Security is central to everything we do at Nasuni. In 2017, our hybrid cloud file services platform and global file system were put through comprehensive security audits by some of the world’s most security-conscious enterprises. We had to add a few things here and there, but we passed all their tests. And our platform is stronger for all our customers because of it. Fortune 500 companies and industry sector leaders like AECOM, Western Digital, Omnicom Group, Ecolab, and Siemens who trust their unstructured data to Nasuni are now benefiting from the changes we made.
Given the continued questions I hear in my role as a solutions engineer about whether enterprise files are safe in the cloud, I thought I’d provide an overview of the Nasuni security model, what we’ve done to date, and the security improvements that are coming next.
Nasuni Security Model – Overview
Making sure your enterprise files are safe in the cloud starts with Nasuni Chief Scientist David Shaw. David co-authored and develops the GnuPG Project, an implementation of OpenPGP, the world’s most widely used email encryption standard. David applied these security principles in creating Nasuni’s strong security model. He continues to apply these principles today as he leads its continued evolution.
Fundamental to Nasuni’s security model is that all data and metadata are encrypted under a key generated and controlled by our customers. Neither Nasuni nor the cloud providers can access the key, which means they cannot access any data. The encryption is based on OpenPGP and AES 256, as well as TLS v2 and HTTPS protocols, which are used to secure data in flight and at rest. Nasuni administrative and end user interfaces are secured with TLS and Active Directory User and Group authentication, as well as Role-Based Access Control (RBAC).
Securing Communication Channels On-Prem and In-Cloud
Nasuni Edge Appliances have two distinct channels of communication when they are in operation:
- First is the data path. This is a direct API/HTTPS channel secured using TLS v2 that communicates directly to the cloud (public or private) from the appliance. Data never flows through Nasuni or any external services or providers.
- Second is a collection of services commonly referred to at the Nasuni Operations Console, or NOC. This channel is also encrypted. It never sends any file data. Capacity licensing, anti-virus updates, OS updates, configuration/orchestration, and Global File Locking all use this second channel.
All NOC communications to public IP destinations from the Nasuni appliances use only outbound TLS (TCP: 443) and connect directly to domains such as *.nasuni.com, *.microsoft.com and *.aws.com. The services running in these public clouds are secure, scale automatically to meet demand, and run in dual-availability zones in geo-separated data centers for resiliency.
All the providers we work with maintain top-tier cloud storage security within their own facilities and are accredited with multiple security certifications.
Securing Nasuni Global File Lock
Since the Nasuni Global File Lock™ (GFL) service is the one that directly interacts with the Nasuni UniFS® global file system, this is the area that raises the most concerns when I’m talking to customers.
Again, at no time is any file data ever transmitted or stored in the external GFL service or the cloud. File handles under GFL control are maintained by Amazon DynamoDB. File names are represented in DynamoDB through a one-way hash. DynamoDB tracks the lock status and returns either a read-write or read-only response when access is requested.
GFL is application-specific in that it only works with apps that lock files. Nasuni won’t lock files if the app doesn’t support the feature.
New Security Features Coming Soon
We’re never going to stop innovating on security. Here’s some of what’s coming next:
- Improved AD ACL support. Advanced support for complex ACLs and historical security identifiers (SIDs) will be available in our next release, planned for next month.
- Protected deletion of Nasuni volumes. We’ll be providing the option to specify how many administrators must simultaneously approve the deletion of any Nasuni volume to prevent malicious or inadvertent actions. Look for this in early 2018.
- Varonis integration. Nasuni is partnering with Varonis to bring data-centric audit and protection to our platform via integration with Varonis DatAdvantage, DatAlert, and DataPrivilege. This will be available with the next major release of Varonis, planned for early 2018.
- SSL Proxy. We’re working on an SSL Proxy feature that will enable customers to proxy outbound SSL connections for inspection and tighter security. The feature is planned for 2018.
As you can see, we’re working hard to overcome any remaining cloud storage security challenges. And we’ll continue innovating to make sure your unstructured data is safe in the cloud. Are there other security features you want to see us add? Comment below or email me directly.