jump to navigation

The world of Information Security This Week -Jan 25th to 29th 2010 January 29, 2010

Posted by Michael Stephenson in Cloud Computing, Cloud Computing Security, compliance, Data Loss Prevention, Identity Management, Information Security, Risk Mamagement.
Tags: , , , , , , , , , , , , , , , , , , , , , , , , ,
add a comment

A quick look at the highlights of this week‘s news in the world of Information and Cloud Computing Security for busy people.

I have always found that keeping up with what is happening in the world of information security was very time consuming. There are lots of newsletters and publications to read through. If you tried read it all thoroughly and pick out what is really interesting and relevant it would leave little time to get on with the day job.

In this blog I have picked out what I think are the highlights of this week’s newsletters and publications and given a brief summary and the links to the sources so you can get more detail on each of them if you want it.

I will appreciate your comments on whether you find this valuable and worth my time continuing. Do you think I have missed anything important, is this  still too long  for busy executives and consultants to get through. Please  let me know what you think in the comments.

New Releases

Facebook Security Suite A security suite for Facebook has been launched by Websense. Working as a Facebook application it allows you to configure your protection level and block URLs and content being posted and use keywords to block.                                                                                                                                                 <http://www.readwriteweb.com/archives/websense_launches_first_ever_security_suite_for_facebook.php>

HP Security Services announcement Hewlett-Packard Co. today announced an extensive security-services portfolio that includes more than 90 basic offerings for application, identity and access management security to business continuity, cloud computing and managed services aimed at businesses and government. http://www.computerworld.com/s/article/9147999/HP_unveils_extensive_security_services_package?source=CTWNLE_nlt_security_2010-01-25>

Virtualisation Security Cisco, NetApp and VMware Tuesday announced a project to improve the security of virtualization deployments, with a focus on isolating applications that use the same physical network, server and storage resources in multi-tenant systems. The collaboration is designed to help customers to link the Cisco, NetApp and VMware products together in a way that protects them from dangers that crop up in multi-tenant environments  http://www.networkworld.com/news/2010/012610-cisco-netapp-vmware-security.html?source=NWWNLE_nlt_security_identity_2010-01-27>

Apple iPad Last, but by no means least, is the announcement of the Apple iPad which gives another mobile device for which security needs to be considered as people bring them into the enterprise and migrate corporate business information onto them.                                                                                                                                               http://www.scmagazineuk.com/apple-launches-the-ipad-to-huge-fanfare-but-questions-are-asked-about-its-capability-and-security/article/162537/>

Cloud Computing

The G-Cloud Whitehall has unveiled plans for a government cloud computing environment which will see applications moving from data centres allowing the government to reduce the number of data centres it has to support. It should also allow the sharing of applications between government departments. The whole project is expected (hoped) to cut hundreds of millions from the public sector’s IT spend. Let’s hope it does that and doesn’t become one more government project for the taxpayer to pour our hard earned money into.     http://www.silicon.com/management/public-sector/2010/01/28/inside-the-g-cloud-whitehalls-grand-cloud-computing-plan-unveiled-39745380/?s_cid=931>

10 Questions to ask about Cloud security CA cloud security expert, Tim Brown, gives ten questions you should think about before you make the move into Cloud Computing. These questions focus on the business risks of cloud computing and form an excellent base to build your plans for any cloud computing project to ensure that it will not adversely impact the business.                                                                                                                                    http://www.cio.com/article/524214/Cloud_Security_Ten_Questions_to_Ask_Before_You_Jump_In?page=1&taxonomyId=3024>

Identity and Access Management

Microsoft passes SAML 2.0 test Microsoft’s federated identity platform passed its first SAML 2.0 interoperability test this week with favourable marks. The tests are  part of the Liberty Alliance and Kantara Initiative multivendor interoperability testing. This should mean an end to the vendor’s resistance to the standard.     http://carolynramon376.blogspot.com/2010/01/microsoft-passes-its-first-saml-20.html>

CA and others take part in Kantara workshop CA, NTT, Ping Identity, Oracle Corporation among others will be taking part in the Kantara Initiative’s annual workshop at the RSA Conference, March 1, 2010, http://kantarainitiative.org/wordpress/2010/01/kantara-initiative%e2%80%99s-annual-workshop-march-1-2010-promises-to-be-educational-packed-day/?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+kantarainitiative+%28Kantara+Initiative+Blog%29&utm_content=My+Yahoo>

The Kantara Initiative for those who haven’t come across it is a non profit organisation set up to address the harmonisation and interoperability challenges that exist between enterprise identity systems, Web 2.0 applications and services, and Web-based initiatives. Its Mission Statement can be seen at the link below. http://kantarainitiative.org/confluence/display/GI/Mission>

PCI

The Payment Card Industry Security Standards Council (PCI SSC), announces plans to improve the training and oversight of PCI QSA certification of individuals who conduct PCI Data Security Standard (DSS) compliance. This should give more consistency in the implementation of PCI initiatives by companies who need to meet this standards, hopefully improving the protection these organisations give to their card holder data.

http://searchsecurity.techtarget.com/news/article/0,289142,sid14_gci1379712,00.html>

Passwords

Users still bad at choosing passwords An analysis of 32 million passwords shows that users still are not very good at picking secure passwords. “12345” is the most popular along with “password” which is often a default just left in place.                                                                                                                                                                            http://www.computerworld.com/s/article/9147138/Users_still_make_hacking_easy_with_weak_passwords?source=CTWNLE_nlt_security_2010-01-22>

To help solve the problem I came across this set of tips on creating more secure passwords which I thought was very useful. Something you could pass on to users as part of a security awareness training session.     http://www.networkworld.com/news/2010/012210-creating-secure-passwords-you-can.html?page=1>

Mergers and Acquisitions

Oracle’s acquisition of Sun comes neared now they have gained approval for the take over from the European Union.                                                                                                                                                                               http://www.scmagazineuk.com/oracle-moves-closer-to-sun-microsystems-acquisition-after-eu-approval/article/162047/>

As the combining of these two organisations comes nearer it is obviously making its potential competitors begin to think about what sort of competition they are going to face as we see from the announcement by HP and Microsoft of investment to integrate their hardware and software systems.                                                       http://www.informationweek.com/cloud-computing/blog/archives/2010/01/hp_and_microsof.html?cid=RSSfeed_IWK_ALL>

Security Risks and data losses

Facebook launches a new platform feature that will enable developers to request email addresses from their users, increasing the security risk to users as email information is stored.                                                                              http://www.scmagazineuk.com/facebook-changes-to-its-application-platform-could-lead-to-security-nightmare-as-users-email-addresses-will-be-collected-and-stored/article/162052/>

Users less inclined to share on social networking sites In a survey of 4,500 consumers worldwide conducted by the RSA division of EMC, 65 percent of the respondents said that they are now less likely to share information via online social networks due to security concerns.                                                              http://www.itbusinessedge.com/cm/blogs/vizard/rsa-survey-online-security-confidence-crisis-coming/?cs=38826>

MoD Security breaches The MoD has admitted that security breaches have occurred due to the use by their staff of social networking sites, raising the question again of whether businesses should allow their staff access to these sites from work.                                                                                                                                                       http://www.computerweekly.com/blogs/tony_collins/2010/01/mod-admits-16-breaches-of-secu.html>

Data loss at the cleaners Other ways of people losing data and leaking confidential information continue to be high on the list of security risks that having people in the system introduce. A UK Survey shows that in the past year 4,500 flash drives were left at the cleaners and 12,500 mobile devices were left in cabs.                               http://www.computerworld.com/s/article/9147100/Storage_wrinkle_4_500_flash_drives_left_at_the_cleaners?source=CTWNLE_nlt_security_2010-01-22>

Ladbrokes data  risk Ladbrokes is investigating the loss of thousands of customer details from one of its databases, but is reassuring gamblers that the information did not include bank details or passwords. The information on this suspected leak was given to the Information Commissioner’s Office.                                                        http://www.theregister.co.uk/2010/01/25/ladbrokes_data_fail/>

500K Fines for data loss These sort of incidents become more critical to UK organisations as the Information Commissioner’s Office take powers expected to come into force from April that mean that Companies that lose individuals’ sensitive personal data will face a fine of up to £500,000.                                                           http://www.silicon.com/technology/security/2010/01/13/500k-data-loss-fine-could-hit-from-april-39745328/>

http://www.computerweekly.com/Articles/2010/01/27/240089/report-data-breaches-or-risk-tougher-sanctions-warns.htm>

Security ROI

The Cyber Security Watch survey, conducted by CSO Magazine with the U.S. Secret Service, Carnegie Mellon University CERT and Deloitte & Touche, shows organisations are beginning to wonder if they are getting any return on their security investments. One reason this may arise is because very rarely do organisations take any measures of the benefits of a project. They fail to take reference statistics before the project is initiated and if the project completes reasonably successfully they do not take any measurements of the expected improvements, so I think these findings are likely to be very subjective, but certainly will be of concern to security vendors as perception is as good as reality in the way customers feel about a project’s success.                                                                                                              http://www.csoonline.com/article/518764/Companies_on_IT_Security_Spending_Where_s_the_ROI_?source=CSONLE_nlt_update_2010-01-26>

Mitigating the risks of cloud computing January 15, 2010

Posted by Michael Stephenson in Cloud Computing, Cloud Computing Security, compliance, Information Security, Risk Mamagement.
Tags: , , , , , , , , , , , ,
1 comment so far

Having talked in an earlier post about the risks of cloud computing, which would seem to reduce the cost and competitive benefits to be had from moving to this way of running your business, let’s now look at how we can overcome some of these risks so we can safely reap the benefits of cloud computing services.

If you recall the risks I covered were:

  1. Loss of control of your data
  2. Disruption of service
  3. Compliance and regulation
  4. Security

Most of these risks should be mitigated by your cloud computing services provider, after all one of the benefits of using cloud computing services is that you will not have the cost of mitigating these risks for yourself. So it is most important that in the commercial and legal negotiations that you have with your provider you ensure that these protections are provided.

To ensure the safety of your business, your IT functions and your information you need to have the ability  to monitor and audit how the supplier meets their contractual obligations to handle the risks you face – i.e. to make sure they are doing what “they said on the tin”. It is no use to your business to know that you can get compensation for any failures, which will probably only be paid after lengthy and expensive legal action, if that failure has closed the business down.

So what do we need to consider in each of the risk areas and what questions do we need answered and guaranteed by the provider?

  • Loss of control of your data – Here you need to know what the supplier is going to do in respect of the risks to your data. How will it be protected from unauthorised access, disclosure, loss or alteration? How will the data be backed up – how quickly can it be restored? Will they be able to guarantee the data is really no longer accessible by anyone when it is deleted?
  • Disruption of service – some of this risk falls on you the user in that you will need to ensure your own communication links are robust, have sufficient capacity and are resilient so that you can be sure of always having a connection to the service. The service provider’s responsibility is to ensure that the service is always available, during contracted hours, and that your data is always accessible when you need it. To achieve this they need to have proper business continuity processes defined and operational. Perhaps they will offer back up data centre’s to which you can connect in the case of failure (you need the connection to be transparent to your users). You need to check and audit that their offering works for you and your users in all situations.
  • Compliance and regulation – whilst the provider will be implementing the controls on the services they provide for you, the responsibility for meeting the regulatory requirements for your business remains with you. You can look for certifications such as the ISO 27000 range from your provider to judge their own standard of security. However you will need to understand your compliance needs for this service, and you may have to ask the provider to go beyond their own standards to meet specific controls that apply to you and this service. There is a plan to introduce a new certification specifically for cloud computing providers. The Cloud Security Alliance, whose mission statement is “To promote the use of best practices for providing security assurance within Cloud Computing, and provide education on the uses of Cloud Computing to help secure all other forms of computing”, is working with others on this and we can expect to see something in the first half of 2010.
  • Security – here you will need to work with your cloud supplier. You should identify the risks to your business and information, and your cloud supplier needs to identify the risks that their service is facing, and together you will define and implement a set of controls that will mitigate the risks your business faces in the cloud environment. There is some help available here in the form of the report produced by the European Network and Information Security Agency ENISA which can be accessed here. This report describes the benefits and risks and provides recommendations for information security in the cloud. There is also a document available from the “Cloud Security Alliance” which gives guidance on the security measures needed in a cloud environment.

So there are things that can be done to make it safe for your business to use cloud computing services and reap the great benefits to be had.

One fairly simple precaution that you can take to protect your business is to test out your venture into cloud computing on a non business critical service. That way you can learn as you go without crippling the business. Don’t put the business’s “Crown Jewels” out to cloud computing until you are confident in your supplier and in your own expertise in managing cloud computing services.

The risks of cloud computing December 14, 2009

Posted by Michael Stephenson in Cloud Computing, Cloud Computing Security.
Tags: , , , , , , , , , , , , ,
add a comment

In my last post I talked about the huge benefits and competitive advantage to be had for business by using cloud computing services. However, like everything else in life, all is not sweetness and light; there are some downsides to using these services. The good news is that these issues are not insurmountable; you can do something about it.

In fact the risks you face are the same as the risks that you face with any computing application that is running in house. The difference here is that someone else will be mitigating these risks for you.

But first let’s look at what the risks are.

Loss of control of your data – this includes the risk of data theft, data destruction,  corruption and disclosure – How the data is backed up – You are putting your business data into someone else’s computers so you need to be sure they are going to take good care of that data.

Disruption of service – if the cloud service you are using is business critical and the provider’s service goes down then you will have a major problem; the loss of any service is going to cause problems and inconvenience at the least. To avoid this you will need to think about how you, or the provider, will deal with this situation.

You also are placing extra reliance on your own communications links so will need to see they are resilient.

Compliance and regulation – one aspect of this is the compliance requirements of your organisation. You will need to ensure that the cloud provider is meeting all the requirements that you are subject to for the information it is handling on your behalf. This is critical for your business as the responsibility and liability remains with you even though someone else is implementing the compliance requirements.

Another aspect to consider is the location of the cloud provider’s systems that are hosting your services and information. You will need to check whether that location means that your business falls within a different jurisdiction that imposes different or additional compliance requirements on you.

Security is one of the biggest risks facing you as you move to cloud computing services. It is seen by some commentators as the stumbling block to the take up of cloud computing services. There is the security of communication between you and the provider as you are conducting your business over communication links to remote computer systems, and there is the security of your business information as it is stored, processed and moved on the provider’s IT systems.

Despite these risks we are seeing more and more take up of cloud computing services, so businesses are either find ways to mitigate these risks, or are finding the business benefits so large that they are willing to take the risk. More worryingly, there are some who are ignoring or are unaware of the risks and are potentially putting their businesses, which might be holding your personal data, in danger.

In a future posting I will look at the steps that can be taken to mitigate some of these risks.

Why go for Cloud Computing? December 7, 2009

Posted by Michael Stephenson in Cloud Computing.
Tags: , , , , , , , , ,
add a comment

Why go for cloud computing?

I recently attended a workshop run by ISSA (The Information System Security Association) on cloud computing  where I was part of a group of security professionals discussing the benefits of cloud computing; in effect asking the question “why would a business want to make use of cloud computing services?” We also went on to consider the risks of taking that step why you may think twice before considering a cloud computing solutions, you should certainly think at least once! – But more of that later.

In this first posting I will look at some of the reasons a business might wish to consider a cloud computing solution.

We can see from the fact that cloud computing is such a hot topic these days that there must be something in it for business. Of course the concept is not new – it is using the same business model that was used in the days of batch computing bureaus where you get someone else to do your computing and pay for the service. The improvements in networking and the growth of the internet have now made it practicable to offer this service on line today.

So what will your business get out of Cloud Computing?

Cost Savings

The benefit that probably sits at the top of the list is cost savings – in today’s economic climate we all need to make savings wherever we can and anything which offers the ability to cut the IT budget is going to be worth looking at. Reducing cost and complexity is shown to be the largest issue facing organisations in the next 12 months according to a recent IDG Research survey carried out for Citrix, and this is one of the things cloud computing can do for your IT operation.

If someone else is running the business application for us then we can reduce the IT infrastructure we need, that means less hardware and software costs, less staff needed to run and maintain our systems – no need for complex and costly software upgrades and patching schedules, and a reduction in power bills with less hardware to run.

We can save on training costs as we don’t need skilled staff to manage our business applications or our IT systems.

The result is that you can not only save, but also move cost from the capital budget to operations budget, which frees up capital to be focused on core business functions to improve competitiveness.

Improved Quality of Service

Cloud computing also gives us the possibility of better quality of service. Because the provider is delivering the same service to many organisations they have the opportunity to become expert in that service, rather than it being one of the many tens or hundreds of applications the IT department are trying their best to support, usually with too few resources.

Green Credentials

We will also be supporting the world’s Green Environment initiative in that we are reducing our resource consumption – although we are using some resource from the service provider, because they can make economies of scale the final environmental impact should be much smaller.

Business Agility

A major benefit to your business of using cloud computing services is the agility it provides to be able to respond quickly to changing market needs. As business requirements change you can much more easily move to different cloud services or engage new ones to meet your needs much faster than you would of you had to build a capability in your own data centre. This gives you a huge competitive advantage. It is also a big advantage to start up companies – a new idea can be brought to market faster by cutting out the need to build a data centre and the relevant business applications. You can buy in the services from existing providers.

So there is a lot to be said for using cloud computing services to improve profitability and give your organisation the competitive edge that may make the difference between success and failure in today’s difficult marketplace.

Of course all these benefits don’t come without a price – and I don’t mean only the service charges – there are risks involved and I will look at these in a future posting.