My company I started working for is looking to move from ArcInfo and MapPoint to an online GIS for easier data access/availability. Obviously the GIS capabilities needed are rather basic, but security is a must. What sort of options are out there? In order to ensure security of data, would we need a hosted platform? Any help would be appreciated!
There are a few companies offering hosted solutions. A few that come to mind are Arc2Cloud, GeoIQ, WeoGeo, etc. Although some of them do not list this on their site, you can contact them and find out more about it.
Personally, I have not used them directly and I prefer another route: using my own gis stack in the cloud.
If you are going to secure it, forget the fact that it is a "GIS" server. The problem is the same as securing a regular server.
Putting the site behind VPN is good advice from Matthew, but IMHO it is also slow.
Another thing to consider is that you can configure most GIS servers to work over https - so that would leave the problem to be standard problem of securing a site through https. Depending on what web server you use, this may or may not be a CPU intensive thing for the server (newer web servers are awesome at making this scale fine).
Of course other people will recommend to use token-based authentication over un-encrypted channels (like std http). Although this may be easier on the bandwidth, it will also mean that you will be open to session sniffing attacks.
Securing a website is a problem that requires knowledge of various attacks, and if you are asking how to "secure it", then most likely you should not be doing it alone.
Just remember that you will not be able to secure it 100% (it is connected to the Internet after-all), you just need to make it harder to break. How hard is up to you.
I found one option: Online GIS and storage by Ovation Solutions
Ovation/DPTS-Online is a web based browser application used to view and order geographically indexed data (eg. seismic or broadcast news). Designed to run securely on the internet, the application is suitable for deployment across multiple organizational divisions operating in spatially diverse locations. Physical storage of the data can be centralized or distributed between organizational divisions.
I would recommend storing your data in PostGIS and serving it through Geoserver. Both free, stable and opensource. Your coworkers can then use the data through a number of interfaces such as mashups, Google Earth, etc... Have a peak at this example.
Geoserver would handle the security... But if you wanted to increase the level of security you could either run everything through a proxy, https or both.
Speed, Security and Ease of Access...these do not tend to go hand in hand. So you've to make a conscious decision which is the most important factor for you and compromise a little on the rest.
Though cloud based solution will give you sufficient security and speed...but many organizations are not willing to put their confidential data onto a cloud, for obvious reasons that they do not "trust" the cloud owner. Going with a well known cloud provider can reduce such risks.
You can have multiple layers of security at the cloud level, but I'm sure it comes with a price!