October 9, 2015 | Leave a Comment
By Kamal Shah, SVP, Products and Marketing, Skyhigh Networks
If cloud services were used only by employees who worked from the office, on company-issued devices, enforcing cloud policies would be straight-forward. IT Security would simply direct all traffic, for all employees, across all cloud services through a Cloud Access Security Broker (CASB), which would provide the required visibility, threat protection, compliance, and data security for all users.
3 megatrends that make Cloud Security a bit more challenging
Three IT megatrends render this type of simplicity impossible:
- BYOD: According to a CompTIA survey, 47 percent of companies have a Bring Your Own Device (BYOD) policy in place, allowing employees to access corporate data from their own devices. With the BYOD, employees access corporate data in cloud services from a variety of devices, most of which are unmanaged.
- Telecommuting: According to statistics from the American Community Survey, telecommuting has risen 79 percent between 2005 and 2012. With many employees logging hours from home and on the road, it can be difficult to get in the path without forcing users to adopt the dreaded VPN.
- 3rd Party Collaboration: According to Skyhigh’s recent Cloud Adoption and Risk report, the average enterprise collaborates with 1,555 partners via cloud services. Agents and VPN are not options for 3rd parties (many would suggest they aren’t an option for employees on BYOD either), making it impossible to get in path for policy enforcement.
API access offers a frictionless path to visibility, but for companies with policy enforcement requirements, such as real-time DLP with closed-loop remediation, contextual access and collaboration control, and structured and unstructured encryption, a new technique is required in order to get in path and enforce security, compliance, and governance policies.
Skyhigh solves policy enforcement challenges with new, patented technology
Today, Skyhigh announces that the United States Patent and Trademark Office has issued US Patent 9,137,131 for Pervasive Cloud Control. The patent covers SAML-based Identity Provider (IdP) redirection, which enables customers to enforce their cloud security, compliance and governance policies across all devices – managed or unmanaged – and across all user – on-premises, remote, or third party.
Best of all, the solution meets two universal requirements for cloud security and enablement – pervasiveness and zero-friction.
Pervasiveness: It is impossible to circumvent the CASB control point, regardless of the device or user.
Zero-friction: The solution requires no device agents and has no impact to the user experience or the cloud service providers.
Skyhigh Pervasive Cloud Control extends Skyhigh’s leadership in the Cloud Access Security Broker space and enables policy enforcement while supporting BYOD access to cloud services, off-network access to cloud services, and collaboration between employees, customers, and partners.
Three killer use cases for Skyhigh’s Pervasive Cloud Control
BYOD Access to Cloud Services: With Skyhigh Pervasive Cloud Control, IT and Security teams can support BYOD policies while enforcing corporate security, compliance, and governance policies. As an example, a sales person may be authorized to access a Customer Relationship Management service, such as Salesforce, from their personal iPhone to view or update their sales forecast. However, when the salesperson tries to download their monthly forecast to their iPhone, Skyhigh’s Pervasive Cloud Control automatically prevents the download because it violates the company’s security policies.
Off-Network Access to Cloud Services: With Skyhigh Pervasive Cloud Control, IT and Security teams can secure off-network access to cloud services, and best of all they can do so without an agent on the device or VPN access to the corporate network. As a example, an executive needs to download an encrypted file stored on a file sharing and collaboration cloud service, such as Box, while logged in from the airport. Skyhigh’s Pervasive Cloud Control seamlessly decrypts the encrypted file and the executive can access the encrypted file in a readable format
Collaboration Between Employees, Customers and Partners: With Skyhigh Pervasive Cloud Control companies can satisfy security, compliance and governance requirements while collaborating seamlessly with third parties such as vendors, customers, and partners and without breaking business workflows. As an example, while collaborating with a customer’s HR department, a third party HR vendor uploads a document containing PII to the customer’s Office 365 SharePoint site. Skyhigh’s Pervasive Cloud Control flags the file containing PII for policy violation, puts the file in quarantine as the PII is identified, and replaces the file with a tombstone file.
How Pervasive Cloud Control works (according to Gartner)
“Reverse Proxy Mode – This mode involves traffic redirection by making configuration changes to how traffic arrives from clients to the SaaS application. One way this can occur is by configuration applied to the SaaS application so that, during the SaaS authentication workflow, each individual app in question is directed to use the CASB provider as the authentication source. The CASB then forwards the authentication request to the IAM solution, and directs future traffic through it as well. This SAML redirection method is a popular way to force end-user traffic through the CASB so that it can perform inspection, even from unmanaged devices.” — Gartner, Select the Right CASB Deployment for Your SaaS Security Strategy, Craig Lawson, Neil MacDonald, Sid Deshpande, March 2015.
October 7, 2015 | Leave a Comment
By Frank Guanco, Research Project Manager, CSA Global
Last week, the CSA Congress and IAPP Privacy Academy teamed up in Las Vegas, Nevada for the Privacy.Security.Risk. (PSR) conference. This was the second privacy and security conference that the Cloud Security Alliance (CSA) and the International Association of Privacy Professionals (IAPP) co-hosted and the conference was a successful event with cloud security and privacy professionals learning about best practices, the current state of affairs in their respective fields, and cross-training and learning new disciplines. During CSA Congress at PSR, there were a number of releases, events, awards, speakers, and sessions that ran the gamut of the CSA’s Research Portfolio. Below are links that recap some of the activity during CSA Congress 2015 at PSR.
Ron Knode Award Winners 2015
Each year at Congress, the CSA recognizes a few of our members around the globe for their excellence in volunteerism and leadership. Named in honor of Ron Knode, a member of the CSA family who passed away in 2012, these awards are a means toward recognizing members whose contributions have been invaluable. Learn more about the winners of the 2015 Ron Knode Service Awards.
Cloud Security Alliance Releases New Guidance for Identity and Access Management for the Internet of Things
The CSA’s Internet of Things (IoT) Working Group released a new summary guidance report titled Identity and Access Management for the Internet of Things. The Internet of Things (IoT) has been experiencing massive growth in both consumer and business environments. In response to this emerging market and the particular security requirements of these connected devices, the CSA established the IoT Working Group to focus on providing relevant guidance to its stakeholders who are implementing IoT solutions. Get more information on the report.
Cloud Security Alliance Releases New Document on Post-Quantum Cryptography
The CSA’s Quantum-Safe Security working group released their latest document, “What is Post-Quantum Cryptography,” a report that takes a closer look at post-quantum cryptography and what institutions need to know and need to do in order to protect themselves against quantum computers. Read more on the report.
Cloud Security Alliance Research Working Group Sessions
When CSA’s big events happen in North America, like CSA Summit at RSA and CSA Congress at PSR, the CSA’s Research team hosts working group sessions for the various projects, groups, and initiatives that comprise the research portfolio. This year, the following working groups and initiatives gave their updates: Virtualization, Service Level Agreement, International Standards Council, Top Threats, Cloud Controls Matrix, Cloud Cyber Incident Sharing Center, Internet of Things, and the Open Certification Framework. See presentations from CSA Congress at PSR 2015.
Thanks to all that attended CSA Congress at PSR in Las Vegas. It was a successful event and we look forward to seeing everyone at Privacy.Security.Risk 2016 as it returns to San Jose, California from 9/15-16, 2016. Save the date!
October 7, 2015 | Leave a Comment
By Aimee Simpson, Integrated Marketing Manager, Code42
President Obama designated October as National Cyber Security Awareness Month (NCSAM). This U.S. observance is meant to engage, educate and raise awareness of the importance of cybersecurity to our nation. This month, Code42 is celebrating with a series of blog posts, giveaways and juicy content all about protecting your users and network from the growing threats that haunt our digital lives. This post covers one of the darkest, greediest threats out there: ransomware.
Over the last few decades, hundreds of thousands of computer users have had the great misfortune of having messages like these pop up on their screens (see Example A).
Becoming infected with a ransomware program—be it CryptoLocker, CryptoWall, CTB-Locker, TorrentLocker, or one of their many variants—can feel like the digital equivalent of getting mugged. The software encrypts targeted files on the infected computer and holds them hostage until a payment is made when a decryption key is delivered. Demands for payment range from $100-$500, depending on the victim. This past year, several U.S. city police departments admitted to paying ransoms around $500 each for retrieving files that were stolen from them.
(Example A. Screengrab: PCRisk.com)
With criminal groups all over the world reaping exponential rewards, ransomware is now big business. By tracking bitcoin transactions, a computer science grad student reported that on January 15, 2013, a single address associated with ransomware received over $1 million in bitcoin. For criminals in the ransomware game, the average ROI is 1,425%.
With returns like that, it is no wonder that ransomware has grown into an enormous, notorious global extortion machine. It’s one of the web’s most costly nemeses—a true super villain—with an equally evil origin story.
An Evil Villain with an Evil Origin
Ransomware, first known as cryptoviral extortion, was born in 1989. The malware was quaintly distributed on 20,000 floppy disks by post. Instead of an adult website advertisement or an email attachment promising 70 percent off select items at J.Crew—two of the many ways malware distributes and disguises itself today—this first incarnation’s disguise was something much crueler.
The floppy disks, distributed to scientific research institutions throughout 90 countries, were masquerading as AIDS education software. The program became known as the “AIDS Trojan.” When you first inserted the disk, you were taken through a questionnaire that calculated your risk of contracting AIDS. The file encryption was programmed to begin after the computer was rebooted a certain number of times. When their ransom notes arrived—also by post—the victims were instructed to turn on their printers, which spat out the demand for a payment of $189. They had no clue that the seemingly innocent AIDS app was to blame. Payments were made to a P.O. box in Panama. Only then did the victims receive the decryption key—also on a floppy disk in the mail.
After analysis, the code used in this first iteration of ransomware was found to be weak and easily reversible. The story was well covered by British media where the first attacks were reported. The mastermind, Dr. Joseph L. Popp, was a Harvard-educated biologist loosely associated with the victims through the World Health Organization, where he had recently been denied a job. In the end, Popp pled insanity and was set free. (Read the whole story here.)
More important than Popp’s fate, the World Health Organization scandal or the product of the software itself was the concept. In 1989, an idea was born. You could steal someone’s files without physically stealing them. You could blackmail the owner. You could perform cyber extortion.
This legacy left a massively destructive blueprint for a generation of criminals to come. Today’s cybercriminals are smarter, stealthier and have the benefits of ubiquitous Internet connectivity, unbeatable open-source cryptography resources and nearly anonymous online bitcoin depositories. Today, ransomware follows the same pattern as Popps’ AIDS Trojan, only everything is bigger: larger criminal organizations, higher ransom payments and malware with greater reach.
Earlier this year a strain called VirRansom was released. Experts have already dubbed it, “the AIDS of ransomware.” How evil! How…fitting.
October 6, 2015 | Leave a Comment
By Krishna Narayanaswamy, Co-founder and Chief Scientist, Netskope
Today we released our Cloud Report for Fall 2015 – global as well as and Europe, Middle East and Africa versions. Each quarter we report on aggregated, anonymized findings such as top used apps, top activities, and top policy violations from across our customers using the Netskope Active Platform.
This season we focus primarily on app usage and data policy violations by industry grouping as well as activities in cloud apps. Plus, we distill that information down into a few “quick wins” for IT. Here’s an overview:
Industry App Usage
For the first time, this report breaks down trends by industry group, focusing on five key groupings with similar usage characteristics. They are:
- Healthcare and life sciences;
- Financial services, banking, and insurance;
- Retail, restaurants, and hospitality;
- Manufacturing; and
- Technology and IT services
The average number of cloud apps per enterprise climbed from 715 in our last report to 755, with 91.2 lacking in the areas of security, audit and certification, service-level agreement, and other key attributes that we adapted from the Cloud Security Alliance’s Cloud Controls Matrix. Technology and IT services saw the highest number of cloud apps, with an average of 1,157 apps per enterprise, with healthcare and life sciences a close second, with 1,017.
Industry Data Policy Violations
A key area of focus for us this season is Data Loss Prevention (DLP) in the cloud. Healthcare and life sciences enterprises had the highest number of DLP policy violations in content at rest in sanctioned apps, with 21.1 percent of files scanned matching at least one DLP profile, such as personally-identifiable information (PII), payment card industry information (PCI), protected health information (PHI), source code, profanity, and “confidential” or “top secret” information. The second highest was Technology and IT services, with 14.2 percent. Overall, healthcare and life sciences enterprises accounted for the vast majority of total DLP policy violations (for both content at rest and en route to and from cloud apps), at 76.2 percent of the total. Not surprisingly, when we drill deeper into violation type, PHI makes up the bulk of such violations in cloud apps, at 68.5 percent. A full run-down on data violations by industry is in the report.
Activities In The Cloud
The top five cloud app activities in this season’s report include “send,” “post,” “login,” “download,” and “view.” Activities associated with data leakage or exposure, such as “share” and “download,” are alive and well in key app categories such as Cloud Storage, HR, and Business Intelligence. In Cloud Storage, for every “login,” there are four “shares.” Within HR, “download” is the fourth most common activity. And within Business Intelligence, “share” – an activity many don’t expect even to be available in this category – is the top activity.
Three Quick Wins For Enterprise It
Based on this report’s findings, here are some quick wins for enterprise IT to enable cloud apps while minimizing risk:
- Discover and secure sensitive content both at rest in and en route to your cloud apps. Focus on most common DLP violations that carry penalties and can result in negative press, including PHI, PII, and PCI.
- In defining cloud app policies, consider not just popular Cloud Storage, Social, and Webmail apps, but also focus on business-critical apps like HR, Finance/Accounting, and Business Intelligence.
- Go beyond coarse-grained “allow” or “block” decisions on cloud apps, and enforce contextual policies on risky activities such as “download” (e.g., to mobile), “share” (e.g., outside of the company), or “delete” (e.g., if you’re not in the enterprise directory group “HR Directors”).
What are your quick wins for dealing with cloud app risk? We want to hear them!
October 6, 2015 | Leave a Comment
By Frank Guanco, Research Project Manager, CSA Global
You are sitting at your computer about to login to your bank account to complete a transaction. Did you notice the lock icon on the browser address bar? If you didn’t, you’re not alone. Most people pay little attention to the lock icon on their browser address bar that signifies a secure HTTPS connection. They don’t realize that there is an exchange of keys to assure that the communications are secure and a signature with the data to assure its integrity. But what if that connection is not secure and cannot be trusted? Now think about the situation on a global scale. Such unsecured communications could be devastating, potentially making eCommerce, Cloud applications and storage, Online Stock Trading, and anything that relies on HTTPS, useless.
While it may seem like doomsday, this scenario is possible in the not-too-distant future. The US National Security Agency (NSA) and the Chinese government, as well as researchers and engineers at universities and corporations, are all working to create a quantum computer with enough computing power to break the secure HTTPS connection. Thankfully, solutions exist today that can resist quantum computing attacks and avoid this economic Armageddon. Post-quantum cryptography refers to the different classes of new cryptographic algorithms that are currently believed to resist quantum computer attacks. The most pressing issue today is these cryptographic algorithms need to be proactively in place several years before quantum computers are available. That’s why it is necessary to start integrating post-quantum algorithms in cryptographic protocols today.
Today, the Cloud Security Alliance’s (CSA) Quantum-Safe Security Working Group released “What is Post-Quantum Cryptography,” a report that takes a closer look at post-quantum cryptography and what institutions need to know and need to do in order to protect themselves against quantum computers.
Current secure HTTPS communications rely on an exchange of keys generated by asymmetric cryptography to ensure that the parties are who they say they are. Once these keys are exchanged, the data is then encrypted with symmetric cryptography and signed with asymmetric cryptography. A quantum computer could potentially run on an algorithm that could be used to break asymmetric public-key cryptography schemes. Protection, however, is not far off. Post-quantum symmetric cryptography does not need to be changed significantly from current symmetric cryptography, other than by increasing current security levels. With a few security tweaks and some careful planning, organizations can start preparing now for the post-quantum computer world
To learn more about post-quantum cryptography and to read the entire report, please visit here. For more details about CSA and its Quantum-Safe Security working group, please visit the Cloud Security Alliance.
October 2, 2015 | Leave a Comment
By Jim Reavis, CEO, Cloud Security Alliance.
I would like to thank my friends at Code42 for again giving me a platform to talk about the cloud security issues on my mind. In this blog post, I wanted to discuss some of the changes I am seeing in how security professionals are rethinking best practices as a result of being exposed to cloud computing and what some of the security priorities are as organizations begin to depend upon a critical mass of cloud services.
From comfortable stasis…
Traditional IT systems have been characterized as being static in nature. Indeed, I spent the first 20 years of my career focused on architecture, implementation and security of traditional computer networks. File servers, routers, firewalls and hosts would be carefully sized, designed and put into production, with the hope that they could go years without a single reboot. We valued stability perhaps most of all, and would even develop odd, fond relationships with servers—treating them a bit like favorite pets. Systems would be patched and upgraded of course, but only when deemed absolutely necessary, and only after significant research and regression testing of the updates.
The information security solutions that grew up around this environment recognized the relative permanence of these systems and developed their security strategies accordingly. Detection and prevention of viruses, performing forensics on breaches and several other tasks are carefully integrated with systems, lest we disturb these permanent servers. Sometimes we couldn’t even eradicate malware, as the cure (a reboot with downtime) was worse than the disease. These static systems are actually very fragile.
To ephemeral clouds
By contrast, cloud computing is highly dynamic. We turn services on or off at will. Virtual machines are very transient, not eligible for pet names, unless as part of a cloud orchestration tool we are instantiating Rover001..RoverNNN. This ephemeral cloud is causing security professionals to tackle problems differently. Instead of a painstaking malware mitigation program, why not just turn the virtual machine off, start a new VM and point it at your data sets? Maybe we don’t care about all of the malware details from an operational perspective when we can just make it go away and start over.
This is just one example. The reality is, I don’t think we as a security community have yet grasped all of the implications of cloud computing’s essential characteristics, and have not employed enough imagination yet to replace our security strategies with brand new approaches; but clearly the wheels are turning. It is exciting to see the experts start with a blank slate, rather than duplicating a questionable security tool in cloud.
New approaches to old (and new) security problems
As we are in this phase of transitioning to cloud, security professionals are seeking their ground zero for sound security strategies. Many organizations are starting with their data and working outward from there. A lot goes into protecting data, so I’ll just mention a few priorities. Strong authentication is becoming so common, that it makes an old security professional positively giddy. When you think about some of the early so-called cloud breaches, they were actually not direct attacks on cloud providers, but account takeovers caused by attacks upon a user’s ID and password. We have a lot more to implement here, but it is going in the right direction. Closely related is identity federation. We simply cannot afford to have an employee’s login credentials stored at hundreds of provider locations and must federate our directories rather than duplicating them.
Encryption has proven to be a remarkably resilient security control. When you have the option, take it. CSAexpounds upon the importance of customer control of keys to create an appropriate separation of duties. The challenge for encryption going forward is to make it applicable in as many cloud use cases as possible. Notably, providing encryption for Software-as-a-Service (SaaS) is an important area CSA is focused on, with our new OpenAPI working group seeking to provide an approach that creates seamless encryption that works across any cloud provider.
Taking new approaches to old security problems is a great thing to see. Of course cloud will bring some interesting new security problems, but we’ll leave that for another blog post.
(This post first appeared on Code42’s blog Data on the Edge)
September 29, 2015 | Leave a Comment
By Cameron Coles, Sr. Product Marketing Manager, Skyhigh Networks
Given the explosive growth of cloud computing and numerous high-profile security and compliance incidents, it’s not surprising that surveys of IT leaders find that cloud tops the list of security priorities this year. In its latest technology overview (download a free copy here), Gartner gives a detailed overview of the emerging security category called cloud access security brokers (CASB) that offer a control point for enforcing security policies across cloud services. By 2016, Gartner predicts 25% of enterprises will secure their cloud usage using a CASB, up from less than 1% in 2012. Organizations across all industries are deploying CASB solutions because they enable them to migrate to the cloud securely.
As corporate data moves to the cloud and employees access data from mobile devices, they bypass existing security technologies. Gartner says this has created a “SaaS security gap”. In response, many organizations have attempted to block cloud services en masse using their firewall or proxy. However, with thousands of cloud services available today, organizations block the ones that are well known and that causes employees to seek out lesser-known, potentially riskier cloud services that are not being blocked. CASB solutions will, according to Gartner, enable IT to shift from the “no” team to the “let’s do this and here’s how” team.
Gartner’s 4 Pillars of Required CASB Functionality
Gartner organizes CASB capabilities into four pillars of required functionality: visibility, compliance, data security, and threat protection. While cloud providers are starting to offer some limited policy enforcement capabilities, one benefit of using a cross-cloud CASB solution that addresses each functional area, says Gartner, is that an organization has a centralized place to manage and enforce policies. Since capabilities vary widely among cloud providers (and even CASB vendors) this also ensures a consistent set of controls across cloud services.
|Visibility||Compliance||Data Security||Threat Protection|
|Gives organizations visibility into users, services, data, and devices.||Provides file content monitoring to find and report on regulated data in the cloud.||Adds an additional layer of protection including encryption.||Analyzes traffic patterns to identify compromised accounts and malicious usage.|
Using cloud access security brokers, organizations can:
- Identify what Shadow IT cloud services are in use, by whom, and what risks they pose to the organization and its data
- Evaluate and select cloud services that meet security and compliance requirements using a registry of cloud services and their security controls
- Protect enterprise data in the cloud by preventing certain types of sensitive data from being uploaded, and encrypting and tokenizing data
- Identify threats and potential misuse of cloud services
- Enforce differing levels of data access and cloud service functionality based on the user’s device, location, and operating system
CASBs Have Multiple Deployment Models
While many CASBs leverage log data from firewalls and web proxies to gain visibility into cloud usage, Gartner defines two major deployment architectures that CASB solutions use to enforce policies across cloud services: proxies and APIs. In proxy mode, a CASB sits between the end user and the cloud service to monitor traffic and enforce inline policies such as encryption and access control. CASBs can leverage a forward proxy, reverse proxy, or both. Another deployment mode is direct integration to specific cloud providers that have exposed events and policy controls via their API. Depending on the cloud provider’s API, a CASB can view end user activity and define policies.
Certain security capabilities are dependent on the deployment model, and Gartner recommends organizations look to CASB solutions that offer a full range of architecture options to cover all cloud access scenarios. They also note that vendors offering API-based controls today are not well-positioned to extend their platforms to include proxy-based controls given the significant investment needed to develop a robust proxy architecture that scales to the large data volumes exchanged between end users and cloud services. Depending on industry regulations, customers may also look for on-premises proxy solutions, so Gartner recommends looking for a vendor that offers both on premises and cloud-based proxy models.
CASB Evaluation Criteria
According to Gartner, while many providers focus on limited areas of the four CASB functionality pillars, most organizations prefer to select a single CASB provider that covers all use cases. Gartner recommends that organizations carefully evaluate CASB solutions based on multiple criteria. One consideration is how many cloud providers the CASB solution can discover and the breadth of attributes tracked in the CASB’s registry of cloud providers. Another consideration is whether the CASB supports controls for the business-critical cloud services currently in use or planned in the near future.
Finally, Gartner notes that the CASB market is crowded and expects that consolidation will occur and some vendors will exit the market in the next five years. A good predictor of whether a vendor will continue operating is whether they are one of the leaders in the market in terms of customer traction. Companies with more customers will naturally have a more complete view of customer needs, which will enable them to develop better solutions to meet those needs that will, in turn, attract more customers and support a sustainable business. To read more about Gartner’s view of the market, I encourage you to download a free copy today.
September 22, 2015 | Leave a Comment
By Susan Richardson, Manager/Content Strategy, Code42
It’s been almost 18 months since Symantec officially declared antivirus software “dead” in an interview with the Wall Street Journal. So why did a recent study by ESG find that 73 percent of enterprises have at least two AV products deployed and nearly one-third use three or more?
With antivirus, more is less
In the face of industry reports that AV software is only 50 percent effective in identifying malware, it seems that many enterprises are adopting a “more is better” mindset: More AV products mean a bigger database of known malware “signatures,” which increases the chances of catching malware before it breaches the enterprise environment—right?
Wrong. Deploying multiple AV products might expand the total number of known malware signatures in your AV armor, but this approach doesn’t combat the biggest flaw: new, zero-day malware that no AV product has ever encountered (and therefore can’t possibly recognize). Even with frequent updates to the signature database, AV software just can’t keep up. The September 2015 release of Symantec’s AV product includes a total of 37 million malware signatures. But the AV-TEST Institute registers over 390,000 new pieces of malware every single day—and sophisticated cybercriminals are doing their own QA, running new malware against common AV products to make sure they will go undetected.
As AV piles up, productivity goes down
It’s a game of cat and mouse that you’re destined to lose, and it’s eating up your IT budget—and hampering productivity. IT staff have to learn and configure multiple platforms, and all your staff are impacted by the frequent required updates. And if you’ve ever run a manual AV scan, you know that your computing capacity is reduced to a crawl.
Focus on detection and response
AV software remains a valuable first line of malware defense—and often a requirement for regulatory compliance. But instead of investing time and money in layering AV products on top of each other, enterprises need to shift to a “detect and respond” mindset. This means leveraging a centralized, real-time repository of all the data in your enterprise environment—including laptops and other mobile endpoints—to enable ongoing forensic analysis that will catch aberrations and anomalies across your entire system.
With this progressive security approach, you have the power to quickly isolate malicious code, identify where it entered and what data was affected in the environment, and mitigate the impacts of the breach. You might not be able to stop a new piece of malware from breaching your environment, but you’re in a strong position to corner the “mouse” before it does serious damage.
September 16, 2015 | Leave a Comment
By Susan Richardson, Manager/Content Strategy, Code42
Oceans of ink have already been spilled extolling Uber’s innovative practices and growing profits, but here’s one aspect getting less attention: How the company’s nearly 100 percent cloud-based business empowers its vast network of mobile workers (the drivers):
- Uber drivers have instant connectivity: Uber drivers enjoy instant connectivity to Uber’s cloud-based network at any time, from any place. This allows Uber to instantly deploy drivers and respond in real-time to demand.
- Uber drivers get the convenience of BYOD: Uber gives their drivers the freedom and convenience of a true BYOD environment. Drivers simply install the secure Uber app on the mobile device of their choosing. With no equipment or training, Uber has virtually no onboarding costs for adding new drivers.
- Drivers’ devices aren’t major security threats: Since no private Uber data is stored on drivers’ mobile devices, both Uber and their drivers don’t have to sweat the security risk of a driver losing a device (or having it stolen).
- Drivers can switch devices without downtime: Drivers can quickly bounce back from a lost or stolen device, as well as easily switch to a new mobile device — without losing days or weeks of productivity.
- Drivers can count on Uber uptime: Uber’s cloud-based service has significantly less risk of downtime, so drivers don’t have to worry about being stuck without access to Uber’s servers.
All of this adds up to a mutually beneficial relationship between Uber and its vast network of drivers. Uber drivers are drawn to the reliable service and convenience of the cloud-based platform, and Uber reaps the benefits of greater productivity from this empowered mobile workforce.
Like Uber, Like Everyone
Over the last year, the mobile workforce grew to nearly 100 million in the U.S. and Gartner expects that by 2017, 70 percent of all workers will conduct business via their personal devices. Like Uber, enterprises in every industry are increasingly finding themselves in charge of huge mobile workforces—and scrambling to maximize the opportunity of mobile productivity. Like Uber, the modern enterprise can look to cloud-based services to solve this challenge by:
- Leveraging the cloud to enable BYOD convenience and reliable anytime-anywhere connectivity for mobile workers
- Deploying sophisticated cloud storage and automated endpoint backup to gain complete visibility of employee data
- Mitigating and rapidly remediating risk by knowing who had what data when in the event of lost or stolen devices
September 15, 2015 | Leave a Comment
As with their counterparts in North America, organizations across Europe are eagerly embracing cloud computing into their operating environment. However, despite the overall enthusiasm around the potential of cloud computing to transform their business practices, many CIOs have real concerns about migrating their sensitive data and applications to public cloud environments. Why? In essence, it boils down to a few core areas of concern:
- A perceived lack of clarity in existing Cloud Service Level Agreements and security policy agreements
- The application, monitoring, and enforcement of security SLA’s
- The relative immaturity of cloud services
These issues of course are far from new and, in fact, great progress has been made over the past five years to address these and other concerns around fostering greater trust in cloud computing. The one threat that is present across these issues is transparency – the greater transparency that a cloud service provider can provide into their approach to information security, the more confident organizations will be in adopting and trusting public cloud providers with their data and assets.
To this end, the European Commission (EC) launched the Cloud Selected Industry Group (SIG) on Certification in April of 2013 with the aim of supporting the identification of certifications and schemes deemed “appropriate” for the European Economic Area (EEA) market. Following this, ENISA (European Network and Information Security Agency) launched their Cloud Certification Schemes Metaframework (CCSM) initiative in 2014 to map detailed security requirements used in the public sector to describe security objectives in existing cloud certification schemes. And of course, the Cloud Security Alliance has also played a role in defining security-specific certification schemes with the creation the CSA Open Certification Framework (CSA OCF) which works to enable cloud providers to achieve a global, accredited and trusted certification.
Beyond defining a common set of standards and certifications, SLA’s have become an important proxy by which to gauge visibility into a Cloud provider’s security and privacy capabilities. The specification of security parameters in Cloud Service Level Agreements (“secSLAs)” has been recognized as a mechanism to bring more transparency and trust for both cloud service providers and their customers. Unfortunately, the conspicuous lack of relevant Cloud security SLA standards has also become a barrier for their adoption. For these reasons, standardized Cloud secSLAs should become part of the more general SLAs/Master Service Agreements signed between the CSP and their customers. Current efforts from the CSA and ISO/IEC in this field are expected to bring some initial results by 2016.
This topic will be a key theme at this year’s EMEA Congress, taking place November 17-19 in Berlin, Germany, with a plenary panel on “Cloud Trust and Security Innovation” featuring Nathaly Rey, Head of Trust, Google for Work as well as a track on Secure SLA’s which is being led by Dr. Michaela Iorga, Senior Security Technical Lead for Cloud Computing, NIST.
To register for the EMEA Congress, visit: https://csacongress.org/event/emea-2015/#registration.