Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Comments
In Cloud We Trust: A New Model
Newest First  |  Oldest First  |  Threaded View
Page 1 / 2   >   >>
Marilyn Cohodas
Marilyn Cohodas,
User Rank: Strategist
9/10/2014 | 3:45:21 PM
Re: Data security is going to have to get more granular
thanks for the update, Rich. Keep us apprised of what your experience is at The Gap so we can all learn from it.
rnoguera
rnoguera,
User Rank: Author
9/10/2014 | 3:11:55 PM
Re: Data security is going to have to get more granular
Yes, there are two large SaaS providers - both of which are pure play cloud service providers that have integrated data security within their DNA from the start. Unfortunately, I cannot name them in this forum - but most large enterprises (that I know of anyway) employ their services.

Regarding Gap, we are in the process of deploying the data type paradigm in a manner very similar to what I have  described. Perhaps the greatest (and most rewarding) opportunity throughout, is the education and active collaboration with the business through the type classification process.
Marilyn Cohodas
Marilyn Cohodas,
User Rank: Strategist
9/10/2014 | 11:37:23 AM
Re: Data security is going to have to get more granular
Any organizations come to mind Rick? Where does The Gap fit in this new paradigm? And what were/are the biggest  challenges?
rnoguera
rnoguera,
User Rank: Author
9/10/2014 | 11:35:48 AM
Re: Data security is going to have to get more granular> Some examples?
Great question! Secure data transport, encrypted storage, and strong user authentication are all table stakes. Pushing into the concepts of data usage and user access context are cutting edge.

There are data-centric CSPs in play today that are pushing the bounds of data encryption and identity/context usage analytics. However, these are the relative few - in my experience, a single digit count. However, this is a great advantage to enterprise cloud consumers - because we can influence (if not demand) that level of security being the key service differentiators in the marketplace.

 
rnoguera
rnoguera,
User Rank: Author
9/10/2014 | 11:25:31 AM
Re: Data security is going to have to get more granular
I fully agree. To be fair though, jumping to a '3.0 Data Protection' program - one specific to data type and context of use - requires a bit of corporate maturity (wherein data classification and data type is clearly understood and enforced), a corporate environment that is highly agile (think transformative or still forming).
rnoguera
rnoguera,
User Rank: Author
9/10/2014 | 11:17:52 AM
Re: Data security is going to have to get more granular
Successfully deploying a 'type' versus 'class' based data protection model starts with business education and awareness. While information security practitioners will understand this concept fairly quickly, our business partners typically need a bit of education. For many, this is a somewhat revolutionary approach if only because this attempts to bridge the gap of understanding and explaining why data protection matters. Take advantage of that!

In regards to deployment, I would first recommend confirming that your 'crown jewels' are identical to what your business partners describe them to be. Through this (discovery maybe?) exercise, be opportunisitic and introduce the data type methodology and collaborate on the type assignment with the partner. Ideally, at that point forward you will have the basis - thinking in an opportunities and challenges mindset - to develop the data protection approach best suited to your organization.  
Marilyn Cohodas
Marilyn Cohodas,
User Rank: Strategist
9/10/2014 | 7:53:10 AM
Re: Data security is going to have to get more granular> Some examples?
Very interesting point that "Cloud providers may have in the past taken advantage of business users who were leading the charge to the cloud and who may not have been security savvy, are beginning to realize that customer trust once lost cannot be regained. So, they too are increasingly beefing up their data security."

So what specifically are forward-thinking CSPs offering to their customers in terms of data security and where are they still lagging?

 
ede souza950
ede souza950,
User Rank: Author
9/9/2014 | 7:04:54 PM
Re: Data security is going to have to get more granular
Stay tuned for Rich's reply.  We are seeing the shift in IT security from an infrastructure-based approach, which served very well when assets were primarily housed behind an enterprise perimeter towards a data-centric approach to meet the needs of a cloud-extended enterprise. Many of the organizations we speak to are also educating business users on the value of data and the importance of securing personal, regulated and other sensitive data especially as the business increasingly gravitates towards SaaS applications for mission-critical purposes. Cloud providers may have in the past taken advantage of business users who were leading the charge to the cloud and who may not have been security savvy, are beginning to realize that customer trust once lost cannot be regained. So, they too are increasingly beefing up their data security.
Marilyn Cohodas
Marilyn Cohodas,
User Rank: Strategist
9/8/2014 | 9:41:56 AM
Re: Data security is going to have to get more granular
@ede souza950 and Richard -- What's been your experience in deploying this model (or elements of it) in the real world? I'd be particularly interested to hear from Richard what The Gap is doing or planning to do.
ede souza950
ede souza950,
User Rank: Author
9/5/2014 | 12:25:57 PM
Re: Data security is going to have to get more granular
I agree fully!  Rich and I suggested a tiering as a first step to getting  beyond a a one size fits all  data security approach. Data security needs to be broken down into the granular components you suggest, be contextual and also be based on a lifcycle.
Page 1 / 2   >   >>


Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
The Promise and Reality of Cloud Security
Cloud security has been part of the cybersecurity conversation for years but has been on the sidelines for most enterprises. The shift to remote work during the COVID-19 pandemic and digital transformation projects have moved cloud infrastructure front-and-center as enterprises address the associated security risks. This report - a compilation of cutting-edge Black Hat research, in-depth Omdia analysis, and comprehensive Dark Reading reporting - explores how cloud security is rapidly evolving.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2023-0560
PUBLISHED: 2023-01-28
A vulnerability, which was classified as critical, has been found in SourceCodester Online Tours & Travels Management System 1.0. This issue affects some unknown processing of the file admin/practice_pdf.php. The manipulation of the argument id leads to sql injection. The attack may be initiated...
CVE-2023-0561
PUBLISHED: 2023-01-28
A vulnerability, which was classified as critical, was found in SourceCodester Online Tours & Travels Management System 1.0. Affected is an unknown function of the file /user/s.php. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The expl...
CVE-2023-23628
PUBLISHED: 2023-01-28
Metabase is an open source data analytics platform. Affected versions are subject to Exposure of Sensitive Information to an Unauthorized Actor. Sandboxed users shouldn't be able to view data about other Metabase users anywhere in the Metabase application. However, when a sandbox user views the sett...
CVE-2023-23629
PUBLISHED: 2023-01-28
Metabase is an open source data analytics platform. Affected versions are subject to Improper Privilege Management. As intended, recipients of dashboards subscriptions can view the data as seen by the creator of that subscription. This allows someone with greater access to data to create a dashboard...
CVE-2023-23616
PUBLISHED: 2023-01-28
Discourse is an open-source discussion platform. Prior to version 3.0.1 on the `stable` branch and 3.1.0.beta2 on the `beta` and `tests-passed` branches, when submitting a membership request, there is no character limit for the reason provided with the request. This could potentially allow a user to...