I’m heading to RSA this afternoon, and the weather is already looking cloudy, even before the onslaught of announcements about cloud security this, that, and the other thing. Check out some of the headlines coming from San Francisco:
- Cloud security challenges dominate
- RSA Conference study to reveal cloud frustration
- RSA Conference Adds Focus on Cloud Computing Security
But securing cloud services is the issue that’s likely to be top of mind. Mogull said conference attendees will see a lot of hype from security vendors. Many vendors are merely using the cloud as a service model for their security technology. Others have simply virtualized their appliances to make the technology deployable in hosted virtual environments. Mogull said attendees should look for specifics from vendors.Security experts and vendors need to stop talking superficially about the cloud and start speaking more specifically about the aspects of the cloud they are referring to, said Joshua Corman, research director of enterprise security at The 451 Group, a New York-based analyst firm.Conference attendees should ask vendors whether their product is “in, for or from the cloud,” Corman said. “People are calling everything cloud, and when everything is cloud, nothing is,” Corman said.
As the Trusted Computing Group‘s Opal security standard advances, giving enterprises more choices for mixed-vendor Full-Disk Encryption (FDE), Lenovo and WinMagic have teamed up to offer new Full-Disk Encryption administration software that supports managing both hardware- and software-based FDE options. Publicly debuting the partnership and software at the 2011 RSA Conference in San Francisco, Lenovo hopes the flexibility will help jump start wider adoption, particularly as Opal-ready drives drop in price to just $10 more than non-Opal devices.
“Adoption [of hardware-based encryption] has been slow,” admitted Clain Anderson, a director of Software Business at Lenovo. “I thought, being Mr. Security, that the big interest would be in fewer vulnerabilities and stronger security, but the hottest topic is gaining 6 to 10% performance just for switching.” Those performance gains come from switching to on-drive encryption which takes the work load off the CPU.
Anderson said that Lenovo has embraced the Opal standard, particularly as enterprises have indicated being uncomfortable signing on to any single vendor’s encryption solution. Now that they have assurances that the drives they buy from one vendor will work with solutions from another, they are beginning to come around to the benefits of hardware-based encryption.
“It’s the regulated industries – medical, pharmaceutical, banking, and anyone with significant intellectual property,” he said. “Coca-Cola has their secret formula on here.”
As Abraham Lincoln once said, “A capacity and taste for reading gives access to whatever has already been discovered by others.” In the realm of cloud computing security, there is no more valuable information than the hard-earned lessons of those that have come and adopted before you. Don’t make the same mistakes that have crippled others’ applications and data. Read up on the subject with these widely-reviewed and strongly-recommended titles on the subject:
- Cloud Security and Privacy: An Enterprise Perspective on Risks and Compliance: For anyone who is considering deploying to the cloud – whether on the investor side or practitioner side – this book seeks to explain the risks of moving data to the cloud as well as the ways to secure against them. A collaborative project among Tim Mather, Subra Kumaraswamy, and Shahed Latif, Cloud Security & Privacy explores the security measures relevant to the cloud including security-as-a-service.
- Cloud Security: A Comprehensive Guide to Secure Cloud Computing: Written by senior information systems security consultant Ronald L. Krutz and Chief Security Advisor for Gotham Technology Group, LLC, Russell Dean Vines, this book is a breakdown of the most difficult areas of cloud security. Pick this up if you’re looking for a “guide to helping you find your way through a maze of security minefields.” These days, who isn’t?
- Cloud Computing: Implementation, Management, and Security: From a co-founder of Hypersecurity and and the Senior Director and Chief Security Officer at the Cisco Collaborative Software Group, Cloud Computing is a great overview of the technology, providing definitions, repercussions, as well as pros and cons. Get the history leading up to cloud computing and finish up with profiles of successful cloud computing vendors.
- Web Application Obfuscation: One of the misconceptions about deploying existing applications in the cloud is that security will increase upon deployment. The truth? A faulty application outside the cloud will be just as – if not more – faulty in the cloud. Web Application Obfuscation explores, from an attacker’s perspective, traditional infrastructures and security measures to illustrate common vulnerabilities inherent in many security systems.
- Hacking: The Next Generation: There are many new ways for hackers to reach into your networks, and Hacking seeks to inform users about new hacks as well as attacks aimed specifically at social networking sites, wireless networks and cloud infrastructures.
And one to look forward to…
- Securing the Cloud: Written by a senior associate at Booz Allen Hamilton, Securing the Cloud presents the cloud in the context of existing security frameworks. Whether it’s the roadblocks standing in front of your deployment in the cloud or the adjustments necessary before and after cloud adoption, your concerns and considerations are covered in J.R. Winkler’s forthcoming book from Syngress.
Is an essential security read missing from our list? Let me know in the comments section or send me an email at Melanie@ITKnowledgeExchange.com!
Prepping for RSA, my days this week have been jam-packed with pre-briefings. Most of the announcements I’ve come across have been rather ho-hum: Product line updates, new partnerships, sales goals completed (Got something more exciting? Drop me a line). But one thing that has come up again and again is a more widespread awareness of the dangers of politically or ideologically-motivated attackers, or “hacktivists.” Much of the interest is, of course, stemming from WikiLeaks‘ Cablegate release as well as the planned bank disclosures. But the halo affect has hit far beyond the central players involved: PayPal suffered disruptions, as did a security firm that helped root out the identities of Anonymous attackers.
Several analysts I’ve talked to have said that this awareness is going all the way up to the C-level, and that it brings some real measurable impacts in how attacks are carried out:
- For one, the attacks are not typically planned in the back channels that financially-driven attacks are, but often out in the open, in forums and Facebook.
- All press is bad press: One security-minded firm stated that companies are complaining that any mention in the major media is driving attacks.
- While the tools are often the same (DDoS attacks, data leakage), the participants are a different class, operating from both the inside and the outside in ways that opt more towards disruption and high-profile publicity rather than sustained effort.
Guest blogger David Strom pointed out that many concerns surrounding cloud security can be traced to applications that were faulty long before being deployed in the cloud. Blue Coat’s new web security as a service is one way to keep track of the applications you’re currently deploying in the cloud. Following the model of cloud service itself, the service is pay-as-you-go and based on a subscription system that allows a certain level of customization depending on your company’s needs. The biggest selling point? Your ability to manage and deploy the service from anywhere in the world.
Is all the cloud concern justified? Today’s guest post comes from David Strom, and he argues that while it isn’t the cloud that’s insecure, it might be your own cloud implementation and basic IT policies that are at fault.
With cloud security, sometimes perception trumps reality. Interestingly, a report in May 2010 by Derek Brink of the Aberdeen Group shows that users of cloud-based Web security tools fared better than their on premises equivalents with fewer malware incidents.
Perhaps all the fuss is more about insecure Web applications than the cloud itself. Many of the top Web security exploits – like cross-site scripting and SQL injection – are things that have been around almost since the early days when Web servers were invented, and for some reason still vex many corporate installations. Going to the cloud doesn’t change that: If you have an insecure Web app, it will be just as insecure in the cloud or on a server in your data center.
In an effort to increase government adoption of cloud computing, America’s CIO Vivek Kundra commissioned the National Institute of Standards and Technology (NIST) to create the Guidelines on Security and Privacy in Public Cloud Computing. If the guidelines provide even a working definition of cloud computing and how to secure it, it would appear to be a success. From the report:
Cloud computing can and does mean different things to different people. The common
characteristics most share are on-demand scalability of highly available and reliable pooled
computing resources, secure access to metered services from nearly anywhere, and dislocation of data from inside to outside the organization. While aspects of these characteristics have been realized to a certain extent, cloud computing remains a work in progress. This publication provides an overview of the security and privacy challenges pertinent to public cloud computing and points out considerations organizations should take when outsourcing data, applications, and infrastructure to a public cloud environment.
But the standards aren’t just for the government’s benefit. If you’re company’s considering cloud computing, take some notes on how to secure your own data in someone else’s data center.
Member Batye recently reviewed Stealing the Network: The Complete Series Collector’s Edition for our Bookworm Blog. It’s a collection of fictional stories that takes a look at the possibilities available to hackers with some time and bad intentions. While the collection is meant to be an aid to ethical hackers and security professionals looking to be proactive, it brings up a moral dilemma. How can you ever ensure that the knowledge you’re passing on will be used for good rather than evil?
A question was recently posted in the IT Forums regarding embedding executable files into a JPEG, a common tactic for spreading malware to unsuspecting end users. The community responded with mixed feelings toward the intentions of the asker. Who draws the line between helping out your fellow IT professionals and providing ill intent with the recipe for possible harm?
The simple answer is that no one draws that line except for you. IT Knowledge Exchange doesn’t expect you to provide any information you feel uncomfortable disclosing, and that goes for answering deceivingly innocuous questions. Member Chippy088 shares his own philosophy on the dilemma:
[It’s] not a good idea to help everyone without thinking about their reason for the question first.
Have there been circumstances in your tech career that have made you uncertain about passing on your own knowledge? What are some nuggets of advice you’d want to pass on to those who are new to IT Knowledge Exchange or IT in general?
Despite the progress SaaS has made in the enterprise, security concerns remain a hindrance to the growth of the market. Enter former Salesforce.com executive, Tod McKinnon, now CEO of Okta, with a lofty goal: To accelerate enterprise adoption of cloud and web-based apps.
All the ROI in the world doesn’t mean a thing if your mission-critical apps are a floating security risk. As McKinnon told Newsfactor.com, “Okta is the only enterprise-class, on-demand service purpose built to help customers secure and manage their entire cloud-services network and the people who need access to it, with no professional services required.”
While cloud computing isn’t necessarily moving IT security into uncharted waters, it is highlighting some old vulnerabilities that many organizations just never got around to patching up, from shoddy encryption practices to allowed poor user practices. Leading the way, in both stumbles and recoveries, might be Facebook, which probably has its own recent security struggles more closely watched than any other company.
Phishing for fame and friends
Today, most attacks on corporate infrastructure are driven by monetary gain: Long gone are the days where embarrassing defacements dumped a company’s dirty laundry and embarrassing taunts onto its domain. Instead, the criminals are largely organized, stealthily going in and making off with the valuable digital loot without being noticed until it’s far too late. Facebook still sees its share of these types of criminals. However, its high-profile nature, and mixed track record on privacy, has made it a favored target for the type of attacker who still likes to put on a show. Nicolas Sarkozy’s account was recently hacked, posting a message stating the president would not seek office again (he has made no official statement on his plans). Facebook founder Mark Zuckerberg then had his fan page hacked, pleading for the company to become a ‘social business.’