Vulnerabilities / Threats
6/4/2010
06:37 PM
Connect Directly
Google+
LinkedIn
Twitter
RSS
E-Mail
50%
50%

Google Explains Security Procedures

In what it describes as a move toward greater transparency, Google has provided details about its security practices in a newly published paper.

In an effort to communicate its commitment to the security of its online services, Google on Friday published a paper that delves into its corporate security strategy.

Eran Feigenbaum, director of security for Google's enterprise group, characterizes the paper as an attempt to be more transparent. It would also be fair to characterize the paper as an attempt to counter the perception that Google's online services are somehow less secure than traditional on-premises systems, a claim often made by Google's competitors.

"Feeling comfortable storing data in the cloud involves trusting a cloud services provider and the practices and policies they have in place," said Feigenbaum in a blog post. "In today's ultra-connected, Web-capable world, understanding how data will be protected is ultimately more meaningful than knowing it is physically located in one data center or another."

Google itself put that trust at risk earlier this year when is disclosed that "a highly sophisticated and targeted attack on our corporate infrastructure originating from China that resulted in the theft of intellectual property from Google."

Part of Google's response to that incident -- said to be made possible as a result of a previously unrecognized flaw in Internet Explorer 6 -- has reportedly been phasing out the use of Microsoft's Windows operating system at the company, a move that may be motivated by marketing concerns in addition to worries about security.

But Google's work making potential customers feel comfortable in its cloud isn't done. In March, Yale delayed a planned move to Google Apps for Education over security concerns. When the City of Los Angeles was considering abandoning its Novell e-mail system for Google Apps and Gmail, similar concerns were raised. The deal ultimately went through but such fears remain.

Google's paper, Security Whitepaper: Google Apps Messaging and Collaboration Products, should help allay those fears. It describes the company's corporate security policies, organizational and operational security, asset classification and control practices, personnel, physical, and environmental security, access control, systems development and maintenance, and disaster recovery efforts.

It may not be quite as fun as, say, the comic book Google used to introduce its Chrome browser, but it's likely to help IT decision makers render more informed judgments about Google's services.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Tech Digest, Dec. 19, 2014
Software-defined networking can be a net plus for security. The key: Work with the network team to implement gradually, test as you go, and take the opportunity to overhaul your security strategy.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-8142
Published: 2014-12-20
Use-after-free vulnerability in the process_nested_data function in ext/standard/var_unserializer.re in PHP before 5.4.36, 5.5.x before 5.5.20, and 5.6.x before 5.6.4 allows remote attackers to execute arbitrary code via a crafted unserialize call that leverages improper handling of duplicate keys w...

CVE-2013-4440
Published: 2014-12-19
Password Generator (aka Pwgen) before 2.07 generates weak non-tty passwords, which makes it easier for context-dependent attackers to guess the password via a brute-force attack.

CVE-2013-4442
Published: 2014-12-19
Password Generator (aka Pwgen) before 2.07 uses weak pseudo generated numbers when /dev/urandom is unavailable, which makes it easier for context-dependent attackers to guess the numbers.

CVE-2013-7401
Published: 2014-12-19
The parse_request function in request.c in c-icap 0.2.x allows remote attackers to cause a denial of service (crash) via a URI without a " " or "?" character in an ICAP request, as demonstrated by use of the OPTIONS method.

CVE-2014-2026
Published: 2014-12-19
Cross-site scripting (XSS) vulnerability in the search functionality in United Planet Intrexx Professional before 5.2 Online Update 0905 and 6.x before 6.0 Online Update 10 allows remote attackers to inject arbitrary web script or HTML via the request parameter.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Join us Wednesday, Dec. 17 at 1 p.m. Eastern Time to hear what employers are really looking for in a chief information security officer -- it may not be what you think.