Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Cloud

3/5/2018
05:00 PM
Kelly Sheridan
Kelly Sheridan
Slideshows
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail

6 Questions to Ask Your Cloud Provider Right Now

Experts share the security-focused issues all businesses should explore when researching and using cloud services.
2 of 7

Which responsibility belongs to which company?
'I think you're only going to be as successful as the relationships you build,' says Mike Santimaw, VP of information security, innovation labs and corporate solutions at Rent-A-Center. The company has been moving to a serverless architecture and working with AWS.
'We had to check quite a few boxes,' Santimaw explains. 'Having an honest conversation around what AWS' responsibilities were was vitally important.'
There is a shared responsibility between cloud providers and their enterprise customers, Gartner's Judd explains, noting that some security controls are implemented by the provider, some are implemented by the customer, and some are shared between the two. An example of this, he says, is with identity and access management (IAM). A cloud provider will give the customer access to their cloud subscription, and the organization will implement controls to let employees and stakeholders access the data in the environment.
(Image: Aila Images via Shutterstock)

Which responsibility belongs to which company?

"I think you're only going to be as successful as the relationships you build," says Mike Santimaw, VP of information security, innovation labs and corporate solutions at Rent-A-Center. The company has been moving to a serverless architecture and working with AWS.

"We had to check quite a few boxes," Santimaw explains. "Having an honest conversation around what AWS' responsibilities were was vitally important."

There is a shared responsibility between cloud providers and their enterprise customers, Gartner's Judd explains, noting that some security controls are implemented by the provider, some are implemented by the customer, and some are shared between the two. An example of this, he says, is with identity and access management (IAM). A cloud provider will give the customer access to their cloud subscription, and the organization will implement controls to let employees and stakeholders access the data in the environment.

(Image: Aila Images via Shutterstock)

2 of 7
Comment  | 
Print  | 
Comments
Newest First  |  Oldest First  |  Threaded View
Navigating Security in the Cloud
Diya Jolly, Chief Product Officer, Okta,  12/4/2019
US Sets $5 Million Bounty For Russian Hacker Behind Zeus Banking Thefts
Jai Vijayan, Contributing Writer,  12/5/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: Our Endpoint Protection system is a little outdated... 
Current Issue
Navigating the Deluge of Security Data
In this Tech Digest, Dark Reading shares the experiences of some top security practitioners as they navigate volumes of security data. We examine some examples of how enterprises can cull this data to find the clues they need.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-3667
PUBLISHED: 2019-12-11
DLL Search Order Hijacking vulnerability in the Microsoft Windows client in McAfee Tech Check 3.0.0.17 and earlier allows local users to execute arbitrary code via the local folder placed there by an attacker.
CVE-2019-19719
PUBLISHED: 2019-12-11
Tableau Server 10.3 through 2019.4 on Windows and Linux allows XSS via the embeddedAuthRedirect page.
CVE-2019-19720
PUBLISHED: 2019-12-11
Yabasic 2.86.1 has a heap-based buffer overflow in the yylex() function in flex.c via a crafted BASIC source file.
CVE-2019-19707
PUBLISHED: 2019-12-11
On Moxa EDS-G508E, EDS-G512E, and EDS-G516E devices (with firmware through 6.0), denial of service can occur via PROFINET DCE-RPC endpoint discovery packets.
CVE-2019-19708
PUBLISHED: 2019-12-11
The VisualEditor extension through 1.34 for MediaWiki allows XSS via pasted content containing an element with a data-ve-clipboard-key attribute.