Like so many of you out there, I upgraded my Apple device to iOS 5 recently, and with that I found that I could get a free email account in the iCloud, an @me.com email address. My immediate response was to go “heck yeah!” and sign up for it. I did, added it to my other devices, and only then did I stop to think for a moment about what I did. That made five, yes, that’s right, FIVE email accounts that my phone would check every so many minutes to interrupt my day with yet another notification that I must check to see what someone sent me. That’s now FIVE email accounts I have to worry about filtering for spam, and securing with unique usernames and passwords, and that I will have to search through when, six months after reading an email and remembering only vaguely what it was about, need to find it again.

But wait, there’s more. How many instant messaging accounts do you have? I have one on each of the main public services. Since my Gmail account is already in the five above, that means I have a Yahoo, a Hotmail, and an AIM account that are capable of receiving email. I also have LinkedIn, and Facebook; each of those is a place that I can receive email, though they don’t have email addresses associated directly with them. I own a few different domains that I’ve registered through Google, so each of those comes with a Google Apps email whether I use it or not. So now I am up to fourteen different mailboxes that I could actually use today. Who knows how many are out there that I haven’t thought about in years, whether on Gmail, or Hotmail, at college, or in various other systems. And I’m pretty sure I have an email address on my personal cell phone, my work cell phone, and as a part of my Internet connection from my ISP.

So I ask myself and you, gentle reader, this very serious question… How many mailboxes do you really need?

This question is distinctly different from how many email addresses to you really need. With aliases, purpose built addresses, addresses you want to use to register for a service and hope to never need again, and all the various distribution lists you might want to have, you might need tens or dozens of email addresses.

What I want to know is how many mailboxes does someone really need, where a mailbox should be considered as something on a distinct system, requiring a distinct set of credentials, and that you will check on a (semi-)regular basis. It can be a web-mail, or POP3, or IMAP system, or something more enterprise targeted like an Exchange or Notes system. Please, leave a comment and let me know how many you have – you can leave as much or as little detail as you wish, but please give me at least the number of personal, and of professional mailboxes you have.

There is more to this post than just an attempt at justifying the ridiculous number of mailboxes that I have by trying to see how many of you are just as bad; I want you to consider whether or not any of those mailboxes you have left out there in the world might be:

a)      A resource drain on someone’s system

b)      A treasure trove of lost information

c)       A security risk.

If you think any of those might be the case, I encourage you to go clean them up. My own homework for this week is to do just that – clean up and close mailboxes that I can get rid of, review the messages that are in there to see if anything is worth keeping, and to forward messages from any that I need to keep in service to a “live” mailbox so that I am more aware of what might be hitting them, like requests to confirm things, password resets to other services; you get the idea.

It’s Time to Stop the Madness

Free ebook download: Top 10 Most Popular Troubleshooting Posts for Email Administrators

Back in May of 2011, the Exchange Team Blog announced that Exchange 2010 SP2 would be coming in the second half of 2011. Now that we are firmly within that second half, SP2 should be just around the corner, and now’s the time for you to start getting ready for the inevitable testing and pre-deployment work that will come with this service pack release. What’s that, you say? Testing? Pre-deployment work? This isn’t just a Windows Update deployed patch? Hardly! Any service pack to any operating system or server is a major event, and the deployment of this service pack will be a major undertaking for every company running Exchange 2010, from the single server installs to the largest of organisations.

And why would anyone want to take on a service pack? Well long-term supportability comes to mind; so does ensuring you are up to date with the latest patches, bug fixes, and security enhancements. But if that is not enough, check out this impressive list of features* that SP2 will be bringing to Exchange 2010.

1. Outlook Web App Mini
   This will be a browser based version of OWA designed for phones that are web-capable, but not as “smart” as Windows, Droids, or Apple iPhones. It will be largely text based, and provide access to mail and the GAL.
2. Silent cross-site redirection for OWA
   This will make the task of redirecting OWA clients to another site silent (no user prompt) and will also support SSO. The short is that you can have a single OWA URL that you publish for your users, even if you have OWA implementations distributed geographically, and your users can all use the same URL.
3. Hybrid Configuration Wizard
   The cloud is where it’s at, and Exchange coexistence is a great solution for many organisations looking at Office 365 or other hosted solutions. The wizard will take 40+ manual steps to deploy this, and condense them down to 6.
4. Address book policies
   Companies that need to segment their address books into geographic, organizational, or other grouping will be able to do so, which is both more efficient, and more secure.
5. All of the patches that have been included in the various roll ups (1-4.)

*subject to change

Now that you know why you will want to deploy SP2, it’s time to consider the how. One of the most significant things to be aware of, and to plan for, is that this will require schema updates to your Active Directory. Yes, that’s right; you will need to extend the schema to support SP2. With year-end activities approaching, and the sorts of enterprise wide change windows that tend to close at this time of year, you might want to get the schema extension change request submitted now so that you can apply it as soon as the bits are released so you can spend time testing SP2 before the end of the year.

Knowing that SP2’s release is coming, and that it will need schema updates, let’s you start planning now for how you will deploy this in your environment. If any of the features being added will address urgent business needs, you will want to have time allotted in December for testing and deployment. If not, you can wait until January. Whatever the case may be, now you know.

Get ready for Exchange 2010 SP2

Free ebook download: Top 10 Most Popular Troubleshooting Posts for Email Administrators

You’d have to have spent the last two years of your professional career living under a rock to have not come across “the cloud”. The cloud – this; the cloud – that; the cloud, the cloud, the cloud… Cloud computing promises to be the next sea change in information technology, as more and more Somethings as a Service (*aaS) hit the market, with every player from Microsoft and Google all the way down to JoeBob’s Hosting trying to get in on the action.

Email services look to be the most common, some of the easiest to move to the cloud, and certainly of the most interest to readers of this blog. My colleagues Jeff Orloff and Paul Mah have both written some great articles around this topic already. Today, I want to talk about cloud based email services from a different point of view; that of the email admin who thinks the cloud will make his or her job go away.

There are all sorts of euphemisms for jobs coming to an end; downsizing, right sizing, smart sizing, outsourcing, off shoring, and many others. I’ve been involved in a few of these. Sometimes I was the last man standing, other times I was the rat leaving the sinking ship, and once I was the deer in the headlights who never believed it would happen to him. All of those situations sucked, and I don’t want to promise you that no one will lose their job because their company moved their email to the cloud. What I do want to do is help you realize that:

a)      Moving your company’s email to the cloud DOES NOT mean your company doesn’t need email admins. Your boss is a fool if they think they can get rid of the entire email team.

b)      If you are an in house Exchange shop today, you will want to keep some in house Exchange servers even after the cloud move is complete. It’s called hybrid mode, and it offers significant advantages to a company, and it means you still need email admins.

c)       Overworked shops might find the cloud to be just the relief they need.

d)      There are several new skillsets a company needs to have in-house to support a cloud based service. There are opportunities to take your skillset to the next level and be just as critical tomorrow as you are today.

e)      Cloud migrations can take months; sometimes more than a year. Sure, an SMB can move their email in a weekend to the cloud, but an enterprise with thousands of users and gigabytes of email will take much longer, starting with remediation.

Your company will still need email admins

Managing a cloud based service requires admins who can take care of user needs, client needs, provisioning, set up, backups and restores, and to be the contact between the users and the service provider. Cloud providers take care of the care and feeding for an email system, and are on the hook for BCP/DR, but they don’t talk to end users and they don’t provision accounts.

Hybrid mode

Keeping some Exchange servers on premise lets you move mailboxes from the cloud back to your own servers, which lets you keep access to the mailboxes of former employees without paying the monthly costs to keep that mailbox in the cloud. Some companies are deciding to move only the regular users to the cloud, while keeping key personnel and executives’ mailboxes on-prem…in essence outsourcing the basic users to free up space and resources while keeping the VIPs in house to provide more personal service. You may also find add-ons like archiving are better kept in-house, which means you need email servers (just not as many as before).

Taking some of the load off

Again, that hybrid model offers a lot to consider. Moving the regular users’ mailboxes to the cloud not only reduces the number of servers you need, it frees up the diskspace your power users need for their multi-gigabyte mailboxes. Cloud providers are great, but they are not, and never will be, able to offer the executives the personal hand holding they expect when they have problems, need their Crackberries reset, or can’t find that critical email. You may find yourself going home earlier, and not getting as many late night calls.

Skillsets

To keep a company’s email running smoothly during and after a migration to the cloud, you will need to understand licensing, cost models, federated services, vendor management, and can also polish up your customer support skills. In every large org I have ever dealt with, the vendor management folks are some of the highest paid in all of IT. Dealing with a cloud provider is not a bad way to break into that tax bracket. Plus, most email admins know some networking and AD stuff; both of which are important and might let you move to another team. Working on a cloud migration can make you very marketable to those who offer cloud based email services. Consider also the security aspects of using a cloud provider – security has been one of the top ten most sought after skills in IT since the late 90′s and cloud security is a hot topic you can get hands-on experience with as you go through a new migration.

Time

Even if none of the above appeal and you are convinced that your job is on the chopping block, there is no need to jump ship day one. Cloud migrations will take significantly longer than anyone expects until they get into the project planning. For the duration of that project, you are one of the most important persons in the room. Have an honest conversation with your management, knowing that you are in a position of power. They need you to make the migration successful, and you have every right to know whether you are targeted for a new role or not post migration. I have seen email admins get very generous severance packages in return for staying with a project.

Don’t automatically assume that the words “the cloud” are another euphemism for “time to job hunt”. Look at it from all angles, never underestimate your own importance to the project, and make the most of it. You can find that every cloud really does have a silver lining if you keep your wits about you.

Inside Every Cloud Is a Silver Lining

Free ebook download: Top 10 Most Popular Troubleshooting Posts for Email Administrators

One of the most common applications to move to the cloud is email. Quite frankly, most small and medium sized businesses choose to let a cloud provider host their email because:

• Email services are always up and running
• Email can be accessed from anywhere
• It is scalable – you can increase or decrease as needed
• It is affordable (you only pay for what you use)
• It frees up resources (IT staff) for other projects.

Although attractive, cloud based email solutions can’t be something an organization just jumps into without proper planning.

In order to successfully implement a cloud based email solution for your business you need to first ask why. The answer to your question should define what your company stands to gain from a successful cloud solution. Once you know why your email should be in the cloud, it is time to start looking at how to move forward with planning your move.

Best Practices

One of the most practical ways to plan a project is to take a look at what other organizations with similar goals have done in the past and apply those practices that worked for them, avoiding, or modify, the things that failed.

Regardless of your industry, there are a few best practices that can be considered universal and should be a part of any organization’s planning stage.

Find out what your employees need

One of the reasons why organizations move email services to the cloud is because they pay only for what they need. A cloud provider makes money from the services they are able to sell. Knowing exactly what is needed can help you avoid paying additional costs and can also help you purchase the solution you need. Some things to look for:

• What are the mailbox size requirements?
• What are your archiving requirements?
• What type of backup and recovery solution is needed?

Does your email integrate with other business applications?

CRM, finance, project management, web applications and many other software packages that are part of the business workflow process are dependent on email services. Before you work with a cloud provider, make sure everything will integrate seamlessly.

Analyze security requirements

If your business is subject to regulations like HIPPA or Sarbanes-Oxley, then it is important that any cloud solution you use for email has the capability and expertise on staff to keep your business in compliance. If they are unable to supply this guarantee then you should be looking to another service provider.

Determine what you will migrate

The amount of data in your email and calendar history will have an effect on how long your migration to cloud services takes, and ultimately how much it will cost. While most organizations want to avoid the issues of keeping one foot in your current solution and one foot in the cloud, it may be necessary.

It may be necessary to utilize a hybrid approach for a certain amount of time until your organization can move entirely to the cloud.

Test, test and test again

Before anything is completely moved to the cloud it is important that you test the waters. Having employees show up one day to find that their email services have completely changed is bad enough. Not knowing what complications and challenges they may run into can easily kill your credibility.

By setting up a valid testing environment you can see the effect moving your email services to the cloud will have on workers and your company’s workflow.

Have an exit strategy

No one wants to start a project with the assumption that it will fail but if you have been around IT long enough you should know that not everything goes according to plan. If this is the case with your cloud migration, you have to be ready to pull the plug.

Making the decision to kill a project is hard enough but dealing with the ramifications can be even worse. Understand what contractual obligations you have to your cloud provider in the event that you need to terminate the contract. Not only that, but have a plan in mind for how you will minimize any disruption of service should your cloud solution not work out.

Cloud Based Email, Best Practices for Before You Move

Free ebook download: Top 10 Most Popular Troubleshooting Posts for Email Administrators

You must have heard about Office 365 by now, the newly launched cloud service by Microsoft that offers Exchange Online and other Microsoft-hosted services such as SharePoint Online, Lync Online and Office Web Apps.  Before being dismayed however, Exchange administrators may want to first check out my arguments as to Why Office 365 is good for Exchange Administrators. In addition, those who have yet to explore Office 365 may want to take some time to read my earlier article on TheEmailAdmin titled A Closer Look at Exchange in Microsoft’s Office 365.

Despite its various merits however, I would caution companies to carefully consider their requirements and sign up for Office 365 based solely on their needs – and not be taken in by the hype.  But let’s assume for the moment that Microsoft’s Plan P with its 25GB of mailbox storage per user is a great fit for your small business, and you would like to shift your company’s Exchange onto Office 365.  Having made the transition to Plan P myself, I want to highlight some possible issues that you may encounter.

Transfer your domain to Microsoft

Businesses considering Plan P may be surprised to learn that it does not support the use of domain names in the same way that Gmail, its web-based email services competitor, does.  Google allows Gmail users to send out emails from multiple domains as long as they have been validated, which means that the Send field of your emails will show: yourname@yourcompany.com when sent from your Gmail-hosted account.  In Plan P however, businesses will have to transfer the entire domain name to Microsoft before they get the same result.  Failing to do so will see Plan P stuck to the default: yourname@yourcompany.onmicrosoft.com when sending out email from your Office 365 account – hardly something a business would want.

Depending on who currently hosts your domain name server and the kind of services hosted on your domain, this may represent a significant problem to some businesses.  This is compounded by the fact that existing companies would already have their own websites with their own hosting arrangements.  Finally, these websites may be running on PHP or other scripting languages not supported by Microsoft.  Thankfully, companies that already have their own web server for their corporate website have a relatively easy way out if they are willing to transfer their domain name hosting over to Microsoft.

The steps are:

1.  Transfer  your domain name to Microsoft (Admin: Management -> Domains -> Add a domain)
2. Use the DNS Manager and set the appropriate A record (www) back to your company’s web server

According to forum postings that I came across, this strange state of affairs came about because Microsoft did not consider Plan P businesses to require a “vanity” domain (yourcompany.com).  I have not tried Plan E yet, though it is my understanding that it does not compel the transfer of your domain name to Microsoft in this manner.

Configuring Plan P to host your own domain

As highlighted above, transferring their entire domain name hosting to Microsoft may not necessarily be an option for some businesses for various reasons.  For example, there may be a need to pipe emails through a spam filtering appliance or online service, or you may find Microsoft’s functional but rudimentary DNS manager (A and CNAME records only) inadequate for your needs.

Or like me, you may want to forward your emails through an archival service before channeling it into your inbox.  In this scenario, it is possible to forward your incoming messages to: yourname@yourcompany.onmicrosoft.com and still receive your mails.  When it comes to outgoing emails however, it would be more professional to have your email aliased as: yourname@yourcompany.com.  There is another way around it, though be warned that it is a more involved task than the earlier method.

The steps are:

1. Initiate the wizard to transfer your domain name to Microsoft (Just like above)
2. Stop the verification process before it is completed (Don’t click “Next”)
3. Change the email send address manually using PowerShell to update your Office 365 Exchange Server configuration

For the specific steps and PowerShell commands, IT Consultant Peter Meinl does an excellent job outlining the requisite steps his blog entry Changing the email send address in Office 365 without moving your domain.

Administrators new to PowerShell should be cautioned that it has some dependencies on additional software that you may need to install (the PowerShell installation will prompt you on them).  In a nutshell: Don’t expect a five minute procedure if doing it for the first time; factor in some time to install them.

Using Office 365 Plan P with your Company’s Domain Name

Free ebook download: Top 10 Most Popular Troubleshooting Posts for Email Administrators

When you don’t understand something that your job requires you to know, the most logical thing to do is research the topic and learn as much as you can about it. For many people who find security as part of their job description, learning as you go is the only option available. Yet despite the fact that there is so much information readily available to us, misconceptions regarding email security still confuse many professionals tasked with maintaining the confidentiality, integrity and availability of email services.

Blocking executable files will stop malware from being spread among users

Filtering all attachments that include .exe or .msi, was once a common way to keep users from sending infected files to one another through email. This is still considered by many to be a best practice for securing email systems, however as more tech savvy workers entered the workforce, they found ways around this. Generally, people will simply change the extension on a file and send it in an email attachment to a co-worker, friend, or family member. The recipient simply downloads the file and changes it back to the correct file extension. If that file has malware attached to it, the recipient will become infected when the file is opened and that could spread to other machines on your network.

Another scenario that dates this method of securing email, and is much more common, is when a user receives an email with a link in it. This link takes the user to a seemingly harmless website that is hosting drive-by downloads that install malware onto a computer when the person visits the site. No action on the part of the user is necessary other than clicking on the link.

Email security solutions need to address both of these scenarios in order to truly offer protection.

Attackers target large companies because that is where the rewards are greater

We often hear about how large financial institutions are hit by attackers where the number of users whose confidential information is stolen tops up to millions; or maybe it’s an attack against a huge government organization like the Oak Ridge National Lab attack that makes the headlines. At the same time, we almost never hear of a mom and pop store where the same thing happens. That’s because it’s not sensational. A small business being breached doesn’t warrant enough interest from the major networks but that doesn’t mean it never happens. It actually happens more frequently to small and medium sized enterprises than it does to the big corporations.

Large companies often have the budget to better secure email systems against attack where smaller companies often rely on security by obscurity as their solution and attackers know this. Whether they are looking for the lower hanging fruit, or simply trying to hone their skills, SMBs are frequent targets of email security attacks.

Finding security products that are geared towards SMBs is essential not only because they are affordable, but because they are tailored to the needs of these organizations.

Email encryption is only for healthcare and financial institutions.

It is true that these two industries are required by certain regulations to encrypt email messages, while other industries have nothing that says encryption is necessary it still is good practice to make sure your emails aren’t sent in plain text across the Internet.

There are many reasons why a smaller company would want to protect information sent via email. You could be sending confidential information about employees, details about an investigation, sensitive company financial data, strategies for growing your business… the list is endless. But no matter what the reason for keeping a lid on the contents of your message, if it is not encrypted then anyone with the know-how can capture and read these emails.

Email stored behind your firewall is more secure than email stored in the cloud

Cloud security is one of the most hotly debated topics when it comes to email security. Moving email services to the cloud will certainly take security and control out of your hands and put that responsibility on your cloud provider. But that doesn’t always have to be a bad thing.

If you research cloud providers and find one that takes security seriously and is open to answering questions about your email and data, then odds are their staff will be better able to handle security than a small IT department where the staff wears many different hats.

Cloud providers also have multiple data centers to handle back-up and recovery, as well as multiple layers of security.

Getting the right information when it comes to security can be rather difficult. There are many supposed “experts” who make a great deal of money selling snake oil to companies whether it is in the form of a security solution or education. The key is to read as much as you can and always look for the counterpoints when it comes to finding the best solution. If you spend enough time doing your homework up front, you will spend less time in the future dealing with mistakes.

Misconceptions About Email Security

Free ebook download: Top 10 Most Popular Troubleshooting Posts for Email Administrators

Microsoft’s newly launched Office 365 offers powerful, intuitive controls for businesses looking to deploy a cloud-hosted collaboration and messaging solution.  I was able to get my own trial account activated in just 10 minutes, faster than any hosted Exchange providers that I’m aware of.  In addition, the presence of a free 30-day trial means that businesses and individuals can experiment with – or even deploy – various components of the service without having to part with a single cent.

As I’ve explained in Why Office 365 is good for Exchange Administrators, Office 365 can actually help to bolster the popular of Exchange Server; enhancing the career prospects of experienced Exchange administrators in the long-term.  Moreover, many of the reasons to consider an on-premise deployment of Exchange Server remain just as relevant today.  This includes a greater choice of anti-spam and anti-malware solutions, heightened confidentiality, compliance, as well as increased backup and archival options.

Companies on the fence about deploying Exchange or new businesses lacking the budget for on-premise Exchange Server will definitely want to start off with Office 365.  Depending on individual requirements, businesses can migrate to a full-fledged Exchange Server at a later date.  To assist administrators who may be thinking of starting off their Exchange deployment on Office 365, I shall be exploring the capabilities of the various plans today with a specific focus on Exchange Server.

Office 365 for professionals and small businesses

Positioned towards professionals and small businesses, Plan P is touted as a plan that offers value-for-money.  It is easy to see its attraction when one considers its Exchange capabilities, as well as the presence of SharePoint Online and Office Web Apps.  The downside is lower levels of support: don’t bother calling Microsoft when you encounter any problems.  Moreover, note that Plan P has an upper limit of 50 user licenses, and does not support Active Directory Sync.(Though the Plan P product page says “fewer than 25 users”, it does not stop users from buying up to 50 user licenses).

According to the official FAQ, a company growing beyond 50 users will need to cancel their Plan P and manually switch to a Plan E. You heard it right; there is no automatic migration for businesses that outgrow Plan P.  Finally, do note that Plan P does not officially support what it calls “vanity” domain (yourname@yourdomain.com), but defaults instead to yourname@yourcompanyname.onmicrosoft.com.  There are a couple of workaround strategies fortunately, which I shall outline in my next article. And yes, Plan P includes premium antivirus and anti-spam filtering with Microsoft Forefront Online Protection for Exchange

Despite its shortcomings, its low price of US$6 per user per month makes Plan P a compelling offering indeed.  The Plan P1 trial includes 10 user licenses.  You can read more about Plan P here.

Office 365 for midsize businesses and enterprises

Plan E comes in various configurations that range from E1, E2, E3 to E4.  Priced at US$10, US$16, US$24 and US$27 per user per month, the various offerings under Plan E include the license rights to access on-premise deployment of Exchange Server, SharePoint Server and Lync Server – more about possible deployment scenarios another time.  E1 excludes online document viewing and editing capabilities with Office Web Apps, while E3 and E4 include the desktop edition of Office Professional Plus.  Do note that a trial is only available for Plan E3, which includes 25 user licenses.  You can read more about the various offerings under Plan E here.

Other Online Exchange options

Businesses that require only Exchange Server services will be interested in the “Kiosk Worker Plans” called K1 and K2.  Both plans offer 500MB of mailbox storage and are priced at just US$4 and US$10 respectively.  It is important to note that both plans offer the Outlook Web App as the only interface to standard Exchange services such as email, calendar, contacts and the company directory.  Microsoft Outlook is not supported, although POP access is. The slightly pricier K2 plan comes with the ability to make basic edits to documents with Office Web Apps.

Finally, administrators or individuals interested in Exchange Online-only plans may want to check out the various plans tucked away here.  Exchange Online is offered at just US$5 and US$10 per month and includes access via PC (Microsoft Outlook), Exchange ActiveSync (EAS) and Outlook Web App.  A final Exchange Online Kiosk plan mirrors the K1 plan by doing away with Outlook and EAS support (no contacts and company directory too) for a rock bottom price of just US$2 per user per month.

Have you given Exchange Online in Office 365 a spin yet?  Feel free to share your experiences.

A Closer Look at Exchange in Microsoft’s Office 365

Free ebook download: Top 10 Most Popular Troubleshooting Posts for Email Administrators

Developments in cloud based computing have shown quite a bit of excitement and promise, especially when it comes to small to medium sized businesses. Those who evangelize the cloud will often cite the many benefits of moving to a cloud based email service. The litany of favorable reasons to examine moving email services off site that are oft quoted fall into line with the reasons used to move to any new technology:

• Ease of scalability
• Ease of software updates
• Email access anywhere
• Better disaster recovery
• Ease of implementation
• And of course, reduced costs

So when a vendor, or even someone in your own organization, throw these at management looking to save money and increase productivity then it seems like the question moves from why should we move to the cloud? to why has it taken us so long to move our email to the cloud?

Is it really that easy?

Cloud based email services make a whole lot of sense for many organizations. By doing a bit of research, you are certain to find at least one case study on how moving your email to the cloud helped someone in your specific industry. Yet even with good reasons and plenty of research to support this decision, nothing should be done without considering every angle because over the years if we have learned one thing, when it comes to IT nothing is risk-free.

So what does an interested SMB need to consider when all the arrows point to moving to the cloud? Let’s take a look.

1. Control

When your email resides on servers that are housed at your location, you are responsible for configuring the software, maintaining the hardware, updating and patching the server(s), cooling the room, etc. But you also have complete control over your email and backups. Moving to the cloud means you are giving up control and possibly ownership. This lack of control can lead to real world problems. For instance, if your organization has a one year deletion policy, is your cloud provider able to adhere to that? Conversely, if you have a no delete policy can this be achieved as well?

A rarer occurrence, but one that has much harsher repercussions is the event that an investigation needs to take place. Will emails be available for forensics when needed? If so, will there be any issues with the chain of custody and proving that the investigation was tamper proof?

2. Availability

Unless you have been living under a rock you are well aware of the attacks against Gmail over the recent months. The decision to move email services to a cloud provider should always be based on how well the provider can ensure that mail servers will deliver an acceptable percentage of uptime. Of course it’s one thing to say that you guarantee 99.9999 percent uptime and quite another to deliver so when a cloud provider makes a claim regarding availability, make sure your IT team speaks with the sales engineers, not just the salesperson, to see what exactly is in place to eliminate things like interruptions and denial of service attacks.

3. Security and Spam Protection

One of the biggest draws to the cloud for email is the fact that the provider will take care of security and anti-spam. Again, this is something that you are entrusting to the provider and giving up control over. If you are unhappy with the amount of spam that gets by the filters, or if the false positive rate is higher than an acceptable rate you can’t simply switch to a different solution.

This should be at the forefront of any discussions you have with potential email service providers. Find out what solutions they have in place and research them just as if you were buying the protection for your own servers.

4. Cost

Of course cost is always the number one reason SMBs look to the cloud. It is hard to find anyone who will say that a cloud based solution isn’t less expensive in the long run than running, securing and maintaining your own email servers. However the numbers may not always equal the level of service you expect. Costs may not always be transparent. A cloud provider may charge extra for business grade anti-spam protection. Perimeter security or virus scanning may also require additional costs. Finally, storage is never a one size fits all solution so this will always present itself as a variable.

The cloud is definitely a solution worth looking into for a number of reasons, however as a smart business move it would be equally prudent to look at all of the considerations as well prior to signing any type of contract.

4 Considerations for Cloud Based Email

Free ebook download: Top 10 Most Popular Troubleshooting Posts for Email Administrators

With another round of issues facing users of Microsoft’s Exchange Online service the launch of the Business Professional Online Services replacement, Office 365, is starting to face questions by consumers who are starting to think that Microsoft’s cloud based services may not have much of a silver lining.

Exchange Online is a hosted messaging solution, like Google’s Gmail for businesses, and is based on the same technologies that run the ever popular Exchange server. However as this is a hosted solution, the business does not need to dedicate the same resources towards messaging as they would if they were running their own email servers on-site. Since messages are stored in the cloud, Exchange Online users have “From virtually-anywhere” access to e-mail. Also touted by Microsoft’s website is:

• Improved email security
• Enhanced operations efficiency for a company’s IT staff
• 25-gigabyte mailbox storage size for the standard license

Most importantly, users who have become reliant on Microsoft Outlook and its tools can find the move to hosted email seamless unlike the issues that arise when using Outlook with other hosted email services.

What seems to be the problem?

In early May, most BPOS users experienced loss of service for up to nine hours one day followed by sporadic outages over the next couple of days. Without email services, many businesses found their productivity crippled.

Ironically, email services hosted in Microsoft’s beta offering of Office 365 were not affected by the outages and service here did not have any of the issues that BPOS had. However the timing of these recent problems couldn’t be any worse.

Microsoft’s reputation is still tarnished by the problems associated with Windows Vista and Internet Explorer is often thought of as an inferior product when compared to competitors, so making headlines once again due to service related issues is not the best thing when launching a new product. Even if the product addresses the problems you are infamous for.

Is there light at the end of the tunnel?

Most people understand that there is no such thing as 100 percent uptime when it comes to technology. Ask Gmail users if their service is always up. Things are bound to fail at times. And to Microsoft’s credit they responded to the problems quickly, provided users with a temporary workaround to restore service and they identified the root cause of the issue in a short period of time. Unfortunately most people aren’t in the habit of giving Microsoft much credit for anything.

What we can learn from this

Email administrators understand all too well the importance email service plays in the ability for a business to operate efficiently. When email is down workers grow impatient, management grows frustrated and the email administrator’s popularity rapidly wanes.

In order to handle a disruption in productivity any business that relies on the cloud for essential services, like email, should have a back-up plan. One thing that is promising with Office 365 is that it offers a hybrid approach to email. Using Exchange Server 2010 on site in the hybrid deployment scenario that Microsoft offers can help an organization better deal with outages in their cloud services. Conversely, being able to access email via the cloud keeps things moving when the Exchange server goes down as well.

Microsoft’s Office 365 community website points out that the cross-premise messaging solution (hybrid deployment) offers the following features to help lure potential customers:

• Mail routing between on-premises and cloud-based organizations
• Mail routing with a shared domain namespace (For example, both on-premises and cloud-based organizations use the @contoso.com SMTP domain)
• Unified global address list, also called a “shared address book”
• Free/busy and calendar sharing between on-premises and cloud-based organizations
• Centralized mail flow control; the on-premises organization can control mail flow for both organizations.
• A single Outlook Web App URL for both the on-premises and cloud-based organizations
• Move existing on-premises mailboxes to the cloud-based organization
• Centralized mailbox administration using the on-premises Exchange Management Console (EMC)
• Message tracking, MailTips, and multi-mailbox search between on-premises and cloud-based organizations

Despite recent problems, Office 365’s email solution looks rather promising. One Microsoft is able to do some PR related damage control it looks like they will be able to make a solid run at cloud based email services and give Google Mail something to think about.

Is Microsoft Exchange Online Only Half-Baked?

Free ebook download: Top 10 Most Popular Troubleshooting Posts for Email Administrators

Common wisdom is that there are two sides to every story, and this no doubt holds true in the case of two cloud-related issues recently addressed by David Chernicoff over at the Five Nines: The Next Gen Datacenter blog on ZDNet.com. He relates two stories in his recent column having to do with cloud services.

One was a first-hand experience he had with data loss and a hosted Exchange provider, the other was about a client of his who selected an accounting software vendor which subsequently went out of business, rendering their software unusable.

In both cases (as was perhaps the intent of the article) the reader should take note that it was the use of a cloud based service, with dependencies upon things completely outside the customer’s control, that eventually led to a work-stopping situation. While his point is correct, the SMB reader who is considering a cloud based solution should keep in mind that this is just a couple of anecdotes about cloud services, and that there is just as much possibility for data loss or business interruption when hosting critical services in-house. Indeed, Mr. Chernicoff’s closing warning, about having a plan B in place, is just as important if not more so when keeping services in-house.

Ask any IT guy who has been in the business for more than a year to regale you with a war story of a system failure that caused data loss. Developers who deployed a proprietary in-house solution, then moved on to greener pastures and leaving no usable documentation behind; systems in their own environment that include a single point of failure in the form of the one IT admin who knows what it does and how to keep it doing what it should; commercial solutions from a major, thriving company, that were partially deployed in the environment but never finished because that one guy who understood it/advocated it left, and even though you bought support, no one else in IT has the time, or the background, to pick it up and finish the project.

For the small to medium business that cannot afford a full complement of IT staff, cloud based services offer something that would otherwise be out of their reach… scalable solutions with a 24×7 support structure in place. However, the simple truth is that cloud based solutions are not a panacea, and companies must consider providers with the same due diligence which they would use when considering an in house solution, or a managed services provider, or a new hire. Ensuring that the contract includes provisions for availability, business continuity, backups and restores, and continuing support should all factor into any decision to deploy either a cloud based or in-house solution.

Examining the provider’s financials can provide insight into their long term viability, as can a review of any certifications they have in place like SAS70 or ISO 20000. Contacting reference customers is even more important than checking out references of potential employees. HR may not let you say anything about a former colleague, but customers will let you know in no uncertain terms whether or not they are satisfied with a service. Finally, if you are working with a service that involves proprietary code, use a code escrow service to ensure that if the provider goes out of business, you have the option to deploy their code to continue using the application.

With some basic precautions in place, a little due diligence, and some common sense, SMBs can enjoy great success with the right cloud provider.

Every Cloud Can Have a Silver Lining

Free ebook download: Top 10 Most Popular Troubleshooting Posts for Email Administrators

Microsoft may have been late to the party in the cloud, but once it crashed the festivities it did so with enthusiasm. Anyone who watches television in the US knows that nary a night goes by without a “to the cloud!” commercial from the Redmond gang being aired. So the question administrators are asking themselves is “Does the cloud make sense as a home for my Exchange server?”

By now, the benefits of putting an Exchange server in the cloud have been hammered into the heads of most administrators. They focus on cost and manageability. Creating an Exchange environment locally can be expensive and complicated. There’s hardware to buy. There are licenses to purchase. And once the whole shebang is running, there are ongoing support and operating costs.

With a cloud arrangement, an organization pays a subscription fee–typically $5 per mailbox per month–and the nimbus provider takes care of the rest. It handles headaches like software patches, server backups and complying with Microsoft’s forever shifting best practices scenario. What’s more, it may even offer software that’s easier to use than applications like Exchange Management Console and Exchange Management Shell.

Sounds like moving to the cloud is a no brainer, doesn’t it? Not quite. Take the cost argument. Granted, the initial cost of an Exchange setup is prohibitive for smaller businesses. For them, the cloud is the only way they can reap the benefits of Exchange. For organizations that can afford to deploy their own Exchange environment, however, the total cost of ownership (TCO) may be lower in the long run than an open-ended subscription to a cloud service.

That’s illustrated in a recent cloud versus ground cost analysis by Brien Posey posted at SearchExchange.com. He calculated that the cost of setting up an Exchange environment for 100 users on a single server to be about $21,192. That cost could be considerably less, however. For example, if an organization already has a Windows Server infrastructure and when it built it bought the per-device licensing scheme, then the Windows Server per client licensing fees can be removed from the $21,192 estimate. In addition, if an organization has Exchange Server running on a virtual server under Microsoft Hyper V, then an additional Windows Server license could be cut from the estimate, too. Removing those Windows Server licensing fees would bring the estimate down to $14,199. That’s less than three years of cloud subscription fees.

Of course, every administrator knows that the cost of setting up a system is just the beginning of its cost. There are repair and maintenance costs. There are IT people to pay. But there can be some less than obvious costs in the cloud too. When will the inevitable fee increases occur? Will your costs increase as your data demands increase? Some cloud providers tack on additional charges as a client’s bandwidth demands increase.

In addition to cost, there are some other potential snags with ascending to the cloud. Software compatibility could be an issue. An organization’s third-party software programs, which could be configured locally to work in an Exchange environment, might not work with a cloud provider’s deployment. For example, archiving programs sometimes require a client to run on a mailbox server. Chances are a cloud provider won’t permit such clients to run on its servers.

Compliance with regulatory requirements could be an issue too. If an organization must comply to regulations authorized by laws like Sarbanes-Oxley or HIPPA, it’s required to meet certain inflexible rules on how servers must be configured, managed and maintained. If a cloud provider doesn’t meet those rules, then a nimbus deployment of Exchange becomes a pipe dream for an organization.

Worse yet, a cloud provider may say it’s complying with a regulator’s demands, but in fact may not be. In that case, an enterprise could be on the hook for violations it had no control over.

“You need to be sure that the cloud service provider you select has a proven method in place to meet regulatory compliance and that it will take corrective action if something is not archived properly,” Posey writes.

Of course, if an organization gets a fussy auditor, no cloud provider may be suitable for its needs. Posey recalled one case where an auditor declined to certify an organization in compliance simply because its servers weren’t on its premises.

Although cloud advocates would like administrators to believe an Exchange deployment in the nimbus is a no brainer, a prudent IT pro will exercise their little gray cells before totally committing to the cumulus.

Pros and cons of using Exchange in the cloud

Free ebook download: Top 10 Most Popular Troubleshooting Posts for Email Administrators

We hear a lot of talk these days about the benefits of a hosted Exchange deployment.  Probably reflecting the desires of IT managers on the ground, Microsoft’s latest and greatest version of the Exchange messaging server, better known as Exchange 2010, was touted by Microsoft to be “designed from the ground up” to be equally at ease running as a hosted service or as an on-premise solution.

While running one’s Exchange server on a hosted service certainly does have its allure, e-mail administrators or IT managers ultimately need to consider and weigh the merits of both scenarios carefully.  So when does it make sense for organizations to opt for an on-premise deployment of Exchange?

Let’s take a look at some of them today.

More choice of anti-spam and anti-malware solutions

The state of spam and malware proliferation via e-mail today means there is little tolerance for any Exchange installation that is not protected by some sort of spam and malware filtering.  While most hosted Exchange providers incorporate some form of spam protection, choices offered might be limited or expensive.  The alternative would be to opt for a cloud-based anti-spam service by using MX forwarding, though adding in another hosted service does increase the recurring cost of the hosted Exchange deployment.

On the other hand, an on-premise installation of Microsoft Exchange gives businesses a free rein on whether they want to rely on a cloud-based anti-spam service or a traditional server-deployed solution such as GFI MailEssentials, which allows for a greater degree of configurability.  In fact, it is entirely feasible to deploy both in tandem if necessary.

Heightened confidentiality and compliance

Where there have been many prominent news reports of organizations shifting to a hosted e-mail deployment, a closer examination will show that they are often not companies in the financial, health or other tightly-regulated sectors.

The truth is that the outsourcing of critical installations does not exonerate an organization should something go wrong, as can be evidenced by the case of the prominent seven hours downtime experienced by Singapore bank DBS recently.  The fact that the affected infrastructure was operated and maintained by IT vendor IBM – and the mistake perpetuated by personnel from IBM, cut no ice with the government regulator, who slapped a number of measures on the bank to censure it for the outage.

Another complication inherent to an Exchange deployment has to do with how legal jurisdiction is typically applied based on the location of the physical server.  And what happens if the data is stored at an off-site location in yet another country?  In fact, compliance laws might mean that a hosted deployment might not even be legally possible in the first place – an aspect worth investigating first.

Increased Backup and Archival Options

Moving on, an on-premise Exchange deployment also offers much greater flexibility when it comes to e-mail archival and management of backups.  While all cloud providers will position their backup capabilities as a selling point, the recent data loss experienced by some users of online note-taking service Evernote is a sombre reminder that mistakes can and do happen.

Ultimately, an on-site installation presents the e-mail administrator with the largest number of tried-and-tested solutions that can be used to backup Exchange mailboxes under their charge.  In addition, companies interested in increasing their Exchange performance will also be able to make use of solutions such as GFI MailArchiver to help create backups of old e-mail without running afoul of e-mail retention policies.

Better performance

It is now an accepted practice to connect to Microsoft Exchange via HTTP, which contributes to administrators making the mistaken assumption that the performance for a local area network (LAN) deployment compared to that of a hosted Exchange server is similar. The truth is that an on-site deployment within the network will always perform better than any service hosted on the Internet – where it is subjected to the fluctuating conditions of one’s ISP connection or the bandwidth capacity of your hosting provider.

This is especially important since employees are increasingly using Microsoft Exchange not just for e-mails, but as a collaboration and productivity tool with which to track contacts, schedule meetings, or even to book company resources like meeting rooms and projectors.  And depending on company policies, IT managers might need to roll-out brand new workstations (or do a fresh install) every couple of years.  The performance of a local Exchange deployment will be much faster during these periods.

Some Reasons for an On-Premise Deployment of Exchange Server

Free ebook download: Top 10 Most Popular Troubleshooting Posts for Email Administrators

The release of Google Buzz adds another new step in the ongoing evolution of online communication.  And I hope you’ve been paying attention to the evolution so far.

Buzz, along with Google’s other recent release Google Wave, add real-time communication to traditional email inboxes in ways that, quite frankly, most people will fail to grasp for some time yet.

These new Google releases are part of a long running change in the consumer side of online communications.  Looking back 10 years the average web user had email, newsgroups, and basic instant messaging, all performed on their computers.

Today we have blended platforms such as Facebook that include email-style messaging, real time chat, and broadcast communications such as status updates.  In addition to this more and more content is shared in non-text formats.  Photos and videos are exchanged between friends as often as written messages are.  Business deals are done on Twitter.  And no one ever complained that a sales pitch was too short.

Business communications are charting a similar, but slower evolution.  Email quickly replaced much of our phone and fax communications and became a collaborative workspace, albeit a highly inefficient one.

In recent years collaboration has moved out of the inbox and into document management systems and intranet workspaces.  Faxes go directly to electronic records management systems instead of being dropped on our desk.  And telephony systems are integrating with our real-time communications servers to make voicemail and presence data available to us at our desks or on our mobile devices.Email once made long distance business possible without great expense.  Email put customers within reach of sales people without having to endure the cost and inconvenience of long distance travel.  Now with computing power and bandwidth both inexpensive commodities the long distance face to face meeting has arrived in the form of video conferencing.

Email is fast becoming a time sink, the preferred communications medium of the old guard but too slow and cumbersome for the next generation of business leaders currently learning how to communicate quickly and easily online.

As we roll out the latest enterprise email servers with their amazing new features are we simply delaying the inevitable?  At some point will the generational weight of the workplace tip in favour of those who prefer fast, efficient communications?

At what point will the role of the email server shrink to merely being the place where meeting invites and document workflow alerts are sent?  Will the email administrator disappear?  Or will they evolve into the communications administrator, overseeing the voice, instant messaging, conferencing, and collaboration systems instead?

Will this evolution simplify and improve our business communications?  Or will it add complexity that requires a class of expert not common in today’s industry?  Maybe that complexity will keep us with the systems we use and understand today, at least for a little longer.

On the bright side, at least I’ve never been in a video conference that got interrupted by spam.

What Will Email Be In 10 Years?

Free ebook download: Top 10 Most Popular Troubleshooting Posts for Email Administrators

The increasing popularity of in-the-cloud email delivery and email security solutions, and the wealth of innovations available, raises the discussion of whether email administrators should consider cloud-based solutions. While the free, Web-based email remains out of the question for corporate use, some other cloud solutions that offer more robustness and security may be appropriate for some users.

Security is always imposed in cloud-based systems to one degree or another, but a major limitation is that many cloud providers still implement their own proprietary security approaches. While such an approach may well impose good security, this has still limited the uptake of cloud-based models. A more appropriate approach to cloud-based security would be the adoption of a common security model, made available through the cloud platform-as-a-service.

As outlined in “Cloud computing made easy,” co-authored by yours truly, a cloud platform (as opposed to cloud “software as a service” applications) imposes common software elements, which are used by developers to write cloud applications without having to re-invent the wheel for every aspect of each application. The use of a cloud platform is particularly useful for imposing rigorous security, in that it presents a standard security model for managing things like authentication and authorization, role-based access, secure storage, multi-tenancy, and privacy policies. Developers of common SaaS applications may not always be experts in security, but by using the common security model of a cloud platform, the developer is able to draw against the expertise of other developers who are.

The advantage is especially evident for smaller businesses which often lack full-time, specialized IT security personnel. It is much more likely that a cloud provider will have devoted time, money and resources to security, than would a small company with four or five employees, and in such a case, the small business is more secure by leveraging the services of a reputable cloud provider as opposed to running unsecure or marginally secure applications in-house. This of course, assumes that the small business takes the time to conduct due diligence on the cloud provider, examine the service level agreement in detail, and ensure that the provider has taken steps to ensure the security of the applications being accessed.

It is certainly possible for a company to impose tight, near bulletproof security in-house, and this possibility keeps many from moving to the cloud. But the question should not be “is it possible”, but rather, “is it likely.” A realistic examination of a company’s resources, in-house talent, and ability to adhere to sometimes draconian security policies is the first step in the decision. Do you have the money and somebody on hand to implement the technology? And then, once implemented, do you have the management will to impose necessary but potentially unpopular security policies? Besides technical security such as authentication and authorization, and policies such as frequent password changes, physical security must also be imposed—including locked server rooms, personally escorting laid off employees off the premises, and regulated access to the physical equipment. Cloud providers are more likely to impose these measures as a general rule, which may lead to better security.

Security and the cloud

Free ebook download: Top 10 Most Popular Troubleshooting Posts for Email Administrators

The European Network and Information Security Agency (ENISA) has issued one of the most comprehensive reports on the security risks and benefits of cloud computing. The report takes an impartial look at the cloud phenomena, and it starts out with the obvious—that is, cloud computing’s benefits of ease of access, scalability, instant provisioning and monetary savings are undisputable, but the biggest issue holding people back is the security concern.

In many cases, the concern over security is one of perception. We tend to think that things are more secure if we can put our hands on it. But the ENISA paper gets into more specific detail about precisely what the top security risks are:

1. Loss of governance. The biggest and most common concern, ceding control to a cloud provider may create a vulnerability if security isn’t specifically addressed in the service level agreement.
2. Lock-in. A lack of standardization and portability means that it may be difficult to switch cloud providers, or bring service back in-house.
3. Isolation failure. Because it is based on multi-tenancy, the cloud may be vulnerable to guest-hopping attacks or attacks on the cloud’s isolation mechanisms.
4. Compliance risks. The cloud provider may not be able to provide evidence of compliance with regulations to which the customer must comply.
5. Management interface compromise. There may be an increased risk of exposure through the customer management interface.
6. Data protection. The customer may not be able to verify the provider’s data handling processes.
7. Insecure or incomplete data deletion. What happens when you request that your resources be deleted? A true “wipe” of data may not take place, and reuse of resources may pose some risk of deleted information being detected later by another party.
8. Malicious insider. Insider attacks are always a risk, whether on-premise or in a cloud provider.

But it’s not all downside, either, and the report lists several security benefits as well. Most importantly, there’s the obvious differential that exists between what a small business knows it should do, and what it has actually gotten around to doing when it comes to on-premises security. Smaller businesses in particular which may lack in-house expertise and may be short on time or funds often don’t have the best security, and it is often out of date. In such a case, the cloud may present a big security advantage, since the cloud provider is more likely to have security expertise and the staff to implement it. In the case of the cloud provider, it’s a matter of scale. A top of the line security investment at the cloud center is paid for ultimately by distributing the cost between hundreds of customers, which makes it possible to get better protection for all parties.

Cloud benefits and risks highlighted in ENISA report

Free ebook download: Top 10 Most Popular Troubleshooting Posts for Email Administrators

Security is major barrier to adoption of cloud computing.

Security is playing a key role in the willingness of organizations to adopt cloud computing solutions, according to  a study recently released by Launchpad Europe, a business accelerator outfit based in London.

The study based on a survey of 105 IT security experts across the globe found that more than 50 percent of them identified security concerns as the primary reason their organizations were shying away from embracing the cloud.

Asked what their highest priority was when considering a cloud services provider, 37.9 percent cited security of the cloud infrastructure. Another 12.6 percent identified security procedures to protect their data centers as their highest concern.

The data collected by the researchers also suggests there is considerable doubt about whether those security worries can be met by a cloud vendor. Some 49.5 percent of the respondents told the pollsters their companies neither use nor plan to use the cloud in the next 12 months.

Other significant items when choosing a cloud vendor cited by the survey respondents were due diligence and track record of service provider (18.4 percent) and ease of migrating data from vendor’s service to a new service.

Among the companies participating in the survey who do have cloud deployments, 16.5 percent said they used public deployments; 16.5 percent, private deployments; 10.7 percent, hybrid; and 6.8 percent managed.

Although most of the survey participants were from North America (39.1 percent), the United Kingdom (29.9 percent) and Mainland Europe (12.6 percent), there were also respondents from Australasia (6.9 percent), the Middle East (5.7 percent), Far East (4.6 percent) and South America (1.1 percent).

“While cloud computing remains high on the corporate agenda, organizations’ concerns about cloud security will not go away overnight,”  Launchpad Europe Technical Director Mike Burkitt said in a statement. “Before businesses will feel comfortable transitioning to cloud-based services, they first need to be convinced that the business benefits of the cloud outweigh the security risks–and that goes for both service providers and the cloud infrastructure itself.”

“For organizations with in-house technical capabilities and a good financial situation, the answer to their security fears may lay in the private cloud,” Burkitt added. “Developing your own cloud-based system gives you choice, power and flexibility.”

Similar findings were released last month in a report from the European Network and Information Security Agency.

Admittedly, the benefits of the cloud for businesses are compelling, the report noted. Content and services are available 24/7. Costs can be controlled by better management of capacity demands on the data center. Scalability is smoother. Internal IT resources can be unleashed to do more mission critical and strategic chores.

Those benefits are the reason that the cloud market is expected to become a $44.2 billion market by 2013, from its current level of $17.4 billion.

Nevertheless, as the ENISA report’s editor Giles Hogben points out:

“The picture we got back from the survey was clear. The business case for cloud computing is obvious–it’s computing on tap, available instantly, commitment-free and on-demand. But the number one issue holding many people back is security–how can I know if it’s safe to trust the cloud provider with my data and in some cases my entire business infrastructure?”

The reservations that organizations have with the cloud are similar to the ones they’ve had with outsourcing  any important business activity. You’re at the mercy of the vendor; if its servers go down, you go down with them. If you want to cut the cord with a vendor, migration of services and content could be a problem. Will failing to maintain certain data internally cross regulatory boundaries? Is your data being properly deleted by the vendor?

Before ascending to the cloud, the ENISA recommends that a careful analysis be done to determine the advantages of the cloud to your organization versus handling matters internally. When choosing a vendor, service levels need to be defined in the agreement with the provider, as well as a clear delineation of responsibilities for the vendor and your internal IT people.

The cloud need not be a security conundrum, maintains ENISA Executive Director Udo Helmbrecht.

“The scale and flexibility of cloud computing gives the providers a security edge,” he asserts. “For example, providers can instantly call on extra defensive resources like filtering and re-routing. They can also roll out new security patches more efficiently and keep more comprehensive evidence for diagnostics.”

Security tempers zeal for cloud computing

Free ebook download: Top 10 Most Popular Troubleshooting Posts for Email Administrators

The increasing popularity of cloud-based solutions has resulted in many new offerings of cloud platforms as well as numerous as-a-service software solutions. We also have storage-as-a-service, to alleviate in-house storage demands; and even supercomputing-as-a-service. Are all of these cloud services robust enough for mainstream, daily use?

Computing is seldom a one-size-fits-all proposition, and what works for one company won’t work for another. The same is true with the cloud. What’s clear though, is that it is here to stay. There are two things that have led more companies to face the cloud question head-on: Available technology in the form of cloud services and solutions, and greater availability of cheap, high-speed connectivity; and simple economics. These two factors have converged nicely.

On the economic side, the struggling economy, and the need for more companies to maintain or improve the bottom line by cutting costs, has led to increased reliance on outsourcing. Cloud computing services can be seen as a type of outsourcing; for example, if you’re running anti-spam or another type of security, or all of your email for that matter, through a cloud-based service, then you’re no longer burdening your in-house staff with it (or if you have no in-house IT staff, your office manager, secretary, file clerk, or whoever else may have gotten tasked with it in the past). The administration, provisioning, installation, and maintenance of the physical infrastructure is handled by somebody else. Of course, none of this would even be possible were it not for ubiquitous broadband, which allows even the smallest businesses to connect to the Internet (and all of those cloud services) at incredibly high speeds and with increasing reliability.

The most obvious time when in-the-cloud security is appropriate, is when your company doesn’t have in-house security-specific expertise. Is security being tasked to an IT generalist, or worse, to a non-IT office manager? In the case of small companies, these tasks often get delegated to the office guy who “seems to know a lot about computers” rather than a real IT person, and the result is often disastrous. The advantage to cloud services in this case is that cloud providers tend to employ experts with relevant experience. Those experts can be expensive to hire on your own, but by using the cloud services, you benefit from their expertise without having to pay their full-time salaries.

If your company is considering cloud-based security services, or any cloud service for that matter, the first thing to consider is the reliability of the company. Cloud-based security services are best offered by a company that is well-versed and experienced in security, and has been in business for some time. Second, take a good look at the service level agreement and make sure it has very specific details about performance promises. And lastly, realize that cloud security, like any type of security, while it should be easy to use, is never meant to be a “deploy it and forget it” proposition. Make sure it has good reporting facilities and an intuitive management portal that still affords you some control over the security features.

When is in-the-cloud security appropriate?

Free ebook download: Top 10 Most Popular Troubleshooting Posts for Email Administrators

It seems as though the move to cloud computing is inevitable, at least for parts of the enterprise. It’s gaining in popularity, and it has the incredible attraction of being cheap—which makes cloud services a favorite for corporate bean counters. But are those bean counters listening to their security guys before deploying it?

There are still security and privacy concerns to be addressed. According to a recent Unisys poll, security and privacy concerns are still big barriers to cloud computing. The survey asked, “What do you see as your greatest barrier to moving to the cloud?” And 51 percent cited security and data privacy. Twenty-one percent cited integration of cloud applications with existing systems as a potential barrier.

To their credit, vendors of cloud-based systems of all sorts, email and otherwise, are tackling the problem with new layers of security. But will it be enough? A Dark Reading article interviewed the former black hat known as “mafiaboy”, who claims that cloud computing will ultimately cause a “meltdown” of the Internet due to the inherent security vulnerabilities. According to the reformed hacker, cloud computing done on a massive scale will transform the Internet into a “hacker haven.”

We don’t know if his claims of cloud computing hastening the demise of the Internet as we know it aren’t a bit exaggerated, but he makes some very good points, not the least of which is that today’s hackers are for the most part, in it for the money, as opposed to yesterday’s hackers who saw it sometimes as a challenge or a game. And the lure of ill-gotten gains is powerful indeed. And with everything in the cloud, the Internet will become more of an attractive nuisance than it already is. For a criminal, cloud computing will just be too much of a temptation.

Is cloud computing safe?

Free ebook download: Top 10 Most Popular Troubleshooting Posts for Email Administrators