To address privacy concerns that can fog up a business’ journey to the cloud, one online storage provider is taking a “zero-knowledge” stance.
SpiderOak launched a “Blue” tier to its portfolio of services, billing it as “the world’s first truly private enterprise-class cloud storage system.” According to the company, “businesses retain complete ownership and administration of all their data.” What’s more, SpiderOak assures customers that its employees can’t view the data stored on its cloud, even if they’re served with a subpoena.
In a company blog post, Ben Zimmerman, a developer at SpiderOak, explains how confidentiality is maintained. “Even if we wanted to access your data or received a subpoena to do so, we could never turn over plaintext data. This is accomplished by encrypting all data on your machine before it is sent to us, using encryption keys generated from your password,” he writes.
It’s an approach necessitated by leaky cloud infrastructures, said IT-Harvest’s Chief Research Analyst, Richard Stiennon.
“The industry has experienced several high-profile internal data breaches which can ultimately be traced back to the fact that data was easily accessible to employees and IT staff. As the cloud storage market continues to mature, privacy will continue to play a critical role in terms of a multi-tiered security infrastructure,” said Stiennon in a company statement.
“You can’t lose what you can’t see — this is the essence of the ‘Zero Knowledge’ approach,” he added.
SpiderOak: Blue helps SMBs integrate the company’s cloud storage platform with Windows installers (32- and 64-bit) and by extending LDAP/Active Directory support. It also supports RSA SecurID for authenticated access. Reporting, user provisioning and permissions management functions are available via a web-based dashboard.
SpiderOak: Blue OpenLicense (OL) allows the end users of organizations like universities to take full responsibility of data ownership with one big caveat. SpiderOak: Blue OL cannot change or reset user passwords.
SpiderOak: Blue Plus is an enterprise-grade variant that “places all management control into an open-source virtual machine (VM) that runs on company infrastructure,” according to the firm. Key escrow tech and private master keys keep visibility into an organization’s data outside SpiderOak’s purview. Additionally, Blue Plus offers user account management via Microsoft Active Directory, OpenLDAP, and RedHat Directory Server. Password management support includes LDAP bind and RADIUS.
SpiderOak employs capacity-based pricing, leaving it up to organizations to impose per-user limits.