Hybrid Cloud Solutions: Amazon Web Service (AWS) and Microsoft Office 365

Can Microsoft Office 365 and Amazon Web Services (AWS) work together?  The answer to this cloud riddle is YES.  

There seems to be an overall confusion between what these Cloud venders provide as services.  To be clear, Amazon Web Services is an Infrastructure as a Service (IaaS) provider and Microsoft Office 365 is a Software as a Service (SaaS).  

In enterprise deployments of Office 365, many organizations have requirements to manage and synchronize user profiles to Office 365, restrict user access, provide secure mobile access, and advanced Exchange/Lync/SharePoint management (Remote PowerShell and management consoles).  

In order to satisfy these requirements, organizations will need to deploy the following components within their controlled environment:

• Mobile Management Solution (Blackberry Enterprise Server 10)
• Active Directory Federation Services (ADFS) internal and proxy
• Exchange and Lync Management Console
• Remote PowerShell for SharePoint, Exchange, Lync, and other Office 365 components

Some of our clients have elected to move these components into their own Virtual Private Cloud (VPC) within Amazon Web Services (AWS) so that they can take advantage of the power of AWS (Elastic, Pay as you go model, network, high availability, etc…) and remove their dependencies on managing their own data centers. Once these components have been deployed they can be configured to integrate/communicate with Office 365 Exchange, SharePoint, Lync, and other Office 365 components.

JHC Technology has also designed and implemented virtual application and desktop technology to run on Amazon Web Services.  We are able to deploy the Microsoft Outlook virtual application as well as other office products on AWS and connect them to Office 365.  In this scenario, users are able to connect to an AWS region and access Outlook either via virtual desktop or virtual application from any device and pull down their Office 365 exchange mail securely.

Organizations should not be tied down to use only one cloud model (IaaS vs SaaS). They should look at their overall requirements and choose an architecture that is flexible enough to expand for future requirements.

James Hirmas is the CEO for JHC Technology.  He can be reached at jhirmas(at)jhctechnology.com,@JHC_JamesHirmas, or connect with him on LinkedIn.

Cloud Isn’t All or Nothing

One of the misconceptions that I run into as I visit potential clients is the amount of access a company like ours has when performing a cloud project for a company or individual.  Invariably, at some point, the question of data visibility comes to the forefront.  It usually goes something like this:  “So are you going to be able to see everything, because we can’t have that!”

The answer to this question is the same as many other answers we give when it relates to highly malleable cloud projects:  “It depends.”

Cloud isn’t an all or nothing endeavor.  Your data doesn’t have anything to do with our work, and whether we get to see the data is totally up to you.  I look at it this way:  A cloud provider, such as AWS, can come to the site at which you’re building your dream home.  AWS will put a Home Depot on the site and then leave.  AWS doesn’t tell you how to build your home, what boards to use, or whether that joint requires a nail or a screw.  All they do is keep the Home Depot stocked.  JHC handles the architecture and deployment, and we know all the best practices when it comes to using the material.  But that’s where it ends.  We can build your house without ever knowing what will go in it.

Your data is the same way.  We don’t need to see it and building your cloud environment isn’t dependent on having any access to it at all.

We are doing one project with a global organization in which we have full control of the cloud infrastructure we are deploying.  This infrastructure is being deployed in an AWS Virtual Private Cloud (VPC).  As part of the creation of the VPC, our client’s requirement was that the VPC only allows access from a specific set of IP addresses.  As it stands, that IP range is limited only to our client’s development servers.  What that means is while we can deploy a server into the AWS VPC, we can’t even verify its operation beyond the fact that the server is running.  We have no access to ping the server or remote into it.  The only access comes from the client’s on-premises machines.

Testing the capabilities of the cloud can provide tremendous insight for an organization.  Many times, involving an outside consultant with cloud experience is also the wise step.  But, don’t fret that you’ll need to give the ol’ “Keys to the Kingdom,” to your consultant.  You can build and test all sorts of services without exposing your data outside your organization.

Matt Jordan is the Cloud Services Manager for JHC Technology.  He can be reached at mjordan(at)jhctechology.com, @matt_jhc, or connect with him on LinkedIn.

DIY, Cloud Style

Unless you’re actively working in the cloud technology space, you’re probably relying on those that are to provide you the cloud services you’ve come to depend on.  One of the biggest pieces of the move to cloud is the use of the cloud for backing up your data.  I know many people that either utilize their own external storage drives or pay a yearly/monthly subscription to backup info to an online vendor.

While an external drive is good, it’s not always there when you need it, and while an online vendor is an easy choice, what do you really know about them?  Can you trust the storage?  Can you trust that they’ll be in business?  Can you trust that they won’t make a mistake and delete your files?

For me, I decided that I wasn’t going to pay for an external drive, and there’s no reason for me to utilize an online vendor.  With Amazon Web Services and the free tier, I pay next to nothing for my small backup account.  This post will walk through the ease of using AWS’s Simple Storage Service (S3) to back up your own information and cut out the expensive hardware and expensive middle man.

If you haven’t done so already, create an AWS account by going to http://aws.amazon.com and clicking “Sign Up”.

1. Once you have your account created, go to the AWS Management Console.  Select S3.  
    
2. From the S3 Dashboard, select Create Bucket.  (Note:  an S3 Bucket is simply a container for your files.  Within Buckets you can have Folders to help organize information.)  
    
3. Once you’ve created the bucket, you will be prompted to enter a name.  Keep in mind that this name is not simply unique to your account, which means you won’t be able to go generic.  You may have to enter a couple of names to find one that works.  I ended up with “demo-test-1” as my bucket name, as an FYI.  As you can note, you also get to select the region in which to store your data.  
   
    
4. Once you’ve named your Bucket, click Create (You can also set up logging for the bucket, if you’d like).
5. You will now have your bucket listed on the S3 dashboard.  
   
     
6. Access the bucket by clicking the Bucket name.
7. You can create folders by clicking on the Actions dropdown and selecting Create Folder.  Simply type the folder name in the line that appears.
8. To upload a file or files, click Actions, then select Upload.  
   
     
9. You will then be prompted to select your files.  Click Start Upload when finished selecting your files.  
   
     

By default, the S3 bucket is accessible only to the user account that created the bucket.  In order to make the bucket available to others, permissions will have to be assigned via AWS Identity and Access Management users or through other permissions that open availability to the public.

Matt Jordan is the Cloud Services Manager for JHC Technology.  He can be reached at mjordan@jhctechology.com, @matt_jhc, or connect with him on LinkedIn.

Password Health: Are Your Passwords Secure Enough?

How healthy is your password?  Do you know what to look for to determine the health of a password? Depending on whom you ask, the answer may differ. In this blog post, I will give you my 2 cents, which could be worth more.

First, how old is your password? 

There is a reason why work requires you to change your password every so often. Standard practice is to change it every 90 days.

Second, how complicated is your password?  

In order to increase the security of your password and decrease the likelihood that someone can easily guess what it is, most employers require that you set password using upper and lower case letters with a variation of numbers and special characters.  The length of a password is also key in maintaining good security practices.

Nowadays there are so many passwords one would need to memorize and keeping track of every single one could get challenging. So lets start by breaking down your most common password categories.

• Banks
• E-mails
• Home
• Social Sites
• Phone
• Computer / Mobile Devices
• Home WiFi network 

Some categories are more important that others so one would think that the passwords are more complicated and therefore harder to break…or are they?

You have to consider that the bad guys are always trying to get into your accounts. However, they usually get into accounts that are weaker than others.  The more difficult the account is to break into the longer it will take the bad guys to get into it.

The bigger corporations have additional security requirements to allow you to get in, which is great, but not fool-proof.  If you are asked for a password and PIN to get into your accounts and you have a habit if picking a PIN that is your birthday, then all the bad guy has to do is know a little bit of info about you and he is in.

For example, do you use your kids, pets or any other identifiable item that is unique to you in your password?  Good security practice suggests you use other criterion that is a little difficult for bad guys to guess.

Here's What I Recommend

I remember I was once advised to use a line in a song, then start replacing certain letters for numbers and special characters. Obviously it has to be something that is easy to remember, but you have to stick with a routine that is easy enough for you to manage.  It doesn’t have to be songs, but maybe a quote from a movie, a poem, a line from a book or even a phrase.  All in all, the password complexity would exist and you can still remember it. I know it takes time, but it can be done. 

Just remember, the longer that password, the more difficult you make it for the bad guys to have to guess it.  So ask yourself these key questions:

• When was the last time you changed your passwords? 
• Are you using common words or names of people and birthdays?
• Are you making your passwords more challenging for hackers to break?

You may even want to consider using password-management software if you find it too difficult to remember all of your passwords. 

Quick Tip:  If you are a Google user (Gmail, Google Drive, Google +, YouTube) , consider using Google Authenticator.  It is a token based app generator that gives users an extra layer of security. 

You just need a smart phone to install the app, but after you install and configure it, all your Google services will require the use of this tool.  It basically generates a code, so when you go to check your e-mail, for example, and you type in your password it will also prompt you for this code (similar to multi factor authentication - MFA)  You can read up more on this here: http://www.google.com/landing/2step/?utm_campaign=en&utm_source=en-ha-na-us-sk&utm_medium=ha

Ernesto Fuller is the Senior Security Administrator for JHC Technology.  He can be reached at efuller (at) jhctechnology.com or connect with him on LinkedIn.