Yesterday I wrote about how Lenovo, talking up its new Full-Drive Encryption (FDE) tools, bragged that the technology was used to secure Coca-Cola’s famously guarded secret recipe. Well, that security measure (if accurate) was recently trumped by a 125-year-old vulnerability and an unlikely Black Hat: Ira Glass and NPR’s This American Life, which stumbled upon a 1979 stock photo which, the program’s reporters believe, was actually a photo of the original handwritten recipe.
It’s not the first time the alleged recipe has been released (Wikipedia currently lists a host of candidates), but the release highlights a theme I heard again and again this morning from the wonkier side of RSA: Technology is an incredibly small part of any true security solution. Adi Shamir, the “S” in RSA, made a point of saying that even the bleeding edge in security, and particularly cryptography, can do very little to nothing to stop WikiLeaks-style attacks or even Stuxnet attacks.
The end result is this: Enterprises (and governments) must constantly evaluate the total security scenario and always consider their assets compromised, just like the the NSA does, while evaluating ways to minimize harm.
Whether you’re in San Francisco at RSA 2011 or you’re in the middle of nowhere scouring the Web for updates and insights, we’ve got the A-list of Twitter stars that are on the ground at RSA right now. Click, follow, and keep up. If you’re there, why not send them a message – the worst that can happen is you get even more swag!
@atwalls: Gartner analyst who specializes in infosec practices, enterprise governance, security program management, and more.
@rcheyne: This self-described “hacker of the old-school variety” is also CEO of Safelight Security, a security training company.
@Simply_Security: David Lingenfelter, Information Security Officer at Fiberlink Communications, is sending out highlights and reactions to the goings on in San Fran.
@merrittmaxim: Works in Identity & Access Management at CA Technologies. He’s giving frequent updates on his reactions to what’s happening at RSA.
@jhaggett: This “lover of all things mobile” is at RSA. Whether he’s interacting with other members of the conference or observing a session, Jamie Haggett’s tweets are just as entertaining as they are informative.
@themeworks: Chief Technologist at Palm Tree Technology UK and Mastlabs USA, is tweeting out questions for his fellow RSA-goers and IT enthusiasts alike.
@Reflex_mike: UPDATE! How did we miss Mike Wronski? He’s VP of Product Management at Reflex Systems, and he’s been tweeting the heck out of RSA the past week.
And of course, for official updates on the conference, check out @RSAConference and hashtag #RSAC for more general, up-to-date information. Did we miss anyone? Send me an email at Melanie@ITKnowledgeExchange.com or leave it in the comments section.
Oracle Database Firewall made its public debut here at RSA yesterday, and for a cool $5,000 per processor the software parses incoming SQL statements, picks out risky ones and translates them into something a bit more mundane, adding a new layer of defense against SQL while minimizing the disruption to non-malicious users. It also means a minimal amount of reconfiguration on the part of the database admins: Just drop the firewall in, theoretically, and you’re (theoretically) protected, as one Oracle honcho explains:
“Evolving threats to databases require enterprises to look at new security solutions,” said Vipin Samar, vice president of Database Security, Oracle. “Oracle Database Firewall offers organizations a first line of defense that can stop internal and external attacks from reaching databases. Easy to deploy and manage, Oracle Database Firewall helps reduce the costs and complexity of securing data across the enterprise without requiring any changes to existing applications and databases.”
Read the full press release here.
Once your data is secured in the cloud, where do you secure your backups? Today’s guest post comes from David Strom, and he discusses his experience with one option for backing up the information in your cloud in another cloud.
One of the problems of using online services such as WordPress blogs, Facebook and Twitter is that you can’t easily save the information that you accumulate in the cloud. If you have a WordPress blog, you need to run a regular backup that saves your blog content into an XML file, for example. Now a service from Backupify.com can help. Using Amazon’s Web services and cloud-based storage, they provide backup agents to more than a dozen services, including Google’s Docs, Blogger and Gmail, Zoho, Delicious, Hotmail and Basecamp, YouTube, Tumblr, and general RSS feeds.
Setup for the most part is fairly simple: You have to provide your authentication information, which in some cases is stored in an encrypted place by Backupify. Then the service goes to work on a weekly or daily basis to do the backups, moving your data from its original repository (such as your Blogger blog) to your account on Backupify. You can have the service notify you via email when a successful backup is complete, along with other conditions too. Also, you can download what is stored in your archives using a Web browser. A sample backup history report is shown below.
I’m heading to RSA this afternoon, and the weather is already looking cloudy, even before the onslaught of announcements about cloud security this, that, and the other thing. Check out some of the headlines coming from San Francisco:
- Cloud security challenges dominate
- RSA Conference study to reveal cloud frustration
- RSA Conference Adds Focus on Cloud Computing Security
But securing cloud services is the issue that’s likely to be top of mind. Mogull said conference attendees will see a lot of hype from security vendors. Many vendors are merely using the cloud as a service model for their security technology. Others have simply virtualized their appliances to make the technology deployable in hosted virtual environments. Mogull said attendees should look for specifics from vendors.Security experts and vendors need to stop talking superficially about the cloud and start speaking more specifically about the aspects of the cloud they are referring to, said Joshua Corman, research director of enterprise security at The 451 Group, a New York-based analyst firm.Conference attendees should ask vendors whether their product is “in, for or from the cloud,” Corman said. “People are calling everything cloud, and when everything is cloud, nothing is,” Corman said.
As the Trusted Computing Group‘s Opal security standard advances, giving enterprises more choices for mixed-vendor Full-Disk Encryption (FDE), Lenovo and WinMagic have teamed up to offer new Full-Disk Encryption administration software that supports managing both hardware- and software-based FDE options. Publicly debuting the partnership and software at the 2011 RSA Conference in San Francisco, Lenovo hopes the flexibility will help jump start wider adoption, particularly as Opal-ready drives drop in price to just $10 more than non-Opal devices.
“Adoption [of hardware-based encryption] has been slow,” admitted Clain Anderson, a director of Software Business at Lenovo. “I thought, being Mr. Security, that the big interest would be in fewer vulnerabilities and stronger security, but the hottest topic is gaining 6 to 10% performance just for switching.” Those performance gains come from switching to on-drive encryption which takes the work load off the CPU.
Anderson said that Lenovo has embraced the Opal standard, particularly as enterprises have indicated being uncomfortable signing on to any single vendor’s encryption solution. Now that they have assurances that the drives they buy from one vendor will work with solutions from another, they are beginning to come around to the benefits of hardware-based encryption.
“It’s the regulated industries – medical, pharmaceutical, banking, and anyone with significant intellectual property,” he said. “Coca-Cola has their secret formula on here.”
As Abraham Lincoln once said, “A capacity and taste for reading gives access to whatever has already been discovered by others.” In the realm of cloud computing security, there is no more valuable information than the hard-earned lessons of those that have come and adopted before you. Don’t make the same mistakes that have crippled others’ applications and data. Read up on the subject with these widely-reviewed and strongly-recommended titles on the subject:
- Cloud Security and Privacy: An Enterprise Perspective on Risks and Compliance: For anyone who is considering deploying to the cloud – whether on the investor side or practitioner side – this book seeks to explain the risks of moving data to the cloud as well as the ways to secure against them. A collaborative project among Tim Mather, Subra Kumaraswamy, and Shahed Latif, Cloud Security & Privacy explores the security measures relevant to the cloud including security-as-a-service.
- Cloud Security: A Comprehensive Guide to Secure Cloud Computing: Written by senior information systems security consultant Ronald L. Krutz and Chief Security Advisor for Gotham Technology Group, LLC, Russell Dean Vines, this book is a breakdown of the most difficult areas of cloud security. Pick this up if you’re looking for a “guide to helping you find your way through a maze of security minefields.” These days, who isn’t?
- Cloud Computing: Implementation, Management, and Security: From a co-founder of Hypersecurity and and the Senior Director and Chief Security Officer at the Cisco Collaborative Software Group, Cloud Computing is a great overview of the technology, providing definitions, repercussions, as well as pros and cons. Get the history leading up to cloud computing and finish up with profiles of successful cloud computing vendors.
- Web Application Obfuscation: One of the misconceptions about deploying existing applications in the cloud is that security will increase upon deployment. The truth? A faulty application outside the cloud will be just as – if not more – faulty in the cloud. Web Application Obfuscation explores, from an attacker’s perspective, traditional infrastructures and security measures to illustrate common vulnerabilities inherent in many security systems.
- Hacking: The Next Generation: There are many new ways for hackers to reach into your networks, and Hacking seeks to inform users about new hacks as well as attacks aimed specifically at social networking sites, wireless networks and cloud infrastructures.
And one to look forward to…
- Securing the Cloud: Written by a senior associate at Booz Allen Hamilton, Securing the Cloud presents the cloud in the context of existing security frameworks. Whether it’s the roadblocks standing in front of your deployment in the cloud or the adjustments necessary before and after cloud adoption, your concerns and considerations are covered in J.R. Winkler’s forthcoming book from Syngress.
Is an essential security read missing from our list? Let me know in the comments section or send me an email at Melanie@ITKnowledgeExchange.com!
Prepping for RSA, my days this week have been jam-packed with pre-briefings. Most of the announcements I’ve come across have been rather ho-hum: Product line updates, new partnerships, sales goals completed (Got something more exciting? Drop me a line). But one thing that has come up again and again is a more widespread awareness of the dangers of politically or ideologically-motivated attackers, or “hacktivists.” Much of the interest is, of course, stemming from WikiLeaks‘ Cablegate release as well as the planned bank disclosures. But the halo affect has hit far beyond the central players involved: PayPal suffered disruptions, as did a security firm that helped root out the identities of Anonymous attackers.
Several analysts I’ve talked to have said that this awareness is going all the way up to the C-level, and that it brings some real measurable impacts in how attacks are carried out:
- For one, the attacks are not typically planned in the back channels that financially-driven attacks are, but often out in the open, in forums and Facebook.
- All press is bad press: One security-minded firm stated that companies are complaining that any mention in the major media is driving attacks.
- While the tools are often the same (DDoS attacks, data leakage), the participants are a different class, operating from both the inside and the outside in ways that opt more towards disruption and high-profile publicity rather than sustained effort.
Guest blogger David Strom pointed out that many concerns surrounding cloud security can be traced to applications that were faulty long before being deployed in the cloud. Blue Coat’s new web security as a service is one way to keep track of the applications you’re currently deploying in the cloud. Following the model of cloud service itself, the service is pay-as-you-go and based on a subscription system that allows a certain level of customization depending on your company’s needs. The biggest selling point? Your ability to manage and deploy the service from anywhere in the world.
Is all the cloud concern justified? Today’s guest post comes from David Strom, and he argues that while it isn’t the cloud that’s insecure, it might be your own cloud implementation and basic IT policies that are at fault.
With cloud security, sometimes perception trumps reality. Interestingly, a report in May 2010 by Derek Brink of the Aberdeen Group shows that users of cloud-based Web security tools fared better than their on premises equivalents with fewer malware incidents.
Perhaps all the fuss is more about insecure Web applications than the cloud itself. Many of the top Web security exploits – like cross-site scripting and SQL injection – are things that have been around almost since the early days when Web servers were invented, and for some reason still vex many corporate installations. Going to the cloud doesn’t change that: If you have an insecure Web app, it will be just as insecure in the cloud or on a server in your data center.