866.277.4621
6 NJ-173, Clinton, NJ 08809 
March 16, 2021
By Mike Maher, Director of Professional Services
CPP has received a lot of client calls and questions about the recent SolarWinds events, most of them revolving around what customers should do to secure their own infrastructure.
While there is little sense in re-litigating how egregious a supply chain breach it was, or how significant the attacks across the public and private sectors have been, it is good to reflect on the situation and the challenges it presented so we can learn from it and perhaps mitigate similar issues in the future.
As technology evolves, interconnectedness grows, and the world continues to shift to a more permanent remote workforce, the discussion about securing environments will continue every minute of every day.
So, what do we do to monitor and secure infrastructures? Is moving everything to the public cloud the right answer? Microsoft’s President seems to think so. In fact, he said during a Congressional hearing on February 23 that you would likely get better security by moving to their platform instead of keeping everything on premises. (Read complete testimony here.)
While this is a simple answer (and certainly self-serving), the truth is somewhat more nuanced and complex.
On March 2nd, Microsoft released yet another round of emergency patches that plug four critical security holes in their on-premises Exchange server versions. At least 30,000 entities across the US have been affected by this attack, which is focused on stealing email from their victims.
I don’t know about you, but I’ve been taught to look at the whole picture, take a 360 degree view of the situation and a measured approach. In my view, reflexively moving everything to the public cloud is the opposite of that. Office365 is one thing. That took the complexity of what has arguably become the most mission critical application/tool/communication solution (email) of all time, and turned it into a public utility. It’s that big a platform. If you think that’s hyperbolic, compare being without your email for 8 hours to being without power to your house for 8 hours. Or even just one hour?
Which would you choose?
Here’s the real question: would you entrust your entire business, including your data, and access to it, to what’s tantamount to a digital utility company?
Continuing with the power example, the power company keeps the power flowing to you, day in and day out. They don’t guarantee that the power will flow 100% of the time, how long it will take to restore it if it goes out, or that your always properly protected against power surges, or sags (not enough power).
Translating that to IT, moving workloads to the public cloud means signing up for their terms and conditions, their service levels, and their limitations on security. If you’re anything like me, you’re probably not comfortable leaving the security of your data in the hands of other people. Unlike power, you have the freedom of choice with IT solutions and providers, and can make decisions based on your organizations best interest.
Securing the infrastructure takes a multi-faceted approach. Best of breed solutions have real value. You can pick and choose what you need to ensure that the infrastructure meets your businesses requirements, as well as that of any regulatory or governing bodies. Most solutions have support for the hybrid space and that is because it is the most common deployment for businesses of all shapes and sizes.
Whether your workload is on or off premises, or a hybrid approach, we recommend a thorough and methodical approach to security. If you need help or guidance, please reach out to your partner. If you don’t have a partner, please reach out to CPP and we’ll be glad to help right away.