Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Cloud

How & Why Cloud Security Will Empower Users

50%
50%

Dramatic growth in cloud computing means big changes for enterprises of all sizes and in all markets this year. Bill Kleyman explains why thats a good thing.

Comment  | 
Print  | 
Comments
Newest First  |  Oldest First  |  Threaded View
Bill Kleyman
50%
50%
Bill Kleyman,
User Rank: Apprentice
1/27/2014 | 10:48:24 AM
Re: Biggest gotchas for empowering users in cloud?
@Marilyn - There's good news and bad news. Organizations can be proactive and deploy best practices around their cloud and infrastructure security environment.

The bad news is that bad guys are usually not far behind -- and in many cases ahead. In creating a good security platform, there are several things to consider. Compliance and regulation aside, some of the biggest mistakes I've seen revolve around lapsed policies, reactive thinking, and no security testing.

Honestly, it's the little things that can hurt a business. Forgetting to renew an SSL cert, leaving a port open, or not having proper security services running internally. Also, checking your sources helps a lot as well. Let me give you an example, a friend of mine ran an experiment as a part of some research he was working on. He built an Amazon Machine Image (AMI) of a popular penetration testing platform -- which was previously unavailable on EC2. One of his additions to the AMI was a backdoor which would basically just communicate back to his own server, indicating that somebody had turned on his backdoored instance. He could have just as easily built a reverse shell into the image. This basically comes back around to the discussion of data security, as all of your encryption keys, VPN configurations, and potentially passwords are protected by unknown controls, which are of unknown resiliency.

In creating the optimal security platform, consider best practices and also consider the target. This also means constant testing and log keeping. There are a lot of proactive things you can do around security that will certainly help.
Marilyn Cohodas
100%
0%
Marilyn Cohodas,
User Rank: Strategist
1/27/2014 | 10:11:03 AM
Biggest gotchas for empowering users in cloud?
Hi Bill. Can you elaborate on what organizations need to do to optimize user security in the evolving cloud infrastructure? In your work with customers, what are the biggest mistakes you've seen IT departments and CSPs make?
CHIRSCHMAN1337
50%
50%
CHIRSCHMAN1337,
User Rank: Apprentice
1/27/2014 | 9:55:14 AM
RSS feeds
Please indicate that content is video in RSS feeds!
AI Is Everywhere, but Don't Ignore the Basics
Howie Xu, Vice President of AI and Machine Learning at Zscaler,  9/10/2019
Fed Kaspersky Ban Made Permanent by New Rules
Dark Reading Staff 9/11/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-14540
PUBLISHED: 2019-09-15
A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to com.zaxxer.hikari.HikariConfig.
CVE-2019-16332
PUBLISHED: 2019-09-15
In the api-bearer-auth plugin before 20190907 for WordPress, the server parameter is not correctly filtered in the swagger-config.yaml.php file, and it is possible to inject JavaScript code, aka XSS.
CVE-2019-16333
PUBLISHED: 2019-09-15
GetSimple CMS v3.3.15 has Persistent Cross-Site Scripting (XSS) in admin/theme-edit.php.
CVE-2019-16334
PUBLISHED: 2019-09-15
In Bludit v3.9.2, there is a persistent XSS vulnerability in the Categories -> Add New Category -> Name field. NOTE: this may overlap CVE-2017-16636.
CVE-2019-16335
PUBLISHED: 2019-09-15
A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to com.zaxxer.hikari.HikariDataSource. This is a different vulnerability than CVE-2019-14540.