IT professionals are finding it harder than ever to set up access controls for network resources and applications used by organization employees, and cloud computing is only adding to their woes, a survey of 728 IT practitioners finds.

Endpoint security gets complicated

The Ponemon Institute’s “2010 Access Governance Trends Survey,” which asked 728 IT practitioners about their procedures and outcomes in setting up access to information resources, found the situation worsening over the past two years. In comparison to a similar survey done by Ponemon two years ago, this year’s survey found 87% believed individuals had too much access to information systems, up 9% from 2008.

And in a new question asked this year about how use of cloud computing fits with access-control strategies, 73% of respondents said adoption of cloud-based applications is enabling business users to circumvent existing access policies.Cloud-based services “are often purchased directly by business units without consideration of access governance,” says the 2010 Access Governance Trends Survey, published Monday. The survey was sponsored by Aveksa.

more of the CIO.com article from Ellen Messmer

A CIO strategy that includes flexible data center facilities can help organizations through changes in the economy, lines of business, revenues and profitability.

Flexible data center facilities help CIOs add racks, power density and temporary systems as needed. Outsource colocation and outsource data center facilities can deliver this flexibility as an operating expense rather than capital costs.

Outsource data center facilities that offer private cage space and separate square footage/active rack charges allow organizations to build for growth and change.

Carrier neutral data centers with no cross connect fees and help control long-term telecom costs and improve network reliability

Building a hardened data center with 99.995% uptime (equal to Tier IV data center ratings) is cost-prohibitive for most companies. Leasing space in an affordable colocation facility with 99.995% uptime is easy.

Maintaining data center compliance is expensive. Data center certifications can cost hundreds of thousands of dollars to implement and tens of thousands to maintain. Outsource data centers let you outsource data center compliance, such as SAS 70 data center certification, TIA-942 compliant data centers, HIPAA, FDA, FISMA and other regulations.

The most flexible Midwest colocation provider, Lifeline Data Centers, can help you make your data center flexibility strategy happen. Call 317.423.2591.

Is your data in a F5 tornado resistant data center? The risk of tornado is the biggest threat for Midwest data center facilities. Whether it’s Midwest colocation or in-house data centers, how do companies protect against the threat of tornado?

The most common approach for protecting against tornadoes is to use a hardened data center, built of steel-reinforced concrete. Underground entrances for power and telecommunications are important. Absence of flood plain is important. TIA-942 compliant data centers adhere to all of the important hardening guidelines. Is your data center TI-942 compliant?

Looking for affordable colocation in hardened data center facilities with 99.995% uptime and data center certifications? Call Lifeline Data Centers in Indianapolis at 317.423.2591.

Nathan Hatch is President and CEO of C7 Data Centers, a privately held company focused on providing high-value data center solutions for colocation, disaster recovery, data backup and virtualization.
Nathan Hatch, C7 Data Centers

Customers want to know that they can trust their data center provider to meet the most rigorous controls standards, demanding accountability and transparency. The American Institute of Certified Public Accountants (AICPA) created a “Statement of Auditing Standards” certification termed “SAS 70” to help customers know that their data center provider has effective internal controls in place for managing the design, implementation and execution of customer information.

The basic certification is called SAS 70 type I, which an independent service auditor assigns after a thorough review of the degree to which a data center provider fairly represents its services in regards to the operational controls that have been implemented to meet set objectives.

more of the Data Center Knowledge article

Colocation power costs (the cost of power in an outsource data center facility) can make a big difference in your overall IT budget. The raw cost of power varies throughout the country. Midwest colocation provider Lifeline Data Centers pays Indianapolis Power and Light $.055 per kW/hr. East and west coast colocation facilities pay double that cost of power.

But more importantly, how does the outsource data center pricing model charge you for power? The fairest way would be to charge based on actual usage. At Lifeline, we charge $.175 per kW/hr based on actual power draw. $.055 is for power to the IT equipment, $.055 is for associated data center cooling for the IT equipment, and $.065 is overhead associated with running multiple utility feeds, multiple generators, and multiple UPS systems for each and every client.

Colocation pricing models vary; be careful.

If you’re considering outsource data center facilities, you know that data center uptime and data center certifications are important. But the cost of data center power can affect the long-term IT budget. Choose an outsource colocation facility that charges fairly with low power costs. Choose Lifeline Data Centers.

Many businesses, small and large, are using outsource computer room facilities to improve their data center uptime and reduce data center capital costs. But at what price? The traditional outsource data center facility is a minefield of vendor lock-in problems. You can get in, but it is difficult to end contracts and leave.

How does this happen? Many outsource data centers sell private label bandwidth and point-to-point circuits. If these contracts are purchased over time, there is no single contract termination date and it becomes costly to move and maintain these redundant contracts.

How can you avoid it? Choose a carrier neutral data center with no cross-connect fees, so you can purchase circuits directly from the carriers and avoid any monthly add-on fees.

Your outsource computer room provider should earn your business. If they’re not giving you the features that you need, i.e. 99.995% uptime (equal to tier IV data centers), hardened data center facilities, data center certifications and affordable colocation, you have alternatives. If you’re looking for a great solution, give Lifeline Data Centers a call at 317.423.2591.

The following is excerpted from the April 12, 2010 Information Week article “Cloud Computing Risks”, written by Greg Shipley. Data center certifications and data center compliance are not always what they seem.

Most IT pros are familiar with the Statement of Auditing Standard (SAS) No. 70 from The American Institute of Certified Public Accountants. Put simply, it’s an auditing standard for service organizations reporting on controls put into operation. While there are two types of SAS 70 audits, Type I and Type II, Type II is the most popular as it involves a minimal amount of testing for specified controls. The output of a SAS 70 Type II audit is typically a “letter of attestation” by the auditor and a report on the “control objectives” that were reviewed during the audit.
Unlike prescriptive standards such as PCI-DSS (Payment Card Industry Data Security Standards), SAS 70 defines the process – the how – in which an audit is performed, but not the criteria – the what – that must be included during that audit. There is certainly value to a SAS 70 Type II audit, but the relevance of that value heavily depends on the controls being investigated – the what. As any IT professional who has undergone a SAS 70 will attest, you can simply remove controls that you don’t want audited. Don’t have desktop patching? Strike it. No security integrated into the software development life cycle? Don’t have your auditor look at that. Don’t run vulnerability scanners? Keep it off the objectives list.
The practice of massaging SAS 70 control objectives is bad news for security, and unlike standard controls in the accounting world, we don’t have Generally Accepted Accounting Principles for IT Risk. Even worse, many of the templates that SAS 70 auditors use are based on outdated controls. For example, password strengths don’t matter when an attacker can gain administrative access to critical systems via unpatched vulnerabilities. The value of a report is only as good as the controls it examines and the scope of its coverage.
Aggravating the situation, we’ve seen cloud providers that will provide a letter of attestation but refuse to list the SAS 70 control objectives. This akin to saying: “Yes, we were audited, but no, we won’t tell you what the auditors looked at.” Fortunately, many IT professionals and mature cloud providers see the absurdity of this situation. “A SAS 70 letter of attestation without visibility into the control objectives is meaningless,” says Google’s Feigenbaum. We couldn’t agree more.
Just like technology evaluations, the value of an audit is all about the criteria and the testing methods. So how do we make sure the right controls are looked at? Build the beforehand using a standards-based formula.

Is outsource data center space a better alternative than infrastructure as a service? Many of Lifeline Data Centers newer clients are second generation outsource data center users. They are moving out of the cloud, or out of another data center and into Lifeline. Their reasons for moving fall into a few categories:

Infrastructure as a service was a good solution at startup, but became too expensive to use as the client grew and needed more resources.

The cost of downtime is high and the clients have experienced data center downtime with their current outsource data center or cloud computing provider.

Data center certifications and data center compliance were difficult or impossible to evaluate/audit in a cloud-based environment.

Clients experienced performance issues that were difficult or impossible to isolate in a fully-hosted, cloud- based environment.

Clients do the math and determine that leasing/buying hardware and placing it in a facility with a sensible data center pricing model is a less expensive alternative.

Clients have had some costly downtime pain and want to take back control of their environments to guarantee that they have hardware, software and data center redundancy where it counts.

Clients realize that what they really need is a hybrid model that includes both outsource data center space and infrastructure as a service/software as a service.

Why are they choosing Lifeline Data Centers over other providers for their outsource computer room space?

Flexibility – clients can buy shared space or private cages, and can purchase extra space for growth without paying a penalty.

Uptime – Lifeline provides 99.995% uptime, the same levels as Uptime Institute certified tier IV data center facilities. And Lifeline’s hardened data centers are F5 tornado resistant.

Data center pricing model – Lifeline has a simple pricing model that separates floor space, per rack charges and power utilization. This appeals to clients who need incremental growth and easy forecasting of future costs.

Carrier neutral data center with no cross connect fees – Lifeline offers access to 15 carriers with no monthly cross-connect fees. Many clients find that the cross-connect fee savings can pay for their outsource data center space.

Data center power costs – Lifeline’s two Midwest colocation facilities deliver low power costs and pay-as you-use-it pricing.

Is outsource data center space a better alternative than infrastructure as a service? It depends, of course, on the nature of your business needs. For affordable colocation, call Lifeline Data Centers at 317.423.2591 to learn more about your best alternatives for outsource data center and cloud computing data center options to take advantage of the best of both worlds.

A group of six leaders in the data center industry say that a new standard by the American Society of Heating, Refrigerating and Air-conditioning Engineers is too “prescriptive” in its attempt to promote data center cooling efficiency, in part because of its support of airside economizers for all data centers, rather than just for those where the technology fits best.

The data center users involved include:

* Chris Crosby, Senior Vice President, Digital Realty Trust
* Hossein Fateh, President and Chief Executive Officer, Dupont Fabros Technology
* James Hamilton, Vice President and Distinguished Engineer, Amazon
* Urs Hoelzle, Senior Vice President, Operations and Google Fellow, Google
* Mike Manos, Vice President, Service Operations, Nokia
* Kevin Timmons, General Manager, Datacenter Services, Microsoft

Recently, ASHRAE added data centers to its building efficiency standard. The standard defines energy efficiency for most types of buildings in the United States, and is “often incorporated into building codes across the country,” according to a statement on setting efficiency goals for data centers released by the group of six. Here is what they had to say specifically regarding airside economizers:

more of the SearchDataCenter article from Mark Fontecchio

In the Midwest, the biggest risk of natural disaster is tornado. Does your data center or Midwest colocation provider have F5 tornado resistant data center facilities?

Hardened data center facilities are reinforced concrete structures with roofing engineered to withstand 135mph plus winds. Lifeline Data Centers offers such facilities at both of their locations. If data center downtime is costly to you, consider outsource data center as an alternative to in-house computer rooms.

Hardened data centers are not the only advantage of outsource computer rooms. Data center capital costs can run easily reach hundreds of thousands of dollars. Maintaining data center certifications and compliance can create an additional FTE burden inside your company.

But be careful. Data center pricing models vary greatly. Look for access to multiple telecom carriers in a carrier neutral data center facility. Look for a provider that charges no cross-connect fees. Flexibility is the key; more choices are better.

If you think outsource data center might be a good solution for your company, give me a call at Lifeline Data Centers, 317.423.2591