Telematique, water and fire.

Cloud Parsing

More clarity (and practicality) is emerging in the conversation regarding cloud computing. Joe Weinman's response to my previous post goes straight to the heart of it: there are reasons why the pure, platonic form of cloud computing just won't satisfy the requirements or live within the constraints placed on corporate production computing.

Dan Woods has a very good article this morning at Forbes.com in which he identifies three issues that will bring complexity to the cloud-based solutions. He identifies them as (1) governments, (2) network topology and (3) quality of service.

With all respect to his choices, I'd probably use different terminology when laying out the issues for a geekier audience. (The column IS entitled JargonSpy !!)

(1) government regulation regarding the jurisdiction in which certain kinds of data must remain is a big issue. But there are a whole slew of industry standards (such as PCI DSS) and just "best practices" that recommend keeping close watch on where data lives and where it's processed. Compliance with regulation, industry standard or corporate best practice is a more inclusive concept.

(2) the network topology issue is really about latency rather than speed. (See Weinman's Cloudonomics Rule #8)

(3) quality of service is a loaded term for those of us with networking backgrounds. Woods' use of the term makes sense to the general readership. In fact, it's an amalgam of service properties that seem to rest primarily on reliability, availability, performance and security. Thrown in for good measure, we need to consider connectivity and resilience of the cloud.

This article is heartwarming, in that it starts to add some texture and the appropriate measure of sophistication into the thinking around cloud computing. Thanks, Dan.

(Thanks to OnSaas for pointing out the article.)

Parsing The Cloud - Forbes.com

Cloud computing is a rich vein of semantic ore for the JargonSpy because so much that is said about the cloud makes it all seem so simple. Most of the time, the story goes like this: We have an application like Salesforce.com or Google Apps, or an application programming interface to a service like Amazon.com's EC2 or S3, and we ask it to do stuff for us. Then, out there in the cloud, it all happens. We don't have to worry about what happens in the cloud, and we do not really care where it is, who else has their stuff there or how it all works.

The days of not caring are quickly coming to an end. The cloud as an abstract entity in a place you don't have to worry about will be replaced by clouds that have geographies, special purposes, other companies and rules that guarantee compliance with regulations. This week JargonSpy takes a look at how and why the cloud will transform from the simple to the complex. ...

VMware Server Virtualization, Compliance & Data Security

This is Catbird's announcement of the new assessment "service." It seems couched primarily in the context of "making you safe" when doing P2V.

While a number of the "virtsec" vendors address compliance, I've noticed a particular increase in the use of this theme with new product announcements over the past weeks. The compliance boogeyman is being hauled out by a number of vendors to make sure potential customers remember that they may need special assessments with respect to HIPAA, PCI DSS, et. al. when using VMware server virtualization.

This theme was apparent in EMC's announcement of the new Application Discovery Manager 6.0 offering, which works in concert with other EMC SMARTS offers ... particularly their newly announced IT Compliance Analyzer -- Application Edition.


Catbird Offers Industry's First-Ever Comprehensive Virtual Security Assessment

SCOTTS VALLEY, Calif.--(BUSINESS WIRE)--Catbird, the pioneer in comprehensive security for virtual and physical networks and developer of the V-Agent™ virtual appliance, announced today the industry’s first and only state-of-the-art Virtual Infrastructure Security Assessment (VSA). Catbird’s VSA helps IT administrators identify and close the potential gaps in security and compliance created in the move from “P to V”. The 30-day assessment includes a thorough security analysis, detailed reports with actionable intelligence and a comprehensive plan to mitigate risk and protect critical virtual systems, networks, desktops and processes.

Catbird’s VSA combines traditional security assessment methodologies with unique virtual infrastructure telemetry gathered through Catbird’s stateless, non-invasive V-Agents to deliver robust scrutiny previously unachievable with existing mechanisms. The VSA identifies the scope and magnitude of the virtualization compliance gap through qualitative and quantitative analysis of the new architecture’s impact on change control, separation of duties, network visibility and segmentation, and secondary validation.

Security 3.0 and the Perimeter Myth

Greg Ness regarding the myth of security at the perimeter.  Continuing the story about how we really need to concern ourselves with VirtSec and  "the soft middle", and not just the perimeter.

Security 3.0 and the Perimeter Myth | AlwaysOn

Over the last few weeks I’ve been talking to analysts and security pros about virtualization, security and the evolution of netsec to virtsec. Last week I was in Los Angeles on a virtualization panel at the InformationWeek Virtualization Summit and then in NYC on a MISTI panel on virtsec.

As a result of several discussions, I’ve come to the conclusion that for many organizations their network really doesn’t have a perimeter, at least in the classic sense of defense. The idea of a strategic point of defense that protects what is inside has become a legacy myth, an anachronism from the early days of netsec and fame-seeking hackers.

...

THEN WHAT'S NEXT FOR NETSEC?

In the short term the netsec hardware vendors MUST announce a virtsec product in 2008. Being late to the party will cost them substantial vision and revenue growth points. As I commented before, these 2008 virtsec announcements will likely be vapor ware because of the substantial difficulties in moving from signature processing (usually ASIC) “architecture crunch” to massive hypervisor footprints. Maybe these products will be broken into multiple parts in order to lessen the load on individual servers and avoid massive processing burdens. Maybe they’ll find a creative way to exploit the hypervisor layer from afar? Either way, they are in a world of computational disadvantage until they understand the nature and weaknesses of the applications they are defending. ...

Powered by ScribeFire.

Virtual Patching and Overlays

News of an interesting startup that delivers and implements patches to database systems by creating an overlay or container which is capable of monitoring traffic into/out of the DBMS, and implementing the appropriate transformation or modification to the behavior of the system.  In principle, this is very much like what BlueLane has done with soft appliances (known as shields) which provide virtual patching for operating systems and selected application platforms.

This elegant architecture is brought to us by virtualization and the ability to deliver optimized soft appliances. I like the aesthetic.

Making a case for virtual patching | InfoWorld | News | 2007-08-20 | By Matt Hines

Dubbed Sentrigo and launched in Nov. 2006, the Israeli firm contends that by adding a layer of host-based activity monitoring and intrusion protection technology on top of almost any commercial database, it can beat back attempts to take advantage of both known vulnerabilities and so-called zero day flaws in the systems.

Rather than struggling to deploy the latest patch from Oracle, IBM, or any other database vendor quickly -- and potentially throwing business-critical systems offline in the process -- Sentrigo executives say that the virtual patching functionality built into its Hedgehog Enterprise package allows companies to stay protected while assessing their options.

While the company is only in the process of signing up its initial customers, its leaders maintain that the firm can quickly become a major player in the database security market simply through the addition of virtual patching to other more traditional tools.

Because the technology sits on top of the database itself and becomes conditioned to the type of activity such a system experiences on a daily basis, the product can easily spot any suspicious commands and block attacks in real time, Sentrigo officials said.

Technorati Tags: BlueLane, soft appliance, Sentrigo

Hyperjacking?

I'm not sure I understand how someone could hijack a hypervisor, but on the premise that it COULD be done... that's scary.

Hyperjacking - the latest threat to servers | APC Magazine

Still in its infancy, hyperjacking revolves around the corporate world's newfound enthusiasm for application virtualisation. Virtualisation allows multiple instances of an operating system to be run on a single box, greatly improving hardware utilisation levels. Because the hypervisor actually runs underneath the operating system, it makes it a particular juicy target for nefarious types, hell bent on gaining control of computer servers. Get control of the hypervisor and you control everything running on the machine. Hyperjacking involves installing a rogue hypervisor that can take complete control of a server. Regular security measures are ineffective because the OS will not even be aware that the machine has been compromised.

Technorati Tags: hypervisor

Shamir's Law

Dan Farber, reporting on RSA 2007, relates this exchange during the cryptographers panel.

» RSA 2007 keynotes: Notable quotes | Between the Lines | ZDNet.com

"Security wins many battles but loses the security war. We are definitely going backwards in computer security."–Adi Shamir

Moderator Burt Kaliski, chief scientist and CTO at RSA Laboratories, quickly factored a new way to look at security, "Shamir's Law": Every 18 months security gets half as good.

Clearly... Some sort of disconnect.

Oops. 

Guidelines and tools certainly help, but what's missing is a generally accepted "standard of care" regarding the protection of data like the personal identifying information (PII). 

VA Loses Another Hard Drive, Vet Data At Risk - News by InformationWeek

... Rep. Spencer Bachus, R-Ala., whose district surrounds Birmingham, said that as many as 48,000 veterans' records were on the drive, and that as many as 20,000 were not encrypted.

"Why were the records of 20,000 veterans not encrypted? Given last year's experience, VA officials should have exercised greater caution," Bachus said in a statement released Monday. "Why did this incident happen at all given the fact that the VA already has the guidelines and tools needed to prevent such breaches? Clearly there is some sort of a disconnect between veterans officials in Washington and in the field," Bachus said. ...

Data Security Compliance and Accountability at NYSE

The issue of compliance, particularly Sarbanes-Oxley compliance, have got to be an on-going concern to financial institutions, and particularly for those securities, commodities and options exchanges that are taking the IPO route to becoming publicly traded companies. Wall Street & Technology has an interesting article regarding the NYSE and their "defense in depth" approach to securing sensitive data.

Although it's a bit of an advertisement, the discussion of their use of Lumigent's data auditing approach is interesting. The article makes the point that their technology using the database transaction logs to provide "... a continuous and complete picture of database activity." This is in contrast to other approaches to content/data monitoring and filtering that watch the network to interpret data access and assess what changes are taking place.

The article goes on to emphasize the importance of addressing inside/insider threat.  They make a pretty strong case for digging into the processes, systems and technologies the NYSE has in place, with a full-spectrum analysis, and big-time emphasis on accountability.

Wall Street & Technology : The NYSE Focuses on Improving Data Integrity

There are signs that the capital markets industry is taking steps to improve accountability regarding access to data, since allowing access to unsecured information in the database is typically where the Sarbanes-Oxley process breaks down, according to Adam Honoré, senior analyst with Boston-based consultancy Aite Group. Efforts are being made on the IT side to install governance processes around how data can be accessed, he notes.


But more work needs to be done in the entitlements piece, in terms of who has access to what data, and the governance process around that, says Honoré. "The biggest [security breaches] in capital markets are either people having laptops stolen or the loss of backup tapes," he contends. "Hacking has not been a big problem in capital markets."


Data ownership and accountability, therefore, must be the cornerstones of data-level security, adds Honoré. ...

Technorati Tags: compliance, security_compliance

E&Y on Foreign Outsourcing Risks

CSO Magazine has a recent post regarding "... third-party relationships, particularly with the use of customer data by customer service outsourcing companies in rapidly developing economies." This comes from a recently completed information security survey performed by Ernst & Young.

Foreign Outsourcing Risks Only Now Being Recognized
Security Feed - Blog - CSO Magazine

Nov 17, 2006
Foreign Outsourcing Risks Only Now Being Recognized

...
Respondents indicated that many companies are beginning to recognize the potential risks "of third-party relationships, particularly with the use of customer data by customer service outsourcing companies in rapidly developing economies," Ernst & Young said in a statement.

...
The survey also reported that CSOs will continue to face the challenges of regulatory compliance and privacy issues.

Privacy issues are a key priority for future success, said Ernst & Young. Privacy "has become a high-stakes business issue, catapulted up the board agenda by consumer concerns caused by well publicized lapses of security and the growing response of government and legislative activism," said (Paul van Kessel, global leader of Ernst & Young’s Technology and Security Risk Services). "Understandably it is the area where companies are being most active, with privacy and data protection practices becoming increasingly more formalized."

Companies know all too well that the problem of privacy and personal data protection is broader and deeper than what is in the headlines," he added. "Our survey reports that this will continue to be a top business issue, requiring vigilant oversight on the part of organizations and even more formalization of measures to mitigate the risks.

Technorati Tags: Data Protection, Security

Flipside: A few minutes with Jeff Jonas

More from Jeff Jonas about analytic processing of anonymized data.

Flipside: A few minutes with Jeff Jonas

...

The technique we are using allows us to anonymize identity  information, like names and addresses, and after the data is  anonymized to compare and determine when two people are the same  person despite all the variability in identity data. Usually one encrypts data to send to somebody else who has to decrypt  it to use it.

Ours is a technique that allows you to encrypt the data  and do the analysis while it is encrypted. That's what is unique  about it. Many people in the privacy community feel that this is  better than some other ways of sharing sensitive data.

...