The Minimalist’s Guide to File Security13 Oct, 2015 By: Robert Green
CAD Manager Column: Keep your data safe by checking these key parameters.
Address Cloud Data Risks
In most companies, network file/folder security, as referenced above, is a well understood concept that IT departments can implement easily. But in the rapidly evolving world of cloud data storage, most companies still have a lot of work to do to ensure file security. Before implementing any cloud-based file management system, consider the following issues carefully:
Make sure you can control the apps centrally. If your company will be using a cloud file storage system, you must be able to control permissions from a central administrative console. Allowing 50 users to maintain their own cloud accounts with no ability to backup or control access to those accounts will only lead to a total lack of standards down the road.
Consider employee turnover. If an employee leaves, how will you know if he or she still has access to company data stored in a personal cloud account? Be sure you can revoke the account as you would a company cell phone or network account.
Consider synchronization as a cause of data loss. If a user syncs a cloud storage folder to a network location and then deletes a file in his or her cloud folder, will the file disappear from the company network folder? In many cases the answer to this scenario would be, "Yes," if tools like OneDrive or Dropbox aren't correctly controlled.
In summary, your company must think about cloud applications with the same sense of security, loss control, and legal liability that you would for any other company resource. Just because a cloud utility is cheap or free doesn't mean you don't need to think about it seriously.
Implement Reliable Backup Procedures
Let's face it, you can't always prevent accidental deletion, so having solid backups is critical. Consider my CAD manager's backup protocol approach as the minimum requirement:
Basic incremental backups. Conducted by your IT department automatically — typically every evening — the purpose of this basic backup is to track daily changes to project files and create a disaster recovery platform that can restore most work files should a major loss occur.
Daily cumulative backups. Conducted daily by the CAD manager via an automated process, these backups are designed to create a copy of working project directories as of yesterday's end of work that can be accessed without having to access IT's incremental backups.
Think of backing up daily as your responsibility, relying on IT backups only when disaster strikes. If a user deletes a key model or CAD file, you should be able to restore it quickly. If the building burns down (taking your daily backups with it), then you can rely on IT to deal with the disaster recovery.
Archival backups. Conducted by the CAD manager at key project milestones, such as submittals or release to manufacturing, these backups should serve as the history of any given project and allow you to restore the models, drawings, data, PDFs, and other files that comprised the project at any given milestone.
Keep your backups local. While your IT department may store backups off site or in a cloud account, your backups must be saved to your own desktop. When a user deletes a file and needs it back immediately, you don't want to wait hours for IT to try to locate its backup. I recommend getting a large, high speed portable disc drive (using USB 3.0 at minimum with Thunderbolt, ideally) on your desktop and create your backups there. Ask yourself, "Do I really want to wait hours or days to retrieve a large number of files down from a cloud account over a slow Internet connection – or wait for IT to assist — when I could have the files available immediately on my own backup drive?"
It really does pay to do your own backups so you can respond to data loss promptly, without waiting for IT intervention. Once you get the process automated, you'll never want to function without your own backups again.
As you navigate the on-going barrage of new software and features, never lose sight of the fact that the only thing they produce are files — and the security of those files is of paramount importance. I hope the strategies outlined will help you assess your risk profile and take corrective action if required.
Until next time.