Apr 01 2021

CSA Survey Suggests Cloud Security Is Improving

Category: Cloud computing — DISC @ 12:56 pm
CSA Survey Suggests Cloud Security Is Improving

New research suggests the overall state of cloud security continues to improve at a time when more organizations rely on multiple cloud service providers.

A survey of 1,900 security and IT professionals published this week by the Cloud Security Alliance (CSA) in collaboration with AlgoSec, a provider of network security tools, finds only 11% of respondents said they encountered a cloud security incident in the past year. The most common problems encountered were issues with a specific cloud provider (26%), security misconfigurations (22%) and attacks such as denial-of-service exploits (20%).

When asked about the impact of the cloud outages, more than a quarter of respondents said it took more than half a day to recover.

Despite growing confidence in cloud platforms, however, security remains a major area of focus. Top areas of concern include network security (58%), lack of cloud expertise (47%), migrating workloads to the cloud (44%) and insufficient staff to manage cloud environments (32%). In all, 79% of respondents noted some kind of issue involving IT staffing.

In the report, 52% of respondents reported they employed cloud-native tools to manage security as part of their application orchestration process, with half (50%) using orchestration and configuration management tools such as Ansible, Chef and Puppet. Less than a third (29%) said they used manual processes to manage cloud security.

Less clear, though, is who within the IT organization is responsible for cloud security. More than a third (35%) said their security operations team managed cloud security, followed by the cloud team (18%) and IT operations (16%). Other teams, such as network operations, DevOps and application owners, are all below 10%, the survey found.

Tags: cloud security

Mar 30 2021

Cloud security experts wanted: You can be one of them

Category: Cloud computing — DISC @ 3:22 pm
Cloud security experts wanted: You can be one of them

Tags: ccsp, Cloud security experts

Mar 23 2021

Taking a Security-First Approach to Cloud Migration

Category: Cloud computing — DISC @ 9:22 am
Taking a Security-First Approach to Cloud Migration

The pandemic and lockdowns hit their first anniversary mark, and many companies continue to have their employees work from home for the foreseeable future. Over the past year, organizations have seen how important cloud computing is to business operations.

In fact, according to a MariaDB survey, 40% of respondents said that COVID-19 accelerated their migration to cloud, and IDC found that while cloud spending increased slightly during the early months of the pandemic, other IT-related spending decreased.

If nothing else, 2020 showed organizations the advantages of cloud services. Of course, with more cloud use, there is more cloud risk. With almost all cloud teams working remotely, there has been an uptick in security vulnerabilities and a concern that there are ongoing cloud security issues that have yet to be discovered. Organizations are migrating so quickly to the cloud that security is an afterthought, and that has consequences.

Instead, a new Deloitte study recommended, this move to the cloud should work with cybersecurity as a differentiator to gain consumer trust. “An integrated cloud cyber strategy enables organizations to use security in their transformation in a way that promotes greater consumer trust, especially in today’s digital age,” the report stated. Any migration to the cloud should take a security-first approach.

Why Security First?

With an integrated, security-by-design cloud cybersecurity strategy, organizations can use security in digital transformation as a driver rather than as an afterthought, said Bhavin Barot, a Deloitte risk and financial advisory principal in the cyber and strategic risk practice, in an email interview. Leveraging secure design principles during a digital transformation or cloud migration helps organizations in the following ways, Barot added:

  • Incorporating leading-edge, innovative approaches such as intelligent threat detection.
  • Reducing risks related to technology, insider threats and the supply chain.
  • Elevating the DevSecOps posture for developers and engineers and
  • Establishes a cyber-forward approach that reinforces business objectives, enabling security principles such as zero trust.

Taking a Security-First Approach to Cloud Migration

Tags: cloud computing risks, Cloud Migration, cloud security

Mar 18 2021

With data volumes and velocity multiplying, how do you choose the right data security solution?

Category: Cloud computing,data security — DISC @ 10:00 am
With data volumes and velocity multiplying, how do you choose the right data security solution?

Choosing the right data security solution

Jean Le Bouthillier, CEO of Canadian data security startup Q​ohash​, says that organizations have had many issues with solutions that generate large volumes of (often) not relevant and not actionable data.

“My first piece of advice for organizations looking for the right data security solutions would be to consider whether they provide valuable metrics and information for reducing enterprise data risks. It sounds obvious, but you’d be surprised at the irrelevance and noisiness of some leading solutions — a problem that is becoming a nightmare with data volumes and velocity multiplying,” he told Help Net Security.

They should also analyze the pricing model of solutions and ensure that they are not presenting an unwelcome dilemma.

“If the pricing model for protecting your data is volume-adjusted, it will mean that over time, as data volumes increase, you’ll be tempted to reduce the scope of your protection to avoid cost overruns,” he noted. Such a situation should ideally be avoided.

Another important point: consider returning to basics and ensuring that you have a solid data classification policy and the means to automate it.

“Data classification is the fundamental root of any data security governance because it provides clarity and authority to support standards and other programs like user awareness efforts. In the context of data governance, data visibility and, ultimately, data-centric controls can’t work without data classification,” he explained.

“Think back on the millions of dollars spent on artificial intelligence projects that didn’t result in operational capabilities because little attention was paid to data quality, and accept that data protection projects – like any other ambitious project – can’t succeed without rock-solid foundations.”

With data volumes and velocity multiplying, how do you choose the right data security solution?

Tags: Data security solution

Mar 14 2021

Passing a compliance audit in the cloud doesn’t have to be hard

Category: Cloud computing — DISC @ 9:30 am
Passing a compliance audit in the cloud doesn’t have to be hard

Adding compliance trails in cloud environments

The secret to resolving compliance and security issues before they escalate into costly audit penalties is to proactively add an automated compliance and security management system in the cloud environment. This way your company can take advantage of all the security benefits offered by the cloud provider while also managing other security aspects critical to your company’s operations while also providing an audit trail that can be used to help verify compliance.

In short, your company needs the means to detect specific issues and correct them prior to an official compliance certification audit. The top areas that auditors check are all centered on data access. That’s understandable given that Gartner predicts that “by 2023, 75% of security failures will result from inadequate management of identities, access, and privileges, up from 50% in 2020.”

Cloud security automation can scale along with your workloads in cloud environments and correct compliance issues and security vulnerabilities as they occur. Your company should consider the following when selecting an Identity Access Management (IAM) product to use in cloud environments to automate corrections and ensure compliance.

  • More easily visualize the current IAM posture and get alerts about excessive permissions
  • Get proof of regulatory compliance and data hygiene along with verification that relevant assets can only be accessed from specific areas in the application
  • Monitor any changes in the application that require updates in its security policy
  • If needed, create a new security policy that reflects the needs of each cloud-based asset
  • Ease of deployment in the pre-production and production environments

Source: Cloud services and foggy compliance issues

Cybersecurity for Executives in the Age of Cloud by [Teri Radichel]

Tags: Cloud compliance audit, cloud security

Mar 10 2021

Keeping your serverless architecture secure

Category: Cloud computing — DISC @ 10:19 am
Keeping your serverless architecture secure

In this article, we’ll outline the key areas you should consider if you want to keep your serverless architecture secure. While the solution that best fits your own ecosystem will be unique to you, the following will serve as strong foundations upon which to build your approach.

Keeping your serverless architecture secure

Tags: serverless, serverless architecture, serverless architecture secure

Mar 09 2021

How to mitigate security risks as cloud services adoption spikes

Category: Cloud computing — DISC @ 11:49 pm
How to mitigate security risks as cloud services adoption spikes

The challenges of accelerated cloud adoption

The sheer number of organizations moving to the cloud is staggering: we’re seeing 3-5 years-worth of business transformation happening in just months due to the pandemic. As cloud-enabled digital transformation continues to accelerate, there are a variety of concerns.

For example, the visibility of data. Organizations (and users) must assess what controls cloud services providers offer in order to understand the security risks and challenges. If data is stored unencrypted, that implies significant additional risk in a multi-tenant environment. Or what about the ability of security models to mimic dynamic behavior? Many anomaly detection and predictive “risk-scoring” algorithms look for abnormal user behavior to help identify security threats. With the sudden and dramatic shift to remote work last year, most models require significant adjustments and adaptation.

Normally, companies begin exploring the move to a cloud service provider with a detailed risk analysis assessment. This often involves examining assets, potential vulnerabilities, exploitation probabilities, anticipated breach-driven outcomes, and an in-depth evaluation of vendors’ capacity to effectively manage a hybrid solution (including authentication services, authorization, access controls, encryption capabilities, logging, incident response, reliability and uptime, etc.).

How to mitigate security risks as cloud services adoption spikes

Tags: cloud computing risks, cloud computing security, cloud security

Feb 23 2021

Security Logging in Cloud Environments – AWS

Category: Cloud computing,Security logs — DISC @ 4:33 pm

Which Services Can We Leverage?

AWS offers multiple services around logging and monitoring. For example, you have almost certainly heard of CloudTrail and CloudWatch, but they are just the tip of the iceberg.

CloudWatch Logs is the default logging service for many AWS resources (like EC2, RDS, etc.): it captures application events and error logs, and allows to monitor and troubleshoot application performance. CloudTrail, on the other hand, works at a lower level, monitoring API calls for various AWS services.

Although listing (and describing) all services made available by AWS is out of scope for this blog post, there are a few brilliant resources which tackle this exact problem:

In the remainder of this section I’ll provide a summary of the main services we will need to design our security logging platform. Before doing so, though, it might be helpful having a high-level overview of how these services communicate (special thanks to Scott Piper for the original idea)

Source: Security Logging in Cloud Environments – AWS

Tags: AWS security, Cloud computing, cloud security

May 31 2019

Secure, Share & Edit All Your Files From Anywhere | Box

Category: Cloud computing,File Security,Information Privacy — DISC @ 5:07 am

Secure File Sharing – 256-bit AES encryption

Secure File Sharing: Easily and securely share files—even sensitive or confidential ones—without worry.

Source: Secure, Share & Edit All Your Files From Anywhere | Box




 Subscribe in a reader




Jan 24 2019

Security is the no. 1 IT barrier to cloud and SaaS adoption

Category: Cloud computing — DISC @ 8:32 am

More than 70% of tech professionals said security spending has increased in the past year, according to a Ping Identity report.

Source: Security is the no. 1 IT barrier to cloud and SaaS adoption

  • Cloud Security





    • Tags: cloud security, Cloud Security Alliance

    Jan 20 2019

    8 Tips for Monitoring Cloud Security

    Category: Cloud computing — DISC @ 6:30 pm

    Cloud security experts weigh in with the practices and tools they prefer to monitor and measure security metrics in the cloud.

    Source: 8 Tips for Monitoring Cloud Security

    🔒 securing the business 🔒

    DISC InfoSec

     





    Jan 17 2012

    The Big Shift to Cloud-based Security

    Category: Cloud computing — DISC @ 8:58 am

    Keeping IT systems secure and running within regulatory compliance mandates, especially for mid-sized and even small businesses, seems next to impossible. There are many reasons for this — but fortunately, several recent technological trends show that it doesn’t have to be this way.

    This paper covers how small and medium-sized organizations can manage their IT risks and maintain regulatory compliance with minimal staff and budget.

    Download Paper Now

    Managing Risk in the World of Cloud Computing




    Nov 10 2011

    Cloud services breached via Google code search

    Category: Cloud computing — DISC @ 10:32 pm

    Researchers at Stach & Liu, a security consulting firm, have advised organizations against storing critical information on the public cloud until there are better intrusion detection systems available for cloud services, the Dark Reading website reports.

    The firm made the recommendation after discovering that access codes and passwords to thousands of public cloud services could be found via a simple Google search. The firm first reported the results of their cloud services security research at the Hacker Halted conference in October in Miami, according to Dark Reading.

    “It is not a good idea to put sensitive data out in the cloud right now — at least not until there are intrusion-detection systems that would let users see these types of searches on their cloud services,” Fran Brown, managing director of the firm, told Dark Reading.




    Nov 02 2011

    Inside IT: Cloud Computing & Security

    Category: Cloud computing — DISC @ 2:13 pm

    IT Best Practices: The IT organization is undergoing rapid change. Changes like virtualization and consumerization present new opportunities for business, and new challenges for IT. Cloud computing shifts IT to more of a creator and distributor of services, but brings with it increased security concerns. In this podcast, Alan Ross, who leads the Security Architecture and Technology Development Team at Intel IT, talks about data security, application security, compliance, privacy, and other issues around these evolving technologies.




    Securing the Cloud: Cloud Computer Security Techniques and Tactics


    Cloud Security: A Comprehensive Guide to Secure Cloud Computing


    The Cloud Security Rules: Technology is your friend. And enemy. A book about ruling the cloud.




    Jul 24 2011

    Security as a Service and Office as a Service

    Category: Cloud computing — DISC @ 10:23 pm

    The Windows Intune cloud service helps you centrally manage and secure your PCs through a simple web-based console, whether your IT staff or end users are in the main office, at a branch office, or on the road.

    Click the fig below to see a video of Windows Intune benefits:

    Windows Intune simplifies and helps businesses manage and secure PCs using Windows cloud services and Windows 7—so your computers and users can operate at peak performance, from virtually anywhere

    Take an advantage of this free trial for a month to see if Windows Intune align with your business requirements, help you comply with industry standards and regulations, and if it’s cost effective for your business. To do that you may have to fnd out the total cost of existing infrastructure and support and maintenance fee. Also a gap analysis based on standard or regulation which apply to your business will help to find out how this security as a service can assist you in your compliance effort. We do need to manage and protect our PCs from malwares and it’s cost of doing business these days. For cost analysis, you should keep in mind that implementation of a control (Intune) should not be greater than the cost of the impact of the risk should a malware exploit your network.

    Intune manage updates
    Centrally manage the deployment of Microsoft updates and service packs that you choose to all your PCs from the Windows Intune console.

    Intune protect PCs from malware
    Help safeguard your PCs from the latest threats with centralized endpoint protection built on the award-winning Microsoft Malware Protection Engine and using the same trusted technologies as Microsoft Forefront Endpoint Protection and Security Essentials

    Leverage location agnostic Security as a Service to Defend your information assets

    ** Windows Intune™ – Trial **

    Try Windows Intune™ for 30 days to see how businesses can simplify PC management and security by using Windows® cloud services.
    ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~

    Every business has needs and yours is no different. Your people need to stay connected and you need to maintain essential security and control. So why not have both? Make productivity easier by giving everyone endless ways to work and collaborate from anywhere at any time and on any device. In the cloud you make the rules.

    Leverage access to e-mail, documents, contacts and calendars on nearly any device

    ** Office 365™ – Trial **

    Office 365 trial for professional and small businesses

    Office 365 trial for Kiosk worker plan

    Office 365 trial for Enterprise level plan

    Microsoft Exchange Online Archiving provides an enterprise-class service to assist organizations with their archiving, compliance, regulatory and e-discovery challenges while simplifying their on-premises infrastructure, enabling cost savings and easing the burden on IT.

    ** Exchange Online Archiving™ – Trial **

    Exchange online archiving trial

    Related article:

    City and County of San Francisco Adopts Microsoft Cloud Solution




    Mar 08 2011

    CSA at RSA 2011 – Solving the Cloud Security Equation

    Category: Cloud computing — DISC @ 12:42 pm

    Visibility + Control = Trust





    Federal Cloud Computing Strategy: Cloud First Policy “This policy is intended to accelerate the pace at which the government will realize the value of cloud computing by requiring agencies to evaluate safe, secure cloud computing options before making any new investments.”

    Titles on How to Secure the Cloud ….




    Feb 22 2011

    Businesses deemed lack of security a major concern for cloud computing

    Category: Cloud computing — DISC @ 11:06 pm

    Diagram showing three main types of cloud comp...

    Image via Wikipedia

    By NICK CLAYTON – WSJ.com
    As the much-hyped next big thing in information technology, the cloud in cloud computing seems almost too apt as a metaphor. Constantly moving and changing, impossible to pin down and the closer it gets, the harder it is to distinguish from fog.

    It has divided opinion. On one side are those who believe the cloud represents nothing less than a revolution that will bring a golden age of cheap, efficient and agile computing on tap. Lined up against them are skeptics who have seen variations on these promises for decades, which have never been fully delivered. However, the single biggest concern weighing on the minds of those chief executives looking to embrace cloud technology is security. Once businesses are happy their data is truly safe in the cloud, only then will this technology transform the world.

    To read the remaining article….

    How to manage risks in the world of cloud computing

    Related articles

    How to manage risks in the world of cloud computing




    Sep 15 2010

    Cloud Computing: A Treasure Trove for Hackers

    Category: Cloud computing — DISC @ 10:10 am
    IBM Cloud Computing
    Image by Ivan Walsh via Flickr

    Above the Clouds: Managing Risk in the World of Cloud Computing

    By Dick Weisinger
    Security usually tops the lists of concerns that people have about the cloud. And now it seems like there is good reason. On a recent survey of 100 “elite” hackers at the 2010 Defcon conferenece, 96 of them said that the cloud offered up more opportunity for them to hack. 89 of them said that they thought that cloud providers weren’t being proactive enough in beefing up their security, and 45 of them admitted to already have engaged in cloud hacking, and 12 of them said that they hack for financial gain.

    When asked about what areas of the cloud that they thought were most vulnerable, 21 percent said Software as a Service (SaaS), 33 percent said problems with the Domain Name System (DNS). 16 percent said that cracking the information in log files was on their list of things to hack, and 12 percent said that they’ve hacked into communication profiles.

    Barmak Meftah, chief products officer at Fortify, sponsor of the survey, said that “more than anything, this research confirms our ongoing observations that cloud vendors – as well as the IT software industry as a whole – need to redouble their governance and security assurance strategies when developing solutions, whether cloud-based or not, as all IT systems will eventually have to support a cloud resource.”

    Another highlight at the Defcon conference was a $1500 device that was able to intercept any GSM mobile phone call.

    Related articles by Zemanta




    Tags: Barmak Meftah, Business, Cloud computing, Defcon, Domain Name System, Hacker (computer security), Information Technology, Software as a service

    Jul 27 2010

    What You Can Do About Cloud Computing Security

    Category: Cloud computing — DISC @ 9:13 am

    Cloud computing security risks are sometimes considered greater than cloud’s rewards. The industry is working to change that, and so can you.

    By James A. Martin
    Cloud computing offers many compelling benefits to organizations, such as reduced capital and operating costs and as-needed scalability. So why aren’t more businesses taking advantage of the on-demand computing resources services collectively known as ‘the cloud’?

    Security concerns are easily the number one inhibitor to deploying the cloud,” says Zeus Kerravala, senior vice president of Global Enterprise and Consumer Research, Yankee Group. “It just gives some people cause for concern.”

    How Cloud Technology Enables New Business Models

    Although no form of computing is entirely risk-free 100 percent of the time, cloud computing isn’t necessarily any more or less secure than non-virtualized or non-cloud environments, says Christofer Hoff, director of cloud and virtualization solutions for Cisco’s Security Technology Business Unit and author of the Rational Survivability blog.

    “It’s how organizations deploy and manage cloud computing that makes the difference,” Hoff explains.

    Fortunately, Cisco, its service provider partners and others in the cloud computing industry are collaborating to provide ever-greater security, visibility and control to consumers of cloud services, Hoff adds. And there are plenty of things enterprises can do to take advantage of cloud computing’s benefits without compromising security.

    To read the reamining article ….

     

    Related articles by Zemanta





    Tags: Application Service Providers, Business-to-Business, Cisco, Cloud computing, E-Commerce, Yankee Group

    Jan 22 2010

    How to manage risk in the cloud

    Category: Cloud computing — DISC @ 3:06 am

    What is Cloud Computing and does it provide more protection to your business?

  • Pre-order the Softcover;

  • Pre-order the eBook.

    • Cloud Computing will bring many benefits to organisations, some of which include reducing operating costs, reducing power consumption and freeing you up to focus on your core business.
    The concept of shifting computing to a shared service provider is not new. What may be new is that the cost of Cloud Computing is falling so dramatically that considering outsourcing to the Cloud is no longer rare, and it is now accessible enough that any individual or organisation can use it to their advantage.

    Above the Clouds: Managing Risk in the World of Cloud Computing
    For Cloud Computing to be a viable option, you need to be confident that your business information will be secure and that the service you offer to your customers will still be reliable. So if you want to adopt a Cloud Computing strategy, you need to make sure you carry out due diligence on the service provider before you entrust this firm with your vital data. However, the author challenges the assumption that Cloud Computing will offer less protection to your data than relying on an in-house server. Buy Now!>

    Cloud Computing not only allows you to make economies of scale; it can also offer you the increased security that comes from sharing the resource. The author argues that moving over to Cloud Computing can actually help to defend your organisation from threats such as denial of service attacks, viruses and worms.

    Cloud service providers will tell you that Cloud Computing is bound to be better, faster and cheaper. The reality is that before switching over to Cloud Computing, you need to think carefully about whether it will really work for your business. This book shows you what you need to do to ensure that with Cloud Computing you will continue to give the standard of service your customers require. It also offers you some valuable tips on how to choose your provider of Cloud services.

    Published date: 9th February 2010.

    Pre-order this book using Voucher Code: “cloud2010” to save 10%!

  • Pre-order the Softcover;

  • Pre-order the eBook.

    • Related articles by Zemanta




    Tags: Business, cloud, Cloud computing, cloud computing benefits, cloud computing concerns, cloud computing risks, cloud computing security, cloud security, cloud services, cloudcomputing, Computer Science, Denial-of-service attack, Distributed Computing, due diligence, Economy of scale, Outsourcing, Security

    « Previous Page — Next Page »