Cloud

How & Why Cloud Security Will Empower Users

50%
50%

Dramatic growth in cloud computing means big changes for enterprises of all sizes and in all markets this year. Bill Kleyman explains why thatís a good thing.

Comment  | 
Print  | 
Comments
Oldest First  |  Newest First  |  Threaded View
CHIRSCHMAN1337
50%
50%
CHIRSCHMAN1337,
User Rank: Apprentice
1/27/2014 | 9:55:14 AM
RSS feeds
Please indicate that content is video in RSS feeds!
Marilyn Cohodas
100%
0%
Marilyn Cohodas,
User Rank: Strategist
1/27/2014 | 10:11:03 AM
Biggest gotchas for empowering users in cloud?
Hi Bill. Can you elaborate on what organizations need to do to optimize user security in the evolving cloud infrastructure? In your work with customers, what are the biggest mistakes you've seen IT departments and CSPs make?
Bill Kleyman
50%
50%
Bill Kleyman,
User Rank: Apprentice
1/27/2014 | 10:48:24 AM
Re: Biggest gotchas for empowering users in cloud?
@Marilyn - There's good news and bad news. Organizations can be proactive and deploy best practices around their cloud and infrastructure security environment.

The bad news is that bad guys are usually not far behind -- and in many cases ahead. In creating a good security platform, there are several things to consider. Compliance and regulation aside, some of the biggest mistakes I've seen revolve around lapsed policies, reactive thinking, and no security testing.

Honestly, it's the little things that can hurt a business. Forgetting to renew an SSL cert, leaving a port open, or not having proper security services running internally. Also, checking your sources helps a lot as well. Let me give you an example, a friend of mine ran an experiment as a part of some research he was working on. He built an Amazon Machine Image (AMI) of a popular penetration testing platform -- which was previously unavailable on EC2. One of his additions to the AMI was a backdoor which would basically just communicate back to his own server, indicating that somebody had turned on his backdoored instance. He could have just as easily built a reverse shell into the image. This basically comes back around to the discussion of data security, as all of your encryption keys, VPN configurations, and potentially passwords are protected by unknown controls, which are of unknown resiliency.

In creating the optimal security platform, consider best practices and also consider the target. This also means constant testing and log keeping. There are a lot of proactive things you can do around security that will certainly help.
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-0914
Published: 2014-07-30
Cross-site scripting (XSS) vulnerability in IBM Maximo Asset Management 6.2 through 6.2.8 and 6.x and 7.x through 7.5.0.6, Maximo Asset Management 7.5 through 7.5.0.3 and 7.5.1 through 7.5.1.2 for SmartCloud Control Desk, and Maximo Asset Management 6.2 through 6.2.8 for Tivoli IT Asset Management f...

CVE-2014-0915
Published: 2014-07-30
Multiple cross-site scripting (XSS) vulnerabilities in IBM Maximo Asset Management 6.2 through 6.2.8, 6.x and 7.1 through 7.1.1.2, and 7.5 through 7.5.0.6; Maximo Asset Management 7.5 through 7.5.0.3 and 7.5.1 through 7.5.1.2 for SmartCloud Control Desk; and Maximo Asset Management 6.2 through 6.2.8...

CVE-2014-0947
Published: 2014-07-30
Unspecified vulnerability in the server in IBM Rational Software Architect Design Manager 4.0.6 allows remote authenticated users to execute arbitrary code via a crafted update site.

CVE-2014-0948
Published: 2014-07-30
Unspecified vulnerability in IBM Rational Software Architect Design Manager and Rational Rhapsody Design Manager 3.x and 4.x before 4.0.7 allows remote authenticated users to execute arbitrary code via a crafted ZIP archive.

CVE-2014-3025
Published: 2014-07-30
Multiple cross-site scripting (XSS) vulnerabilities in IBM Maximo Asset Management 6.2 through 6.2.8, 6.x and 7.1 through 7.1.1.2, and 7.5 through 7.5.0.6; Maximo Asset Management 7.5 through 7.5.0.3 and 7.5.1 through 7.5.1.2 for SmartCloud Control Desk; and Maximo Asset Management 6.2 through 6.2.8...

Best of the Web
Dark Reading Radio