​Confidential VMs will be the first product in Google Cloud’s new confidential computing portfolio, the company has revealed, allowing companies to process sensitive data while keeping it encrypted in memory.

The announcement aims to capitalise on a growing interest in confidential computing, a field that promises to revolutionise cloud computing by providing what is in effect permanent uptime on data encryption.

Until now, like many cloud providers, Google offered encryption on data at rest and while in transit, requiring that data to be decrypted before it could be processed. Through Confidential VMs, Google customers encrypt data while it is being processed inside a virtual machine.

Google’s new feature is an evolution of its Shielded VMs, a tool launched in 2018 that companies could deploy to strip out most of the potentially vulnerable startup processes that trigger when attempting to create a new environment. This is in addition to a few layers of extra protection against external attacks, and monitoring systems that check for unexpected changes to data.

These added layers of security were required given that data is normally decrypted in order to be processed inside the VM – something that not only creates added risk from external attacks, but also forces companies to deploy strict access controls to ensure only the right employees handle the data.

The Confidential VMs feature, available as a beta today, attempts to solve these issues by allowing customers to encrypt their data in memory, meaning encryption can be maintained while it is being used, indexed, queried, or trained on.

This promises to have profound implications for those industries that process highly sensitive or heavily regulated data, such as those in finance and health, or government agencies. Companies in these sectors, which are usually forced to keep most of their data processing in their own private networks, now have a public cloud option, Google claims.

“These companies want to adopt the latest cloud technologies, but strict requirements for data privacy or compliance are often barriers,” Sunil Potti, general manager and VP of Security at Google Cloud. “Confidential VMs… will help us better serve customers in these industries, so they can securely take advantage of the innovation of the cloud while also simplifying security operations.”

Providing confidential computing is largely a question of hardware, something that many vendors have grappled with over the past few years. In this case, Google has turned to AMD and its second-generation EPYC CPUs – these now support a ‘Secure Encrypted Virtualisation (SEV)’ feature, which allows a VM to run with encrypted memory using a unique, non-exportable, key.

“Our deep partnership with Google Cloud on its Confidential VMs solution helps ensure that customers can secure their data and achieve performance when adopting this transformational technology,” said Dan McNamara, senior vice president and general manager of AMD’s Server Business Unit.

“Confidential VMs offer high performance for the most demanding computational tasks all while keeping VM memory encrypted with a dedicated per-VM instance key that is generated and managed by our hardware.”

The company has also confirmed that any customers already running workloads in a VM on Google Cloud Platform will be able to shift these over to a Confidential VM using a checkbox.

Google has also said that VM memory encryption will not interfere with workload output, promising that the performance of Confidential VMs will be on-par with that of non-confidential VMs.

​Google has launched an early version of BigQuery Omni, its new analytics tool that lets users access and view data across Google Cloud and Amazon Web Services without leaving the Big Query UI.

Powered by Google Anthos, its vendor-neutral app development platform, users will be able to use SQL and the standard BigQuery APIs to manipulate data silos sourced from multiple platforms, without having to manage the underlying infrastructure.

Although the initial alpha launch of the service is restricted to Google Cloud and AWS, Google has also confirmed that Microsoft Azure will eventually be supported.

The tool has been designed to target those customers who rely on multiple cloud service providers and are forced to juggle and consolidate a number of analytics tools in order to get a view of their data.

This is made possible by the decoupling of storage and compute, according to the firm. The compute side has always been regarded as ‘stateless’ but, until now, BigQuery required data to be stored in Google Cloud – this restriction has now been scrapped, allowing customers to store their data in any supported public cloud.

This single view means that customers can use BigQuery Omni to run SQL queries on clusters in whichever region the data resides. For example, it will be possible to query Google Analytics 360 Ads data stored in Google Cloud while simultaneously querying logs data from any apps stored in AWS S3. This can then be used to build a dashboard to get a complete view of audience behaviour alongside ad spend.

This means customers can avoid any costs associated with moving or copying data between cloud platforms in order to get a full view, Google claims.

“85% of respondents to 451 Research’s Voice of the Enterprise Data & Analytics, Data Platforms 1H20 survey agreed that the ability to run the same database on multiple cloud/data centre environments is an important consideration when selecting a new data platform,” said Matt Aslett, research director, Data, AI and Analytics, 451 Research.

“As hybrid and multi-cloud adoption has become the norm, enterprises are increasingly looking for data products that provide a consistent experience and lower complexity of using multiple clouds, while enabling the ongoing use of existing infrastructure investments,» he added.

The new system is built using Anthos, an app development platform launched last year to appease customers that wanted a single programming model that allowed for data to be moved between their various cloud providers without charge or requiring changes.

The underlying infrastructure is run entirely by Google, including any communication between cloud providers, on the familiar BigQuery UI, so there will be little operational change from the customers’ perspective, the company claims.

BigQuery Omni’s engine will run on Anthos clusters inside the BigQuery managed service, and will source data from the various data silos across a customer’s public cloud services, provided they have provided authorisation. In order to run queries, data is temporarily moved from the cloud provider’s data storage to the BigQuery cluster running on Anthos.

For now, BigQuery Omni is only available in private alpha, so customers will need to apply to Google to use it if they’re interested. It’s also only available for AWS S3 for now, with Azure support coming soon.

There is currently no general release date available.

Software company SAP has patched a critical vulnerability that can be exploited by an unauthenticated hacker to take control of systems and applications.

The flaw, assigned CVE-2020-6287, affects the LM Configuration Wizard element of the NetWeaver Application Server (AS) Java platform, and affects potentially 40,000 customers, according to Onapsis, which discovered the vulnerability.

Alarmingly, the flaw has been rated 10 out of 10 on the CVSS scale and has spurred the United States Computer Emergency Readiness Team (US-CERT) into issuing an alert encouraging organisations to patch their systems immediately.

«Due to the criticality of this vulnerability, the attack surface this vulnerability represents, and the importance of SAP’s business applications, the Cybersecurity and Infrastructure Security Agency (CISA) strongly recommends organizations immediately apply patches,» the alert said. 

«CISA recommends organizations prioritize patching internet-facing systems, and then internal systems.»

Those unable to patch their systems should mitigate the vulnerability by disabling the LM Configuration Wizard service. Should this step be impossible, or take more than 24 hours to complete, CISA has recommended closely monitoring SAP NetWeaver AS for any suspicious or anomalous activity. 

The flaw is a result of the lack of authentication in a web component of the SAP NetWeaver AS for Java which allows for several high-privileged activities on the SAP system. 

Successful exploitation involves a remote hacker obtaining unrestricted access to SAP systems by creating high-privileged users and executing arbitrary OS commands with high privileges. Hackers would retain unrestricted access to the SAP database and can perform application maintenance activities. 

The flaw, in essence, entirely undermines confidentiality, integrity and availability of data and processes hosted by the SAP application. 

The vulnerability is present by default in SAP applications running over SAP NetWeaver AS Java 7.3, and any newer versions up to SAP NetWeaver 7.5, affecting a handful of applications. These include SAP Enterprise Resource Planning (ERP), SAP Product Lifecycle Management, SAP Customer Relationship Management (CRM), and around a dozen more.

Flaws rated 10/10 on the CVSS scale are barely encountered, and ordinarily mean the vulnerability is highly exploitable, easy to trigger, and require little or no additional privileges and user interaction. Nevertheless, the SAP flaw is the second 10-rated vulnerability discovered within a couple of weeks, after Palo Alto patched a flaw in its networking services based around its SAML-based authentication mechanism.

Both the SAP and Palo Alto flaws were highlighted by official US law enforcement agencies, the former flagged by US-CERT and the latter by US Cyber Command.

If you’re looking to move away from hybrid cloud and pack up your on-premises servers all together, but are worried about how your applications will run in the cloud, serverless computing could be the right strategy for you.

Serverless computing? As in running everything on desktops?

Ah, no – serverless computing means building your server functions in the cloud, rather than on a local, physical machine. In this way, they can benefit from demand-driven management, spinning up as required then closing down again when, for example, the entire human race decides to stay at home for several months. Ideally, functions should be fully portable, eschewing platform-specific services and tricks, so they’ll run in any data centre.

So we can go serverless and retire our old servers?

It’s unlikely that you’d be able to do a straightforward lift-and-shift of your old, badly behaved suite of IT resources up into the cloud. Any function that depends on some older technology (say, for example, a Windows dialog box) will have to be rebuilt with modern tools that embrace scalability and movability. Indeed, even once you’ve moved, it might make sense to keep your older servers running in parallel for some time, as a fallback in case of unforeseen hiccups. 

Could we at least streamline our local admin team?

If that’s your plan, make sure they’re ready to come back on a consultancy basis: you’re going to need their knowledge more than ever while the development is in progress, and likely for some time afterwards. Only the very simplest of businesses can make a consequence-free shift, and they’re still likely to need some techie oversight to ensure everything is scaling and behaving like it should.

Surely moving our everyday line-of-business functions off-site is going to slow things down?

If you have a big on-site compute load then it might, but for outward-facing services – that is, ones used by your customers rather than your employees – moving to a scalable architecture could speed things up. What’s more, a serverless approach easily allows for multiple instances so you can, for example, create different versions of your site for different users and markets.

Is it wise to put our critical functions in the hands of a third party?

Part of the beauty of the serverless model is that you’re not tied to any single provider. If there’s a problem with one host, you can just pop a serverless image onto a flash drive and fire it up somewhere else. Running instances here and there might not be cheap, but it’s a much more resilient position than one where yanking out a 13A lead will scuttle your whole operation.

Are there other benefits?

Most popular business apps are now very old: histories stretching back 20 years or more are not uncommon. That means you’re working with two decades of accumulated bug fixes, function changes and bloat. The process of moving to a serverless model gives you a chance to take stock, assess which parts of your code portfolio could work better in the cloud, and to re-engineer any broken or backward functions. 

So when will our everyday apps go serverless?

Basic, network-shared apps aren’t going to magically transform into serverless versions: the cost of moving outweighs the advantages. However, it may be that service providers (like your card payment processor) migrate you to serverless because you’re only using one specific part of their offering, so it makes sense for them to only fire up the code you’re using. That move will probably be entirely invisible to you, though – which is just as it should be. 

IBM has put out a job advert calling for a candidate with over 12-years of experience with Kubernetes administration and management. 

It looks like a fairly straight forward ad, except for the fact that Kubernetes has only been a thing for the last six years.

The advertisement, which is still live, calls for a «minimum» of 12 years experience in Kubernetes, including «hands-on» experience setting up Kubernetes platforms, deploying microservices and other web applications and managing secure secrets along with container orchestration.

It requires someone to have earned at least six years experience before the first GitHub post about the project was made on 7 June 2014.

As the Twitter account ‘Really Bad Job Ads‘ shows, it’s very common to make typos or strange syntactical errors in job ads, but nothing on its feed comes close to a giant tech company getting in a muddle over new technology.

In this regard, IBM is not alone, as developer Sebastián Ramírez pointed out on Twitter. He applied for a role that asked for over four years of experience using FastAPIs, but Ramírez knew all too well at the time that no one could have more than one and a half years experience of it because he created it. 

This also goes the other way with job seekers sometimes getting it wrong. Replying to Ramírez, researcher Lynn Boyden recalled an applicant in 2012 that said they had over 17-years of experience with web design.

«We interviewed a 28-year-old designer in 2012 who told us he had 17-years experience designing websites. I said, ‘Tim Berners-Lee doesn’t have 17 years experience designing websites’. ‘Who’s Tim Berners-Lee?’ he asked. So yeah.»

Again, this goes the other way as further down the replies, App designer Jens Ravens explained that he was once told he didn’t have enough experience with a certain iOS library during an interview, despite the fact he developed it.

Nokia has launched a set of tools, equipment and an operating system for data centre networking to help large companies manage growing traffic in light of increased 5G and machine learning adoption.

Working in collaboration with Apple to build the technology, Nokia has launched a data centre Network Operating System (NOS) as a toolkit to allow for intent-based automation and operations in data centres. This is in addition to new routers and switches.

The company’s data centre venture is based on the idea that the data centre will overlap with cloud and telecoms networks, with technologies like 5G and the Internet of Things (IoT) causing demand for data movements to rise.

​New research into cloud security management has found that 83% of UK organisations believe threats to cloud systems are outpacing their ability to effectively deploy countermeasures.

This places the UK behind the global average, at 71%. By contrast, only 53% of German enterprises believe the same.

Cyber security company Palo Alto Networks has published its findings about the practices, tools, and technologies that companies around the world use to manage security for cloud-native architecture, interviewing 3,000 professionals in cloud architecture, information security, DevOps, and application development located across the UK, Germany, USA, Singapore, and Australia.

The State of Cloud Native Security report shows that UK organisations today host 42% of their workloads in the cloud and expect this to increase to 65% in the next two years.

A significant majority (93%) of UK businesses admitted to using more than one cloud platform, while one in two (57%) said they use between two and five. The trend was reflected on a global scale, with 94% and 60% of global organisations admitting to the same respectively.

However, the report has found that the growing reliance on cloud infrastructure has not translated into increased confidence in cloud security. In fact, 84% of UK respondents admitted that their organisation struggles to draw a clear line between their own responsibility for cloud security and their cloud service providers responsibility for security.

Low confidence in cloud security, and undefined responsibility for it, coincides with a surge in the number of attacks on cloud accounts, up by 630% between January and April of this year, according to McAfee. A majority of these external attacks were large-scale attempts to access cloud accounts with stolen credentials and usually targeted collaboration services like Microsoft 365.

The research also found that, while overall enterprise use of cloud services increased by 50%, access to the cloud using unmanaged, personal devices doubled, contributing to the risk of company data being stolen.

Docker is expanding its collaboration with AWS to make its Compose and Desktop tools easier to use in container ecosystems.

The compose and desktop developer tools will be integrated with AWS Elastic Container Service (ECS) and ECS on AWS Fargate.

The container ecosystem has become complex, according to Docker. What used to be a simple case of A talking to B and B talking to a database, has expanded due to new managed container services. The complexity of it is helpful to operational teams that might want more control, but it makes it tougher for developers.

«With a large number of containers being built using Docker, we’re very excited to work with Docker to simplify the developer’s experience of building and deploying containerised applications to AWS,» said Deepak Singh, the VP for compute services at AWS.

«Now customers can easily deploy their containerised applications from their local Docker environment straight to Amazon ECS. This accelerated path to modern application development and deployment allows customers to focus more effort on the unique value of their applications, and less time on figuring out how to deploy to the cloud.»

A similar integration was announced in May for Microsoft Azure, shortening the developer commute for Azure Container Instances, highlighting Docker’s more developer-focused strategy. The company surprised many when it sold its enterprise business to Mirantis in 2019, but its reasoning was to solely focus on cloud-native development.

«Going forward, in partnership with the community and ecosystem, we will expand Docker Desktop and Docker Hub’s roles in the developer workflow for modern apps,» said CEO Scott Johnston.

«Specifically, we are investing in expanding our cloud services to enable developers to quickly discover technologies for use when building applications, to easily share these apps with teammates and the community, and to run apps frictionlessly on any Kubernetes endpoint, whether locally or in the cloud.»

Oracle has announced a package for enterprise customers to give them the full benefits of the company’s public cloud services while retaining all their data on-premise.

Dubbed Oracle Dedicated Region Cloud@Customer, the service is touted as the industry’s first fully-managed cloud region that brings more than 50 cloud services that can run from customers’ own data centres.

With packages starting at $500,000 per month, installing Oracle hardware in their own data centres allows enterprise customers with high security and regulatory commitments to benefit from cloud-based software without migrating their data.

Previously, Oracle customers adopting hybrid cloud configurations weren’t necessarily able to use all of the company’s cloud-based services due to incompatibility with their own hardware.

This new service will allow customers to port the entirety of Oracle’s software stack to their own data centres by installing Oracle hardware onsite.

«Enterprise customers have told us that they want the full experience of a public cloud on-premises, including access to all of Oracle’s cloud services, to run their most important workloads,» said executive vice president of engineering for Oracle Cloud Infrastructure, Clay Magouyrk.

«With Oracle Dedicated Region Cloud@Customer, enterprises get all of our second-generation cloud services, including Autonomous Database, in their datacenters. Our major competitors can’t offer customers a comparable dedicated cloud region running on-premises.»

However, the service will likely draw attention from those who campaign against practices that create vendor lock-in, as the installation of Oracle’s own hardware may make it more difficult for enterprise customers to transition to other providers should they wish.

Taking the fight to AWS

The move also represents an attempt to bring the fight to Amazon Web Services (AWS), as part of a long-running feud between the two companies, with Oracle taking on the highly similar AWS Outposts service.

AWS Outposts is Amazon’s fully managed and configurable compute and storage rack service built with AWS-designed hardware. The service allows AWS customers to run on-premise computing while connected to AWS services in the cloud.

Compared with Oracle Dedicated Region Cloud@Customer’s 50 cloud services, AWS Outposts only offers four, Oracle’s Larry Ellison claimed during an online event, according to Tech Radar.

AWS, incidentally, offers six services, including Amazon EC2, Amazon EBS, Amazon Elastic Container Service (ECS), Amazon Elastic Kubernetes Service (EKS), Amazon Relational Database Service (RDS), and Amazon Elastic MapReduce (EMR).

Ellison threw additional barbs at AWS while making the announcement, claiming Oracle’s compliance certifications and management are the same across the public cloud and dedicated region, unlike AWS Outposts.

He also highlighted AWS’ role – as he sees it – in last year’s infamous Capital One data breach in which the personal information of 100 million customers was targeted by cyber criminals due to a misconfigured web application.

The Oracle CEO said it happened because Amazon cloud databases require complex and manual provisioning, configuration, encryption, backup and security, suggesting it was very complicated and that human beings can make mistakes as a result, leading to data loss.

“With Oracle, it is 100% automated and users cannot make mistakes on 100% automated processes. It is the only database where a person who runs the database has no access to users’ data,” he added.

Despite the war of words, however, AWS still dominates the cloud market, leading the industry in terms of market share, followed by Microsoft Azure and Google Cloud Platform.

Microsoft has revealed a slew of changes to Teams that have been in development since the start of the coronavirus pandemic and subsequent lockdown.

The changes are designed to improve user experience on the collaboration platform and drive greater engagement.

It starts with «Together Mode», which is an artificial intelligence-based feature that places a digital avatar of the user in a virtual space. It essentially takes your face and shoulders and puts you, alongside the other members of the call, in a virtual theatre. This is being rolled out now, with other virtual spaces set to be added in the coming months.

The thinking behind the changes is to make users feel more «connected», according to Microsoft. It wants the service to be more inclusive by making people more visible when they join conference calls. To do this, it has added a «Dynamic View» which allows users to share content side by side with other participants.

In addition to Dynamic View, users can also share live reactions with their teammates. This essentially resembles emoji reactions that appear in their intended recipient’s box as they talk. Teams will also have video filters where users can adjust lighting levels or soften focus to improve your webcam while on a call.

Later in the year Teams will also support live transcriptions with a translate feature for meetings in other languages. The service will also get suggested replies for its chat features, similar to Gmail’s suggested replies function, that offers auto-fill text based on the context of the previous message in the channel. Microsoft is also adding ‘chat bubbles’ so that the messages can be seen more clearly by other participants in the call.
 
And, finally, Teams will also integrate Cortana, Microsoft’s voice assistant, on the mobile version of the service. Cortana will be able to make a call, join meetings, share files with colleagues and even send chat messages.