal access was still using Single Sign On and the Active Directory credentials for each user access

User access can be obtained directly from the command line as per the example below..

Mac sftp google drive

Once authenticated the user can do a simple “ls” to get a file listing.

Mac SFTP

Once connected the view of the folder/files is available and can be worked with via the command line.

Mac SFTP S3

All access to the files are also logged and audited, including the username, the IP address and the types of interactions occurring, all part of a the HIPPA compliant process the customer implements. These reports can be exported and made available in excel to any compliance officer.

Summary:

Secure access to files and data can take many forms and in the Enterprise the edge cases also need to be catered for as well as the more common access use cases.

 

Facebooktwitterredditpinterestlinkedinmailby feather

In a post PRISM world why your Company needs joined up File Sharing and Governance

The recent controversy with regards to Prism and data snooping has brought the security of corporate data to the fore however the biggest threat to corporate data lies not with the corporate nemesis that is Prism but with the number of data leaks that occur every day in companies.

These include new phenomena such as Bring Your Own Device (BYOD) and Bring your Own Cloud (BYOC) as well as the thorny issue of what files are shared over email.

Data is any companies biggest asset and not controlling how corporate data is disseminated is a ticking time bomb waiting to explode in your company. Why? Take your pick, Legislative reasons, fraudulent reason, competitive reasons. There are many reasons why not controlling data dissemination could trip your company up.

Companies need to consider how to build an Effective data governance serves ACROSS their enterprise data silos. Doing so will define a cohesive set of parameters for data management, data usage, as well as the ability to create governance processes for a companies internal use, and for their supply chain, which ultimately leads to information assets that are well managed.

SME Data Governance framework

In the world of Cloud it is key that Data Governance and data policies work not only with data behind the corporate firewall but also cloud data and cloud services.

So what should you consider as a company to manage your data assets ?

1. Understand what information is sensitive across all data silos, have a federate access control mechanism that works with your user across this private and cloud data silos. Storage Made Easy provides such a federate mechanism to assign and control user permissions and access at a very granular level that overlays one or more data stores.

SME federate permissions

2. Set policies for data access and enforce them through common tools. For employee sharing of data through tools such as email, make it easy but also set policies that can define expiry time and password protection. Storage Made Easy has plug in’s for Microsoft Outlook and Mac Mail that enables productive file sharing across all cloud / private data but which has built in support for policy enforcement.

Mac Mail large file sharing

These policies should also ripple through to the mobile Applications used in a company:

iOS secure file sharing

3. Use Cloud Encryption for sensitive data and ensure that you control the private key. See our previous post on encryption and securing data for further information.

Cloud File Encryption

4. Audit all your company data. Irrespective of the policies set you should get in the habit of auditing your company data. SME enables the setup of an automated email to a specified user of the previous day file events such as sharing, files updated etc.

Cloud Storage Audit Log

5. Set BYOD policies and device access policies that work like your company works. For example, have a contract firm that you gave access to a specific folder ? Then designate that they can only access the folder using a web browser and only from a specific IP address.

BYOD GEO Restrictions

Summary

Companies need to connect disconnected information to enable corporate governance.

Cloud Corporate Governance

Facebooktwitterredditpinterestlinkedinmailby feather

How to encrypt, secure and access sensitive cloud storage data

**Updated 1st July 2016*

The recent PRISM Data snooping controversies have heightened almost every companies awareness of the potential vulnerabilities of data stored off-premise in the Cloud. Many Cloud Storage companies’ talk about encrypting data ‘at rest’ but the real issue is that the storage companies control the encryption rather than the company whose data is stored controlling the private key.

One of the features that Storage Made Easy provides is an encryption feature that can encrypt data uploaded to remote (and local) Cloud Storage. SME supports 50+ cloud storage vendors, which means companies are able to take advantage of private key encryption for some, or all data, across cloud storage providers.

For individual users of our cloud SaaS services SME  uses a key entered by a user to encrypt data, but  the key is not stored on the SME hosted service. If the key is lost, or forgotten, then when trying to subsequently access the file the user will not be able to gain access to the file as the correct key phrase will not be known.

For companies that use the SME SaaS hosted service team Admins specify a key that uses a similar mechanism but is applied to all users. Unlike the personal encryption the key phrase is either stored encrypted by the SME service, or it can be stored with a self hosted Vault instance.

For enterprise users who self-host the SME service then the key is can be stored on the service behind the corporate firewall or again it could use the open source Vault software on a key server.

Encryption file SME

SME uses AES-256 encryption using the Rijndael cipher, with Cipher Block Chaining (CBC) where the block size is 16 bytes. A random initialisation vector is generated when the user supplies an encryption key. The cipher Rijndael consists of:

– an initial Round Key addition
– Nr-1Rounds
– a final round.

The chaining variable goes into the “input” and the message block goes into the “Cipher Key. The likelihood of recovering a file that has been encrypted using our encryption is fairly remote. The most efficient key-recovery attack for Rijndael is exhaustive key search. The expected effort of exhaustive key search depends on the length of the Cipher Key and for a 16-byte key, 2127 applications of Rijndael.

Data_SecurityOnce files are encrypted in this manner they can be accessed by an of the comprehensive SME desktop (Web, Mac, Windows, Linux) or mobile tools (Windows Phone, iOS, Android, BlackBerry). When an encrypted file is accessed the user is prompted to provide the private key phrase before the file can be opened.

Encrypted file phone

 

If the file is accessed direct from the underlying storage then it will not be able to be used as it will be encrypted and without being opened via the SME service, either hosted or on-premises, it will not be able to be un-encrypted. This makes sensitive data stored on remote servers ultra-secure.

The SME also on-premises Cloud Control service resides behind the corporate firewall. It enables the ability to keep very sensitive data behind the corporate firewall but still enable secure file sharing and at the same time offers the ability to encrypt data that is stored on remote cloud storage and other SaaS services for additional security.

SME Encryption

The Storage Made Easy Cloud Encryption service is available to all SME users inclusive of free, Personal Cloud, Business Cloud and Enterprise Cloud

Facebooktwitterredditpinterestlinkedinmailby feather