Risk
8/26/2011
09:07 AM
50%
50%

Salesforce To Acquire Crypto Provider

SaaS provider's purchase of Navajo Systems could help allay some cloud security skeptics' concerns, experts say.

14 Leading Social CRM Applications
Slideshow: 14 Leading Social CRM Applications
(click image for larger view and for slideshow)
Salesforce.com has quietly snapped up an Israeli cloud security encryption firm and is expected to announce the acquisition at its Dreamforce conference next week in San Francisco, Dark Reading has learned. The move by Salesforce to add encryption to its portfolio goes to the heart of reservations about trusting cloud providers to protect their customers' data.

"The number one reason organizations don't adopt cloud computing more broadly is the lack of ability to protect information in the cloud," says Bob West, CEO of EchelonOne. "Salesforce itself doesn't encrypt information, but it does a pretty good job at protecting data [in general]."

One of the key elements to Navajo Systems' technology, a virtual private cloud encryption gateway that encrypts all data before it goes to the cloud, including Salesforce.com, is that the customer controls the encryption keys. "The enterprise should be holding onto the encryption keys so if someone gains access to their information, they don't also have access to the keys," West says.

Salesforce isn't saying just yet how it will incorporate Navajo Systems' technology into its services, nor would a spokesperson for the SaaS firm reveal any details about the acquisition. Navajo Systems did not respond to press inquiries, and its website appears to have been taken down. A message on the site reads: "Navajo Systems has decided to pursue a different strategy," and it includes a contact name.

Security analysts say the acquisition of Navajo Systems by Salesforce could help reassure skeptical organizations looking for providers to offer encryption solutions for locking down their data in the cloud. "It's going to help for some medium-sized enterprises who can now check the box and say my data is encrypted at Salesforce," says John Pescatore, VP and distinguished analyst at Gartner.

But large enterprises don't typically trust their cloud provider to both store their data and encrypt it, he says. "Larger companies don't want their data to ever be decrypted at Salesforce" or other cloud providers, he says. "They want to keep encryption separate from their SaaS."

Read the rest of this article on Dark Reading.

The vendors, contractors, and other outside parties with which you do business can create a serious security risk. Here's how to keep this threat in check. Also in the new, all-digital issue of Dark Reading: Why focusing solely on your own company's security ignores the bigger picture. Download it now. (Free registration required.)

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This is a secure windows pc.
Current Issue
Security Operations and IT Operations: Finding the Path to Collaboration
A wide gulf has emerged between SOC and NOC teams that's keeping both of them from assuring the confidentiality, integrity, and availability of IT systems. Here's how experts think it should be bridged.
Flash Poll
New Best Practices for Secure App Development
New Best Practices for Secure App Development
The transition from DevOps to SecDevOps is combining with the move toward cloud computing to create new challenges - and new opportunities - for the information security team. Download this report, to learn about the new best practices for secure application development.
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-0290
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

CVE-2016-10369
Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

CVE-2016-8202
Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

CVE-2016-8209
Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

CVE-2017-0890
Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.

Dark Reading Radio