Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Comments
In Cloud We Trust: A New Model
Threaded  |  Newest First  |  Oldest First
Charlie Babcock
50%
50%
Charlie Babcock,
User Rank: Ninja
9/4/2014 | 5:43:39 PM
Data security is going to have to get more granular
Very well informed discussion on data security in the cloud. I'm not 100% sure but what data tiering isn't too old a concept for the problem. It may be necessary to break data down into smaller components and apply appropriate security to each, logical components that might be based on data classification, parent system, even time and place of generation. Security is going to have to get more granular, isn't it?
ede souza950
50%
50%
ede souza950,
User Rank: Author
9/5/2014 | 12:25:57 PM
Re: Data security is going to have to get more granular
I agree fully!  Rich and I suggested a tiering as a first step to getting  beyond a a one size fits all  data security approach. Data security needs to be broken down into the granular components you suggest, be contextual and also be based on a lifcycle.
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
9/8/2014 | 9:41:56 AM
Re: Data security is going to have to get more granular
@ede souza950 and Richard -- What's been your experience in deploying this model (or elements of it) in the real world? I'd be particularly interested to hear from Richard what The Gap is doing or planning to do.
ede souza950
50%
50%
ede souza950,
User Rank: Author
9/9/2014 | 7:04:54 PM
Re: Data security is going to have to get more granular
Stay tuned for Rich's reply.  We are seeing the shift in IT security from an infrastructure-based approach, which served very well when assets were primarily housed behind an enterprise perimeter towards a data-centric approach to meet the needs of a cloud-extended enterprise. Many of the organizations we speak to are also educating business users on the value of data and the importance of securing personal, regulated and other sensitive data especially as the business increasingly gravitates towards SaaS applications for mission-critical purposes. Cloud providers may have in the past taken advantage of business users who were leading the charge to the cloud and who may not have been security savvy, are beginning to realize that customer trust once lost cannot be regained. So, they too are increasingly beefing up their data security.
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
9/10/2014 | 7:53:10 AM
Re: Data security is going to have to get more granular> Some examples?
Very interesting point that "Cloud providers may have in the past taken advantage of business users who were leading the charge to the cloud and who may not have been security savvy, are beginning to realize that customer trust once lost cannot be regained. So, they too are increasingly beefing up their data security."

So what specifically are forward-thinking CSPs offering to their customers in terms of data security and where are they still lagging?

 
rnoguera
50%
50%
rnoguera,
User Rank: Author
9/10/2014 | 11:35:48 AM
Re: Data security is going to have to get more granular> Some examples?
Great question! Secure data transport, encrypted storage, and strong user authentication are all table stakes. Pushing into the concepts of data usage and user access context are cutting edge.

There are data-centric CSPs in play today that are pushing the bounds of data encryption and identity/context usage analytics. However, these are the relative few - in my experience, a single digit count. However, this is a great advantage to enterprise cloud consumers - because we can influence (if not demand) that level of security being the key service differentiators in the marketplace.

 
rnoguera
50%
50%
rnoguera,
User Rank: Author
9/10/2014 | 11:17:52 AM
Re: Data security is going to have to get more granular
Successfully deploying a 'type' versus 'class' based data protection model starts with business education and awareness. While information security practitioners will understand this concept fairly quickly, our business partners typically need a bit of education. For many, this is a somewhat revolutionary approach if only because this attempts to bridge the gap of understanding and explaining why data protection matters. Take advantage of that!

In regards to deployment, I would first recommend confirming that your 'crown jewels' are identical to what your business partners describe them to be. Through this (discovery maybe?) exercise, be opportunisitic and introduce the data type methodology and collaborate on the type assignment with the partner. Ideally, at that point forward you will have the basis - thinking in an opportunities and challenges mindset - to develop the data protection approach best suited to your organization.  
rnoguera
50%
50%
rnoguera,
User Rank: Author
9/10/2014 | 11:25:31 AM
Re: Data security is going to have to get more granular
I fully agree. To be fair though, jumping to a '3.0 Data Protection' program - one specific to data type and context of use - requires a bit of corporate maturity (wherein data classification and data type is clearly understood and enforced), a corporate environment that is highly agile (think transformative or still forming).
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
9/10/2014 | 11:37:23 AM
Re: Data security is going to have to get more granular
Any organizations come to mind Rick? Where does The Gap fit in this new paradigm? And what were/are the biggest  challenges?
rnoguera
50%
50%
rnoguera,
User Rank: Author
9/10/2014 | 3:11:55 PM
Re: Data security is going to have to get more granular
Yes, there are two large SaaS providers - both of which are pure play cloud service providers that have integrated data security within their DNA from the start. Unfortunately, I cannot name them in this forum - but most large enterprises (that I know of anyway) employ their services.

Regarding Gap, we are in the process of deploying the data type paradigm in a manner very similar to what I have  described. Perhaps the greatest (and most rewarding) opportunity throughout, is the education and active collaboration with the business through the type classification process.
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
9/10/2014 | 3:45:21 PM
Re: Data security is going to have to get more granular
thanks for the update, Rich. Keep us apprised of what your experience is at The Gap so we can all learn from it.


News
FluBot Malware's Rapid Spread May Soon Hit US Phones
Kelly Sheridan, Staff Editor, Dark Reading,  4/28/2021
Slideshows
7 Modern-Day Cybersecurity Realities
Steve Zurier, Contributing Writer,  4/30/2021
Commentary
How to Secure Employees' Home Wi-Fi Networks
Bert Kashyap, CEO and Co-Founder at SecureW2,  4/28/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-31755
PUBLISHED: 2021-05-07
An issue was discovered on Tenda AC11 devices with firmware through 02.03.01.104_CN. A stack buffer overflow vulnerability in /goform/setmac allows attackers to execute arbitrary code on the system via a crafted post request.
CVE-2021-31756
PUBLISHED: 2021-05-07
An issue was discovered on Tenda AC11 devices with firmware through 02.03.01.104_CN. A stack buffer overflow vulnerability in /gofrom/setwanType allows attackers to execute arbitrary code on the system via a crafted post request. This occurs when input vector controlled by malicious attack get copie...
CVE-2021-31757
PUBLISHED: 2021-05-07
An issue was discovered on Tenda AC11 devices with firmware through 02.03.01.104_CN. A stack buffer overflow vulnerability in /goform/setVLAN allows attackers to execute arbitrary code on the system via a crafted post request.
CVE-2021-31758
PUBLISHED: 2021-05-07
An issue was discovered on Tenda AC11 devices with firmware through 02.03.01.104_CN. A stack buffer overflow vulnerability in /goform/setportList allows attackers to execute arbitrary code on the system via a crafted post request.
CVE-2021-31458
PUBLISHED: 2021-05-07
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 10.1.1.37576. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handlin...