Vulnerabilities / Threats
6/4/2010
06:37 PM
Connect Directly
Google+
LinkedIn
Twitter
RSS
E-Mail
50%
50%

Google Explains Security Procedures

In what it describes as a move toward greater transparency, Google has provided details about its security practices in a newly published paper.

In an effort to communicate its commitment to the security of its online services, Google on Friday published a paper that delves into its corporate security strategy.

Eran Feigenbaum, director of security for Google's enterprise group, characterizes the paper as an attempt to be more transparent. It would also be fair to characterize the paper as an attempt to counter the perception that Google's online services are somehow less secure than traditional on-premises systems, a claim often made by Google's competitors.

"Feeling comfortable storing data in the cloud involves trusting a cloud services provider and the practices and policies they have in place," said Feigenbaum in a blog post. "In today's ultra-connected, Web-capable world, understanding how data will be protected is ultimately more meaningful than knowing it is physically located in one data center or another."

Google itself put that trust at risk earlier this year when is disclosed that "a highly sophisticated and targeted attack on our corporate infrastructure originating from China that resulted in the theft of intellectual property from Google."

Part of Google's response to that incident -- said to be made possible as a result of a previously unrecognized flaw in Internet Explorer 6 -- has reportedly been phasing out the use of Microsoft's Windows operating system at the company, a move that may be motivated by marketing concerns in addition to worries about security.

But Google's work making potential customers feel comfortable in its cloud isn't done. In March, Yale delayed a planned move to Google Apps for Education over security concerns. When the City of Los Angeles was considering abandoning its Novell e-mail system for Google Apps and Gmail, similar concerns were raised. The deal ultimately went through but such fears remain.

Google's paper, Security Whitepaper: Google Apps Messaging and Collaboration Products, should help allay those fears. It describes the company's corporate security policies, organizational and operational security, asset classification and control practices, personnel, physical, and environmental security, access control, systems development and maintenance, and disaster recovery efforts.

It may not be quite as fun as, say, the comic book Google used to introduce its Chrome browser, but it's likely to help IT decision makers render more informed judgments about Google's services.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-0485
Published: 2014-09-02
S3QL 1.18.1 and earlier uses the pickle Python module unsafely, which allows remote attackers to execute arbitrary code via a crafted serialized object in (1) common.py or (2) local.py in backends/.

CVE-2014-3861
Published: 2014-09-02
Cross-site scripting (XSS) vulnerability in CDA.xsl in HL7 C-CDA 1.1 and earlier allows remote attackers to inject arbitrary web script or HTML via a crafted reference element within a nonXMLBody element.

CVE-2014-3862
Published: 2014-09-02
CDA.xsl in HL7 C-CDA 1.1 and earlier allows remote attackers to discover potentially sensitive URLs via a crafted reference element that triggers creation of an IMG element with an arbitrary URL in its SRC attribute, leading to information disclosure in a Referer log.

CVE-2014-5076
Published: 2014-09-02
The La Banque Postale application before 3.2.6 for Android does not prevent the launching of an activity by a component of another application, which allows attackers to obtain sensitive cached banking information via crafted intents, as demonstrated by the drozer framework.

CVE-2014-5136
Published: 2014-09-02
Cross-site scripting (XSS) vulnerability in Innovative Interfaces Sierra Library Services Platform 1.2_3 allows remote attackers to inject arbitrary web script or HTML via unspecified parameters.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
This episode of Dark Reading Radio looks at infosec security from the big enterprise POV with interviews featuring Ron Plesco, Cyber Investigations, Intelligence & Analytics at KPMG; and Chris Inglis & Chris Bell of Securonix.