Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Comments
In Cloud We Trust: A New Model
Newest First  |  Oldest First  |  Threaded View
Page 1 / 2   >   >>
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
9/10/2014 | 3:45:21 PM
Re: Data security is going to have to get more granular
thanks for the update, Rich. Keep us apprised of what your experience is at The Gap so we can all learn from it.
rnoguera
50%
50%
rnoguera,
User Rank: Author
9/10/2014 | 3:11:55 PM
Re: Data security is going to have to get more granular
Yes, there are two large SaaS providers - both of which are pure play cloud service providers that have integrated data security within their DNA from the start. Unfortunately, I cannot name them in this forum - but most large enterprises (that I know of anyway) employ their services.

Regarding Gap, we are in the process of deploying the data type paradigm in a manner very similar to what I have  described. Perhaps the greatest (and most rewarding) opportunity throughout, is the education and active collaboration with the business through the type classification process.
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
9/10/2014 | 11:37:23 AM
Re: Data security is going to have to get more granular
Any organizations come to mind Rick? Where does The Gap fit in this new paradigm? And what were/are the biggest  challenges?
rnoguera
50%
50%
rnoguera,
User Rank: Author
9/10/2014 | 11:35:48 AM
Re: Data security is going to have to get more granular> Some examples?
Great question! Secure data transport, encrypted storage, and strong user authentication are all table stakes. Pushing into the concepts of data usage and user access context are cutting edge.

There are data-centric CSPs in play today that are pushing the bounds of data encryption and identity/context usage analytics. However, these are the relative few - in my experience, a single digit count. However, this is a great advantage to enterprise cloud consumers - because we can influence (if not demand) that level of security being the key service differentiators in the marketplace.

 
rnoguera
50%
50%
rnoguera,
User Rank: Author
9/10/2014 | 11:25:31 AM
Re: Data security is going to have to get more granular
I fully agree. To be fair though, jumping to a '3.0 Data Protection' program - one specific to data type and context of use - requires a bit of corporate maturity (wherein data classification and data type is clearly understood and enforced), a corporate environment that is highly agile (think transformative or still forming).
rnoguera
50%
50%
rnoguera,
User Rank: Author
9/10/2014 | 11:17:52 AM
Re: Data security is going to have to get more granular
Successfully deploying a 'type' versus 'class' based data protection model starts with business education and awareness. While information security practitioners will understand this concept fairly quickly, our business partners typically need a bit of education. For many, this is a somewhat revolutionary approach if only because this attempts to bridge the gap of understanding and explaining why data protection matters. Take advantage of that!

In regards to deployment, I would first recommend confirming that your 'crown jewels' are identical to what your business partners describe them to be. Through this (discovery maybe?) exercise, be opportunisitic and introduce the data type methodology and collaborate on the type assignment with the partner. Ideally, at that point forward you will have the basis - thinking in an opportunities and challenges mindset - to develop the data protection approach best suited to your organization.  
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
9/10/2014 | 7:53:10 AM
Re: Data security is going to have to get more granular> Some examples?
Very interesting point that "Cloud providers may have in the past taken advantage of business users who were leading the charge to the cloud and who may not have been security savvy, are beginning to realize that customer trust once lost cannot be regained. So, they too are increasingly beefing up their data security."

So what specifically are forward-thinking CSPs offering to their customers in terms of data security and where are they still lagging?

 
ede souza950
50%
50%
ede souza950,
User Rank: Author
9/9/2014 | 7:04:54 PM
Re: Data security is going to have to get more granular
Stay tuned for Rich's reply.  We are seeing the shift in IT security from an infrastructure-based approach, which served very well when assets were primarily housed behind an enterprise perimeter towards a data-centric approach to meet the needs of a cloud-extended enterprise. Many of the organizations we speak to are also educating business users on the value of data and the importance of securing personal, regulated and other sensitive data especially as the business increasingly gravitates towards SaaS applications for mission-critical purposes. Cloud providers may have in the past taken advantage of business users who were leading the charge to the cloud and who may not have been security savvy, are beginning to realize that customer trust once lost cannot be regained. So, they too are increasingly beefing up their data security.
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
9/8/2014 | 9:41:56 AM
Re: Data security is going to have to get more granular
@ede souza950 and Richard -- What's been your experience in deploying this model (or elements of it) in the real world? I'd be particularly interested to hear from Richard what The Gap is doing or planning to do.
ede souza950
50%
50%
ede souza950,
User Rank: Author
9/5/2014 | 12:25:57 PM
Re: Data security is going to have to get more granular
I agree fully!  Rich and I suggested a tiering as a first step to getting  beyond a a one size fits all  data security approach. Data security needs to be broken down into the granular components you suggest, be contextual and also be based on a lifcycle.
Page 1 / 2   >   >>


News
US Formally Attributes SolarWinds Attack to Russian Intelligence Agency
Jai Vijayan, Contributing Writer,  4/15/2021
News
Dependency Problems Increase for Open Source Components
Robert Lemos, Contributing Writer,  4/14/2021
News
FBI Operation Remotely Removes Web Shells From Exchange Servers
Kelly Sheridan, Staff Editor, Dark Reading,  4/14/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: Tell him only Kevin Mitnick and the President know the launch codes.
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-31607
PUBLISHED: 2021-04-23
In SaltStack Salt 2016.9 through 3002.6, a command injection vulnerability exists in the snapper module that allows for local privilege escalation on a minion. The attack requires that a file is created with a pathname that is backed up by snapper, and that the master calls the snapper.diff function...
CVE-2021-31597
PUBLISHED: 2021-04-23
The xmlhttprequest-ssl package before 1.6.1 for Node.js disables SSL certificate validation by default, because rejectUnauthorized (when the property exists but is undefined) is considered to be false within the https.request function of Node.js. In other words, no certificate is ever rejected.
CVE-2021-2296
PUBLISHED: 2021-04-22
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prior to 6.1.20. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromi...
CVE-2021-2297
PUBLISHED: 2021-04-22
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prior to 6.1.20. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromi...
CVE-2021-2298
PUBLISHED: 2021-04-22
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.23 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attac...