Welcome!

Containers Expo Blog Authors: Pat Romanski, ManageEngine IT Matters, Elizabeth White, XebiaLabs Blog, Lori MacVittie

Blog Feed Post

Top 5 Best Practices for Cloud Security

cloud security best practices Cloud Security Cloud Encryption  security daily Top 5 Best Practices for Cloud SecurityCloud computing security issues are constantly a top concern for IT leaders migrating to the cloud. There are many issues related to data security in the cloud and more than one approach to cloud security. Focusing on Infrastructure as a Service cloud security, there are five issues that repeatedly concern customers that are resolved by implementing the best practices discussed at a high level below. Cloud security best practices are technology related, but also focuses on P3: Process, People, Products.

1.     Choose your cloud wisely


Infrastructure clouds come in many variations. Some are big (like Amazon Web Services, Microsoft Azure, Google, or HP) and some are smaller but more focused on specific needs such as addressing compliance (Firehost and Layered Technologies are two examples, but there are many more).

A cross-platform concern in every Infrastructure as a Service (IaaS) deployment is that data security is a shared responsibility. When shortlisting cloud providers, make sure specific certification such as ISO 27001 or SOC3 are in place. If you have specific regulatory concerns such as HIPAA safe harbor or PCI DSS compliance, ensure your cloud provider can support these specific requirements. Ask to speak with customers with a similar use case and similar size (or bigger). Learn from their lessons and make a decision accordingly.

2.     Encrypt your data

As we’ve written before, encryption becomes your virtual walls in a cloud deployment. In your datacenter, your physical servers are protected by the 4 walls and the tight access security policy. In a shared cloud infrastructure, those measures are basically nonexistent.

This is where data encryption steps in. Data encryption allows you to segregate and isolate your environment from other companies (or adversaries) running on the same infrastructure. Data encryption in the cloud takes multiple forms: some more secure than others.

Freeware encryption tools might seem attractive at first, but they have two major issues:

  1. They don’t scale well
  2. In many cases, the encryption key is stored on the virtual disk along with the encrypted data, which renders the entire solution useless.

In a compliance use case, these drawbacks might pose serious issues.

Research and test more than one encryption solution, and learn carefully about the security posture of the encryption provider.

3.     Focus on encryption keys

Although it sounds strange at first, cloud encryption can be easily achieved. The challenge lies=s not with the actual encryption, but with the encryption keys.

The Heartbleed bug, discovered a few weeks ago, exposed a weakness in Open SSL’s SSL/TLS protocol, allowing anyone on the Internet to read the memory of the systems protected by the vulnerable versions of the OpenSSL software. As a result, many encrypted servers in the cloud unknowingly exposed their encryption key, which resided in memory of a server impacted by heartbleed.

To mitigate with such sophisticated attack vectors, the encryption keys should be secured throughout their life cycle: while in the key management system and while in use in the cloud. Emerging technologies such as split-key encryption and homomorphic key management can be used to avoid such attacks.

When researching encryption and key management technologies, look for cloud-enabled innovative technologies, and verify how encryption keys are managed and secure throughout the life cycle of the key usage.

4.     Automate cloud security as much as possible

One of the clouds’ most important benefits is its ability to automatically scale an infrastructure environment up or down, in a single geography or across multiple geographies. When it comes to cloud security, the paradigm shifts. You’ll hear experts telling you about the need to “keep security under your control,” and that security automation means sacrificing trust.

While true for traditional security systems, new – cloud based – security solutions do enable automation using secure, RESTful API tools.

Automating data security actually reduces risk and configuration mistakes. Assuming the software vendor can prove automation is done securely, it is a best practice for IaaS cloud security.

5.     Train your employees

Implementing the latest and greatest security toys is fun. Training employees may not seem as exciting. Yet, in many cases, a trained employee will be more efficient in stopping an attack than most technologies. (Art Gilliland gave a great pitch on “defense in depth” during RSA 2014 – see the video here).

A common modern attack pattern would start by identifying and infiltrating privileged users’ accounts (such as database administrator, or system administrators), and once access is gained, getting to end user data stored on those databases becomes a much simpler task for the attacker.

By educating users on risks and security best practices, the access of the attacker can be avoided. In addition, the cloud brings additional potential attack vectors, such as disk snapshots, or identity theft to the online portal, managing all servers. When training employees, always keep cloud in mind, together with your business tools and processes.

Cloud Security Best Practices Lead to Successful Deployments
There are many considerations surrounding cloud security. These best practices do not eliminate the risks or remove the need to always be kept abreast of the latest development. They do, however, ensure that your cloud will be more secure and enable you to comply with laws and industry regulations while taking advantage of the many business benefits of the cloud. Much of this, when explored from such a high level seems like common sense, and yet, the news is filled with stories of companies large and small who failed to properly manage their encryption keys or permitted their employees or vendors to enable access by attackers (a la recent breaches at Ebay and Target). Implementing these best practices will ensure that yours isn’t listed among the news-making breaches.

cloud security best practices Cloud Security Cloud Encryption  333333 Top 5 Best Practices for Cloud Security

The post Top 5 Best Practices for Cloud Security appeared first on Porticor Cloud Security.

Read the original blog entry...

More Stories By Gilad Parann-Nissany

Gilad Parann-Nissany, Founder and CEO at Porticor is a pioneer of Cloud Computing. He has built SaaS Clouds for medium and small enterprises at SAP (CTO Small Business); contributing to several SAP products and reaching more than 8 million users. Recently he has created a consumer Cloud at G.ho.st - a cloud operating system that delighted hundreds of thousands of users while providing browser-based and mobile access to data, people and a variety of cloud-based applications. He is now CEO of Porticor, a leader in Virtual Privacy and Cloud Security.

@ThingsExpo Stories
Basho Technologies has announced the latest release of Basho Riak TS, version 1.3. Riak TS is an enterprise-grade NoSQL database optimized for Internet of Things (IoT). The open source version enables developers to download the software for free and use it in production as well as make contributions to the code and develop applications around Riak TS. Enhancements to Riak TS make it quick, easy and cost-effective to spin up an instance to test new ideas and build IoT applications. In addition to...
Identity is in everything and customers are looking to their providers to ensure the security of their identities, transactions and data. With the increased reliance on cloud-based services, service providers must build security and trust into their offerings, adding value to customers and improving the user experience. Making identity, security and privacy easy for customers provides a unique advantage over the competition.
CenturyLink has announced that application server solutions from GENBAND are now available as part of CenturyLink’s Networx contracts. The General Services Administration (GSA)’s Networx program includes the largest telecommunications contract vehicles ever awarded by the federal government. CenturyLink recently secured an extension through spring 2020 of its offerings available to federal government agencies via GSA’s Networx Universal and Enterprise contracts. GENBAND’s EXPERiUS™ Application...
"We've discovered that after shows 80% if leads that people get, 80% of the conversations end up on the show floor, meaning people forget about it, people forget who they talk to, people forget that there are actual business opportunities to be had here so we try to help out and keep the conversations going," explained Jeff Mesnik, Founder and President of ContentMX, in this SYS-CON.tv interview at 18th Cloud Expo, held June 7-9, 2016, at the Javits Center in New York City, NY.
I wanted to gather all of my Internet of Things (IOT) blogs into a single blog (that I could later use with my University of San Francisco (USF) Big Data “MBA” course). However as I started to pull these blogs together, I realized that my IOT discussion lacked a vision; it lacked an end point towards which an organization could drive their IOT envisioning, proof of value, app dev, data engineering and data science efforts. And I think that the IOT end point is really quite simple…
Internet of @ThingsExpo, taking place November 1-3, 2016, at the Santa Clara Convention Center in Santa Clara, CA, is co-located with the 19th International Cloud Expo and will feature technical sessions from a rock star conference faculty and the leading industry players in the world and ThingsExpo Silicon Valley Call for Papers is now open.
You think you know what’s in your data. But do you? Most organizations are now aware of the business intelligence represented by their data. Data science stands to take this to a level you never thought of – literally. The techniques of data science, when used with the capabilities of Big Data technologies, can make connections you had not yet imagined, helping you discover new insights and ask new questions of your data. In his session at @ThingsExpo, Sarbjit Sarkaria, data science team lead ...
WebRTC is bringing significant change to the communications landscape that will bridge the worlds of web and telephony, making the Internet the new standard for communications. Cloud9 took the road less traveled and used WebRTC to create a downloadable enterprise-grade communications platform that is changing the communication dynamic in the financial sector. In his session at @ThingsExpo, Leo Papadopoulos, CTO of Cloud9, discussed the importance of WebRTC and how it enables companies to focus...
"My role is working with customers, helping them go through this digital transformation. I spend a lot of time talking to banks, big industries, manufacturers working through how they are integrating and transforming their IT platforms and moving them forward," explained William Morrish, General Manager Product Sales at Interoute, in this SYS-CON.tv interview at 18th Cloud Expo, held June 7-9, 2016, at the Javits Center in New York City, NY.
SYS-CON Events announced today that 910Telecom will exhibit at the 19th International Cloud Expo, which will take place on November 1–3, 2016, at the Santa Clara Convention Center in Santa Clara, CA. Housed in the classic Denver Gas & Electric Building, 910 15th St., 910Telecom is a carrier-neutral telecom hotel located in the heart of Denver. Adjacent to CenturyLink, AT&T, and Denver Main, 910Telecom offers connectivity to all major carriers, Internet service providers, Internet backbones and ...
SYS-CON Events announced today that LeaseWeb USA, a cloud Infrastructure-as-a-Service (IaaS) provider, will exhibit at the 19th International Cloud Expo, which will take place on November 1–3, 2016, at the Santa Clara Convention Center in Santa Clara, CA. LeaseWeb is one of the world's largest hosting brands. The company helps customers define, develop and deploy IT infrastructure tailored to their exact business needs, by combining various kinds cloud solutions.
For basic one-to-one voice or video calling solutions, WebRTC has proven to be a very powerful technology. Although WebRTC’s core functionality is to provide secure, real-time p2p media streaming, leveraging native platform features and server-side components brings up new communication capabilities for web and native mobile applications, allowing for advanced multi-user use cases such as video broadcasting, conferencing, and media recording.
SYS-CON Events announced today that Venafi, the Immune System for the Internet™ and the leading provider of Next Generation Trust Protection, will exhibit at @DevOpsSummit at 19th International Cloud Expo, which will take place on November 1–3, 2016, at the Santa Clara Convention Center in Santa Clara, CA. Venafi is the Immune System for the Internet™ that protects the foundation of all cybersecurity – cryptographic keys and digital certificates – so they can’t be misused by bad guys in attacks...
ReadyTalk has expanded the capabilities of the FoxDen collaboration platform announced late last year to include FoxDen Connect, an in-room video collaboration experience that launches with a single touch. With FoxDen Connect, users can now not only engage in HD video conferencing between iOS and Android mobile devices or Chrome browsers, but also set up in-person meeting rooms for video interactions. A host’s mobile device automatically recognizes the presence of a meeting room via beacon tech...
The cloud market growth today is largely in public clouds. While there is a lot of spend in IT departments in virtualization, these aren’t yet translating into a true “cloud” experience within the enterprise. What is stopping the growth of the “private cloud” market? In his general session at 18th Cloud Expo, Nara Rajagopalan, CEO of Accelerite, explored the challenges in deploying, managing, and getting adoption for a private cloud within an enterprise. What are the key differences between wh...
It’s 2016: buildings are smart, connected and the IoT is fundamentally altering how control and operating systems work and speak to each other. Platforms across the enterprise are networked via inexpensive sensors to collect massive amounts of data for analytics, information management, and insights that can be used to continuously improve operations. In his session at @ThingsExpo, Brian Chemel, Co-Founder and CTO of Digital Lumens, will explore: The benefits sensor-networked systems bring to ...
On Dice.com, the number of job postings asking for skill in Amazon Web Services increased 76 percent between June 2015 and June 2016. Salesforce.com saw its own skill mentions increase 37 percent, while DevOps and Cloud rose 35 percent and 28 percent, respectively. Even as they expand their presence in the cloud, companies are also looking for tech professionals who can manage projects, crunch data, and figure out how to make systems run more autonomously. Mentions of ‘data science’ as a skill ...
Manufacturers are embracing the Industrial Internet the same way consumers are leveraging Fitbits – to improve overall health and wellness. Both can provide consistent measurement, visibility, and suggest performance improvements customized to help reach goals. Fitbit users can view real-time data and make adjustments to increase their activity. In his session at @ThingsExpo, Mark Bernardo Professional Services Leader, Americas, at GE Digital, discussed how leveraging the Industrial Internet a...
Amazon has gradually rolled out parts of its IoT offerings in the last year, but these are just the tip of the iceberg. In addition to optimizing their back-end AWS offerings, Amazon is laying the ground work to be a major force in IoT – especially in the connected home and office. Amazon is extending its reach by building on its dominant Cloud IoT platform, its Dash Button strategy, recently announced Replenishment Services, the Echo/Alexa voice recognition control platform, the 6-7 strategic...
In addition to all the benefits, IoT is also bringing new kind of customer experience challenges - cars that unlock themselves, thermostats turning houses into saunas and baby video monitors broadcasting over the internet. This list can only increase because while IoT services should be intuitive and simple to use, the delivery ecosystem is a myriad of potential problems as IoT explodes complexity. So finding a performance issue is like finding the proverbial needle in the haystack.