Hybrid cloud storage entails keeping some of your data on premises and some offsite in the cloud. It's becoming an increasingly popular option for small and midsize businesses.
Our previous article, How to buy and implement a hybrid cloud, outlined how it's best to start by segmenting information, storing locally any data you need to access quickly, and archiving other information in the cloud.
Security is also an essential element of the implementation of hybrid cloud storage, but it must come alongside a plan. SMBs should assess what data is being stored, how it is going to be protected, and ensure that it is encrypted and properly protected.
It makes sense to use the same vendor for security as for the cloud service itself, especially if they offer consultancy - just check your intended supplier's credentials before you start. Also, as part of your research it's important to check how your data will be used by the cloud provider before signing up.

The strategy

Hybrid cloud storage can be very secure, says Clive Longbottom, Analyst at Quocirca. But SMBs should ask the vendor about how the store the data, as cheaper isn't always better.
"Some of the vendors will offer cheap cloud storage because they are using de-duplication at the back end, using all of their customers as the feeds," Longbottom warns. "This can work well for them then as they are working against a massive set of data files, and so the compression they can get will be well in excess of 80%."
But if you don't want your and other people's data being used together in this way, you will need a dedicated service, where only your data is being de-duplicated. This will cost more.
"The best performance for de-dupe is on files in the clear as well – so the use of encryption will do less de-dupe." says Longbottom.
He recommends that where possible, SMBs should use an appliance that does the de-duplication before sending it across to the cloud. "You get the benefits of smaller data sizes, less traffic over the interconnection between you and the cloud – and still get the option for the data to be encrypted before it is sent to the web," he adds.

Changing perceptions

But cloud's real challenge comes in many firms' perception of the technology. "What the cloud vendors have to prove is the security of the data is better and stronger than on-premises," says Tom Holmes, Founder and Managing Director of HR cloud consultant Veran Performance.
The risk of data storage in the cloud is far less than those taken in some parts of the business already, he says, citing HR storage as an area which can often be outsourced.
Holmes cites the example of one of the firm's previous clients, which had all onsite data stored in a "shed", without proper cooling devices, using out-of-date servers. "What they get by taking reasonably secure data storage in the cloud is far less risk and backup which they do not have. Yet intrinsically it feels like it's higher risk to put things in the cloud, no matter how clunky things are."

Consultancy

It's often wise to get some expert advice on cloud security before you even segment your data. SMBs should look to invest in an approach which offers them a combination of consultancy and high quality technology where possible.
This should incorporate the underlying infrastructure, SLA management security, and advice and guidance, says Andrew Carr, CEO, Bull UK and Ireland. Such services are becoming more available, with vendors offering made-to-measure hybrid cloud models that come with integrated security capabilities.
"Today we are seeing this kind of approach become increasingly popular with SMBs as issues around cloud security dissipate," Carr says.
But SMBs must first make sure onsite data is secure. "I think this is where vendors and the channel can come in," says Longbottom. "They can provide corporate security services as part of putting in place a hybrid solution, making sure that the customer meets all its regulatory data and information requirements as part of the project."
Although many vendors aim at the midmarket and above, Longbottom recommends looking at Ctera, which offers a service to the SMB via the channel; or for more high end services, Nasuni, Nirvanix or StorSimple, which was recently bought by Microsoft.
Securing a hybrid cloud involves a strategy, but you have to make sure you choose the right provider. Once you've secured some of the data onsite, with thorough research your offsite data will be just as, if not more secure.