Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Comments
In Cloud We Trust: A New Model
Newest First  |  Oldest First  |  Threaded View
Page 1 / 2   >   >>
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
9/10/2014 | 3:45:21 PM
Re: Data security is going to have to get more granular
thanks for the update, Rich. Keep us apprised of what your experience is at The Gap so we can all learn from it.
rnoguera
50%
50%
rnoguera,
User Rank: Author
9/10/2014 | 3:11:55 PM
Re: Data security is going to have to get more granular
Yes, there are two large SaaS providers - both of which are pure play cloud service providers that have integrated data security within their DNA from the start. Unfortunately, I cannot name them in this forum - but most large enterprises (that I know of anyway) employ their services.

Regarding Gap, we are in the process of deploying the data type paradigm in a manner very similar to what I have  described. Perhaps the greatest (and most rewarding) opportunity throughout, is the education and active collaboration with the business through the type classification process.
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
9/10/2014 | 11:37:23 AM
Re: Data security is going to have to get more granular
Any organizations come to mind Rick? Where does The Gap fit in this new paradigm? And what were/are the biggest  challenges?
rnoguera
50%
50%
rnoguera,
User Rank: Author
9/10/2014 | 11:35:48 AM
Re: Data security is going to have to get more granular> Some examples?
Great question! Secure data transport, encrypted storage, and strong user authentication are all table stakes. Pushing into the concepts of data usage and user access context are cutting edge.

There are data-centric CSPs in play today that are pushing the bounds of data encryption and identity/context usage analytics. However, these are the relative few - in my experience, a single digit count. However, this is a great advantage to enterprise cloud consumers - because we can influence (if not demand) that level of security being the key service differentiators in the marketplace.

 
rnoguera
50%
50%
rnoguera,
User Rank: Author
9/10/2014 | 11:25:31 AM
Re: Data security is going to have to get more granular
I fully agree. To be fair though, jumping to a '3.0 Data Protection' program - one specific to data type and context of use - requires a bit of corporate maturity (wherein data classification and data type is clearly understood and enforced), a corporate environment that is highly agile (think transformative or still forming).
rnoguera
50%
50%
rnoguera,
User Rank: Author
9/10/2014 | 11:17:52 AM
Re: Data security is going to have to get more granular
Successfully deploying a 'type' versus 'class' based data protection model starts with business education and awareness. While information security practitioners will understand this concept fairly quickly, our business partners typically need a bit of education. For many, this is a somewhat revolutionary approach if only because this attempts to bridge the gap of understanding and explaining why data protection matters. Take advantage of that!

In regards to deployment, I would first recommend confirming that your 'crown jewels' are identical to what your business partners describe them to be. Through this (discovery maybe?) exercise, be opportunisitic and introduce the data type methodology and collaborate on the type assignment with the partner. Ideally, at that point forward you will have the basis - thinking in an opportunities and challenges mindset - to develop the data protection approach best suited to your organization.  
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
9/10/2014 | 7:53:10 AM
Re: Data security is going to have to get more granular> Some examples?
Very interesting point that "Cloud providers may have in the past taken advantage of business users who were leading the charge to the cloud and who may not have been security savvy, are beginning to realize that customer trust once lost cannot be regained. So, they too are increasingly beefing up their data security."

So what specifically are forward-thinking CSPs offering to their customers in terms of data security and where are they still lagging?

 
ede souza950
50%
50%
ede souza950,
User Rank: Author
9/9/2014 | 7:04:54 PM
Re: Data security is going to have to get more granular
Stay tuned for Rich's reply.  We are seeing the shift in IT security from an infrastructure-based approach, which served very well when assets were primarily housed behind an enterprise perimeter towards a data-centric approach to meet the needs of a cloud-extended enterprise. Many of the organizations we speak to are also educating business users on the value of data and the importance of securing personal, regulated and other sensitive data especially as the business increasingly gravitates towards SaaS applications for mission-critical purposes. Cloud providers may have in the past taken advantage of business users who were leading the charge to the cloud and who may not have been security savvy, are beginning to realize that customer trust once lost cannot be regained. So, they too are increasingly beefing up their data security.
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
9/8/2014 | 9:41:56 AM
Re: Data security is going to have to get more granular
@ede souza950 and Richard -- What's been your experience in deploying this model (or elements of it) in the real world? I'd be particularly interested to hear from Richard what The Gap is doing or planning to do.
ede souza950
50%
50%
ede souza950,
User Rank: Author
9/5/2014 | 12:25:57 PM
Re: Data security is going to have to get more granular
I agree fully!  Rich and I suggested a tiering as a first step to getting  beyond a a one size fits all  data security approach. Data security needs to be broken down into the granular components you suggest, be contextual and also be based on a lifcycle.
Page 1 / 2   >   >>


Edge-DRsplash-10-edge-articles
7 Old IT Things Every New InfoSec Pro Should Know
Joan Goodchild, Staff Editor,  4/20/2021
News
Cloud-Native Businesses Struggle With Security
Robert Lemos, Contributing Writer,  5/6/2021
Commentary
Defending Against Web Scraping Attacks
Rob Simon, Principal Security Consultant at TrustedSec,  5/7/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-27184
PUBLISHED: 2021-05-14
The NPort IA5000A Series devices use Telnet as one of the network device management services. Telnet does not support the encryption of client-server communications, making it vulnerable to Man-in-the-Middle attacks.
CVE-2020-27185
PUBLISHED: 2021-05-14
Cleartext transmission of sensitive information via Moxa Service in NPort IA5000A series serial devices. Successfully exploiting the vulnerability could enable attackers to read authentication data, device configuration, and other sensitive data transmitted over Moxa Service.
CVE-2021-32613
PUBLISHED: 2021-05-14
In radare2 through 5.3.0 there is a double free vulnerability in the pyc parse via a crafted file which can lead to DoS.
CVE-2021-24192
PUBLISHED: 2021-05-14
Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the Tree Sitemap WordPress plugin before 2.9, to install any plugin (including a specific version) from the WordPress repository, as well as activate arbitrary plugin from then blog, which helps attackers insta...
CVE-2021-24193
PUBLISHED: 2021-05-14
Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the Visitor Traffic Real Time Statistics WordPress plugin before 2.12, to install any plugin (including a specific version) from the WordPress repository, as well as activate arbitrary plugin from then blog, wh...