Risk

11/17/2010
12:36 PM
50%
50%

Cloud Consortium Releases Security Compliance Tools

Free governance, risk management, and compliance stack from the Cloud Security Alliance aims for data-handling and security transparency.

Slideshow: Cloud Security Pros And Cons
Slideshow: Cloud Security Pros And Cons
(click image for larger view and for full slideshow)

The Cloud Security Alliance (CSA) on Wednesday announced the release of a new governance, risk management, and compliance stack for cloud computing. The suite of cloud security tools, available for free download, is meant to help organizations create public and private clouds that comply with industry standards for accepted governance, risk, and compliance (GRC) best practices.

The GRC stack has three components: a technical foundation, a controls framework, and a questionnaire for assessing what the CSA calls "industry-accepted ways to document what security controls exist" for infrastructure-, platform-, and software-as-a-service offerings.

Philippe Courtot, chairman and CEO of Qualys, sees the framework as a big step in the right direction, both for assuaging customers' concerns as well as keeping vendors honest. "As cloud computing is rapidly changing the way we do business, such a framework is essential [for] ensuring that our data is secure and that cloud computing vendors adhere to privacy and regulatory requirements," he said.

Of course, businesses are already adopting cloud computing, driven by its relatively low cost and ease of management. By 2012, predicts a report from Gartner, 20% of businesses will own no IT assets, instead just renting them.

But according to a recent survey from Novell, half of businesses still see the state of cloud computing security as a barrier to adoption, and 81% have compliance-related concerns over storing data in the cloud.

What constitutes an acceptable level of cloud-based data security? According to Scott Charney, corporate VP for Microsoft's trustworthy computing group, "cloud computing brings tremendous benefits to business, but these models also raise questions around compliance and shared responsibility for data protection."

With luck, this framework will help foster agreement about what constitutes cloud security, as well as verification that any given cloud provider's approach complies with GRC best practices.

RSA, for example, said it would build the framework into its Archer eGRC platform, which is part of its RSA Solution for Cloud Security and Compliance. "Gaining visibility into service provider environments and governing them according to overall enterprise GRC strategy have emerged as major concerns for organizations when considering the use of public cloud services," said Eric Baize, senior director of cloud security strategy at RSA, which is part of EMC.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
20 Questions to Ask Yourself before Giving a Security Conference Talk
Joshua Goldfarb, Co-founder & Chief Product Officer, IDDRA,  10/16/2017
Printers: The Weak Link in Enterprise Security
Kelly Sheridan, Associate Editor, Dark Reading,  10/16/2017
Hyatt Hit With Another Credit Card Breach
Dark Reading Staff 10/13/2017
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Security Vulnerabilities: The Next Wave
Just when you thought it was safe, researchers have unveiled a new round of IT security flaws. Is your enterprise ready?
Flash Poll
The State of Ransomware
The State of Ransomware
Ransomware has become one of the most prevalent new cybersecurity threats faced by today's enterprises. This new report from Dark Reading includes feedback from IT and IT security professionals about their organization's ransomware experiences, defense plans, and malware challenges. Find out what they had to say!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-0290
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

CVE-2016-10369
Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

CVE-2016-8202
Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

CVE-2016-8209
Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

CVE-2017-0890
Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.