With so much concern revolving around security, the release and spread of FIDO’s Security Key is a welcome development. It by no means solves all security problems, but it’s a cheap, convenient, and effective way to enhance security and keep cyber attackers at bay. Security Key can be seen as taking easy security solutions to the next level, one that will likely become a common sight as more organizations focus on improving cyber security.

read more

(c)iStock.com/bestdesigns

High-profile security breaches have dominated the headlines in 2014. Two notable examples over the last few months, the Apple iCloud and Dropbox breaches, have revealed a juicy target for attackers: user credentials.

Rather than try to hack into the application itself like iCloud, Dropbox, Salesforce, or Amazon Web Services (AWS), an easier and much more feasible approach to gaining access to sensitive data, celebrity photos, or whatever else an attacker is after, is through stolen user credentials.

Both Apple and Dropbox were quick to point out that their own applications weren’t breached, but that the hackers had stolen user credentials from other cloud services and then used them to access Apple and Dropbox accounts. These incidents highlight the perils of cloud applications. By moving business-critical applications (like storage, CRM, HR, finance) to the cloud, IT administrators have ceded security controls to cloud service providers, throwing into question the security of data stored in the cloud.

That’s why it’s so important to implement additional security controls on top of those provided by the cloud service. The AWSs and Dropboxes of the world provide varying levels of infrastructure security, but it’s ultimately up to the cloud service customer to close the loop. According to Forrester Research, it’s a shared responsibility between the cloud service provider and its customers to ensure complete security over the app and customer data.

It’s imperative to have visibility into cloud app usage across all devices – managed and unmanaged

Fortunately, there are some steps organisations can take to mitigate the risk of cloud service credential theft.

Know what’s going on – and don’t forget about mobile

First off, it’s important to know what apps are being accessed by employees and whether they’re authorised by IT or not. Cloud apps are no longer just being accessed through desktop browsers. The ubiquitous use of mobile devices and explosive growth of native mobile apps have exposed a new security hole for many IT organisations.  

To date, most organisations have focused on securing managed devices (i.e. corporate-owned), but there’s no escaping the BYOD movement. More and more employees are blurring the line between work and personal devices. It’s common to see employees using their personal smartphones for work-related activity.

As a result, it’s imperative to have visibility into cloud app usage across all devices – managed and unmanaged. For example, knowing from which locations (home, office, Portugal etc) and through what devices (iPad, laptop, Android phone) users are typically accessing the cloud services is fundamental to a sound security strategy.

A new category of tools that analyst firm Gartner calls Cloud Access Security Brokers (CASB) can build “behavioural profiles” based on user and device fingerprints, which make it easier to identify suspicious behaviour in real-time and enforce appropriate policies to remediate risks before damage can occur.

Proactive yet flexible protection

Once a baseline of normal behaviour has been established for each user, CASB solutions can then define and enforce policies to provide proactive detection and protection against stolen credentials attacks. Here’s how it works: an attacker in New York steals the Gmail login credentials of a user in California. Assuming the victim’s login credentials are being used for most, if not all, of their cloud services, the attacker attempts to access a Dropbox account from his or her Android phone at 2am using the stolen credentials. 

Cloud Access Security Brokers (CASB) can build ‘behavioural profiles’ based on user and device fingerprints, which makes it easier to identify suspicious behaviour in real-time

Since the victim doesn’t normally access his or her Dropbox account from New York with an Android phone and certainly not at 2am, this attempt would be flagged as anomalous behaviour. At that point, several measures can be implemented separately or in conjunction. An alert can be sent to the security team, account access can be blocked and/or multi-factor authentication can be requested before allowing access to the account. This flexibility is required since the legitimate user could very well be on vacation in New York, accessing their account from a different device.  A draconian “block access” would be too strict of a measure in this case.

If necessary – request stronger authentication

In both the Apple and Dropbox breaches, both companies recommended the use of two-factor authentication to add another layer of security to prevent the inappropriate use of stolen credentials. Multi-factor authentication is a powerful way to protect against account takeovers. It forces would-be attackers to present at least two forms of authentication – one that involves something you own (e.g. a mobile device) and the other something you know (e.g. a one-time password).

In the New York-California attack example above, instead of blocking access immediately, an organization could invoke two-factor authentication. This would challenge the attacker to verify his identity via an out-of-band one-time password (which he wouldn’t be able to provide) and result in access being denied. If the request was being made by the legitimate user, they would be able to present both forms of authentication and still access their account.

Although stolen credentials pose a significant risk to cloud services security, with the right policies and technology in place, an organisation can protect data residing in cloud apps from unauthorised access and theft.

(c)iStock.com/mihtiander

Almost half of respondents in KPMG’s 2014 cloud computing survey are using cloud to drive cost efficiencies, with a similar number utilising it to better enable their mobile workforce.

The study, of 500 global C-suite executives, saw a variety of ways in which businesses are using cloud to drive business transformation. Aside from cost savings (49%) and enabling a mobile workforce (42%), CXOs also see the benefit of cloud as improving alignment with customers and partners (37%), more effectively leveraging data to provide insight (35%), and aiding in new product development (32%).

The results show an interesting change when compared to KPMG’s last survey, The Cloud Takes Shape, in February 2013. Cost reduction was again the main driver for cloud transformation, yet speed to adoption, new market entry, business process transformation, and improved customer interaction were also cited.

Not surprisingly, security was seen as the key benchmark when seeking a cloud solution, cited by 82% of survey respondents. Price (78%) was only the third most important metric, behind data privacy (81%). The report argues the results are to be expected, describing data security as a “burning business issue across all areas of an organisation.”

Cloud isn’t just a cost saver, and any company changing their IT infrastructure for that reason alone is missing out

The report also examined the impact cloud has in terms of employee mobility and expectation. Cloud enables enterprise mobility and, through that, increases worker productivity (54%) and satisfaction (48%), as well as improve field service operations (45%) and gain a competitive advantage (44%).

The KPMG report concludes with five key takeaways for organisations looking to implement cloud solutions:

• Make cloud transformation a continuous process: Cloud should be seen across the whole organisation, not just a tech or IT project.
• Drive cloud transformation from the top: A lack of hierarchy could be costly to your implementation – instead, cloud projects should be managed centrally with a senior level team that guides strategic decisions.
• Focus on strong leadership and engagement: Companies should look at changing their corporate culture to align with a cloud shift, focusing first on getting buy-in from senior business leaders.
• Avoid silos: Similar to previous points, business and IT professionals should work side by side as cloud is brought into the enterprise, instead of creating potentially harmful shadow IT scenarios
• Measure success: Organisations should come up with “realistic” outcomes for their cloud transformation which, crucially, tie back to key business objectives.

Yet the most important conclusion the report draws is in terms of business mindset to moving to the cloud: cloud isn’t just a cost saver, and any company which goes into changing their IT infrastructure for that reason alone is missing out.

“Making such changes to an organisation are costly and time consuming, but such a large increase in responses signals the tremendous impact, beyond cost reduction, that cloud can have on an organisation,” the report argues.

“These results suggest that for many organisations, cloud has truly become a transformative solution.”

You can read the full report here.

In this demo at 15th Cloud Expo, John Meza, Product Engineer at Esri, showed how Esri products hook into Hadoop cluster to allow you to do spatial analysis on the spatial data within your cluster, and he demonstrated rendering from a data center with ArcGIS Pro, a new product that has a brand new rendering engine.

read more

Cloud has become an extension of today’s enterprise and the traditional perimeter has long disappeared. Increasing business requirements for agility and flexibility make the cloud-extended enterprise ideal for a workforce that works anywhere, anytime and any place. This is especially true as organizations are increasingly made up of third-party resources, partners and suppliers compared to just employees.
However, traditional security models are not equipped to deal with the fluid nature of data and network flows that extend from the enterprise into a mix of multiple clouds. This not only creates concerns about network resiliency and availability, it puts key business transactions, assets and access to critical work streams at business risk. As organizations continue to embrace cloud models, IT and InfoSec teams need to find a way to reinvent security so that they have seamless visibility across their enterprise and into the different cloud models their businesses are using. This is where adopting a data and network-centric approach is pivotal.

read more

As the years passed, and we entered 2014, not only did cloud computing mature as a business model, but senior management began to increase their awareness of various aspects of cloud computing, including the financial benefits, standardization of IT resources, the characteristics of cloud computing, and potential for Platform and Software as a Service (PaaS/SaaS) to improve both business agility and internal decision support systems.

read more

SYS-CON Media announced that Cisco, a worldwide leader in IT that helps companies seize the opportunities of tomorrow, has launched an ad campaign in Cloud Computing Journal. The ad campaign, a webcast titled ‘Is Your Data Center Ready for the Application Economy?’, focuses on the latest data center networking technologies, including SDN or ACI, and how customers are using SDN and ACI in their organizations to achieve business agility. The Cisco webcast takes place January 13, 2015, at 9:00 a.m. PST. Cloud Computing Journal aims to help open the eyes of Enterprise IT professionals to the economics and strategies that utility/cloud computing provides.

read more

If cloud computing benefits are so clear, why have so few enterprises migrated their mission-critical apps? The answer is often inertia and FUD. No one ever got fired for not moving to the cloud – not yet.
In his session at 15th Cloud Expo, Michael Hoch, SVP, Cloud Advisory Service at Virtustream, discussed the six key steps to justify and execute your MCA cloud migration.

read more

How agile is your IT organization? Have you kept pace with the rapid evolution of cloud computing services? Have you applied that cloud investment to connect with your key stakeholders in the marketplace? Are you ready to seize the opportunities from the emerging mobile cloud trend?
If you answered NO to any of these questions, you’re at a competitive disadvantage with your more digital savvy business technology peer group. The leading organizations worldwide will rely on cloud infrastructure to achieve commercial benefits that extend far beyond IT cost reduction goals.
Informed CEOs and other senior executives are realizing that cloud service adoption can be a much-needed catalyst for operational process improvement — as well as a driver of business transformation.

read more