Cloud security is a huge, ever evolving subject that is difficult to cover in a short space, especially with so many different cloud service types and architectures (SaaS, IaaS, PaaS, external, internal, and hybrid). However, there are a few cloud security practices that just about any organization should apply when working with the cloud.
Don’t think you can just hand a function over to a cloud provider and forget about it. Like any other IT component, cloud services must be managed and secured using policy, monitoring, and security tools and services.
Before contracting with a cloud service, make sure your internal security is up to date first. Don’t let your corporate network become the weakest link in the chain.
If you don’t use cloud services, your employees most likely do or will. IT should evaluate corporate applications, business processes, and data according to their value to the organization and risk when deployed wholly or partially in the cloud, then create a cloud use policy that spells out what may be allowed in the cloud and what isn’t. For applications that can be deployed in the cloud, spell out precautions and tools that must be employed to use the cloud securely.
Create a list of cloud services that IT has investigated and deemed acceptable in terms of security.
Start cloud use with low-risk, non-core functions until your organization gets a grip on the security landscape.
Make it clear that internal developers cannot test software in the cloud using live or sensitive corporate or customer information.
Investigate cloud provider contracts and SLA’s carefully. Does the provider take responsibility for your data and provide security guarantees? Does the service offer visibility into security events and responses? Is it willing to provide monitoring tools or hooks into your corporate monitoring tools? Does it provide monthly reports on security events and responses? What happens to your data if you terminate the service?
Don’t accept the provider’s standard contracts and SLAs. Evaluate your own compliance and security needs carefully and employ tech and compliance savvy lawyers to negotiate service contracts and SLA’s that fulfill those needs. Get guarantees on data location or use a hybrid model with data stored internally.
Examine the provider’s data protection strategies and multitenant architecture, if relevant.
Look for standard audits and certifications such as SAS 70 Type II or ISO 27001, then examine the audits carefully to understand potential security gaps. Look for ways to fill those gaps. If the provider uses third party providers, examine their certifications and audits as well.
Make sure the provider allows your organization to audit its security periodically as well.
Look for software services that comply with SAML, OpenID or other federation standards that make it possible to extend your corporate identity management tools into the cloud. Consider employing two-factor authentication for very sensitive data.
Encrypt all data BEFORE it goes to the cloud in transit and at rest. Make sure the provider has sufficient strategies for wiping released data from both memory and storage.
Negotiate specific procedures and roles for incident response. Make sure the provider includes you and considers you a partner.
In most cases users access the cloud through their client Web browsers. Make sure you employ strong client security tools and that your browsers are properly updated and protected from browser exploits.
The list is endless and the cloud is still an evolving learning experience, but this is a good start. With the right strategies your cloud deployment can be reasonably secure.
To find out what McAfee’s doing in the cloud space, visit our SaaS solution page, and be sure to follow @McAfeeBusiness on Twitter for future updates.
By: Leon Erlanger
Tuesday, November 15, 2011
Monday, November 14, 2011
Recipe For Spoiling Holiday Cheer: Top Holiday Viruses & Scams
Somehow, it is that time again. The holiday season is upon us and I have no idea where the year went! If you have been following my blog or anyone else on the McAfee team, you know what that means… the 12 Scams of Christmas!
This year we truly have some new threats out there so I decided that I would highlight each of the scams individually this year over the next few blogs. That way I can break each one down clearly. I want you all to know exactly what these scams look like so you can spot them a mile away!
The 2011 list of scams looks like this:
1. Mobile Malware – Malware targeted specifically at smart phones
2. Malicious Mobile Applications – Apps for your smartphone containing Malware
3. Phony Facebook Promotions and Contests – “Get two free airline tickets!” but give up your personal info first!
4. Scareware and Fake Antivirus – A window pops up on your computer telling you that you have a virus, and you will if you click on it!
5. Holiday Screensavers – Free holiday themed screensavers aren’t so jolly when they contain malicious code! Steer clear of “Fly with Santa in 3-D”!
6. Mac Malware – A new and growing threat
7. Holiday Phishing Scams- Phony notices from UPS, banking phishing scams and Smishing (SMS phishing) all are tricks criminals use hoping that you are too busy to be careful
8. Online Coupon Scams – get a coupon or a “free iPad” but give up your banking or credit card info first!
9. Mystery Shopper Scams – Get paid $50 per hour to shop, but give up that credit card number
10. Hotel “Wrong Transaction” Malware Emails – Email scam looks like it comes from a real hotel and they want to issue a “refund”… after you fill out this form.
11. “It” Gift Scams – Criminals try to cash in on whatever the hot gift of the year is
12. “I’m Away From Home” Scammers – Updating social networks with “I am out of town” could lead to break ins of your home
I will be going into detail over the next three weeks about each of these scams. In the meanwhile follow these tips from McAfee to stay safe this holiday season.
1. Only download mobile apps from official app stores, such as iTunes and the Android Market, and read user reviews before downloading them.
2. Be extra vigilant when reviewing and responding to emails.
3. Watch out for too-good-to-be-true offers on social networks (like free airline tickets). Never agree to reveal your personal information just to participate in a promotion.
4. Don’t accept requests on social networks from people you don’t know in real life. Wait to post pictures and comments about your vacation until you’ve already returned home.
From November 9 – 15, McAfee will be offering a complimentary PDF copy of a just released book on www.facebook.com/mcafee called 99 Things You Wish You Knew Before®… Your Identity Was Stolen, authored by identity theft expert Robert Siciliano. After this time, the book will be available in print, ePub, and PDF and can be found on Amazon, Amazon Kindle, and the Sony eBook Store and http://www.99-series.com/store.html from $5.99-$14.97.
Post your questions below and I will be sure to answer them over the next few posts. Stay safe out there!
By: Tracey Mooney
This year we truly have some new threats out there so I decided that I would highlight each of the scams individually this year over the next few blogs. That way I can break each one down clearly. I want you all to know exactly what these scams look like so you can spot them a mile away!
The 2011 list of scams looks like this:
1. Mobile Malware – Malware targeted specifically at smart phones
2. Malicious Mobile Applications – Apps for your smartphone containing Malware
3. Phony Facebook Promotions and Contests – “Get two free airline tickets!” but give up your personal info first!
4. Scareware and Fake Antivirus – A window pops up on your computer telling you that you have a virus, and you will if you click on it!
5. Holiday Screensavers – Free holiday themed screensavers aren’t so jolly when they contain malicious code! Steer clear of “Fly with Santa in 3-D”!
6. Mac Malware – A new and growing threat
7. Holiday Phishing Scams- Phony notices from UPS, banking phishing scams and Smishing (SMS phishing) all are tricks criminals use hoping that you are too busy to be careful
8. Online Coupon Scams – get a coupon or a “free iPad” but give up your banking or credit card info first!
9. Mystery Shopper Scams – Get paid $50 per hour to shop, but give up that credit card number
10. Hotel “Wrong Transaction” Malware Emails – Email scam looks like it comes from a real hotel and they want to issue a “refund”… after you fill out this form.
11. “It” Gift Scams – Criminals try to cash in on whatever the hot gift of the year is
12. “I’m Away From Home” Scammers – Updating social networks with “I am out of town” could lead to break ins of your home
I will be going into detail over the next three weeks about each of these scams. In the meanwhile follow these tips from McAfee to stay safe this holiday season.
1. Only download mobile apps from official app stores, such as iTunes and the Android Market, and read user reviews before downloading them.
2. Be extra vigilant when reviewing and responding to emails.
3. Watch out for too-good-to-be-true offers on social networks (like free airline tickets). Never agree to reveal your personal information just to participate in a promotion.
4. Don’t accept requests on social networks from people you don’t know in real life. Wait to post pictures and comments about your vacation until you’ve already returned home.
From November 9 – 15, McAfee will be offering a complimentary PDF copy of a just released book on www.facebook.com/mcafee called 99 Things You Wish You Knew Before®… Your Identity Was Stolen, authored by identity theft expert Robert Siciliano. After this time, the book will be available in print, ePub, and PDF and can be found on Amazon, Amazon Kindle, and the Sony eBook Store and http://www.99-series.com/store.html from $5.99-$14.97.
Post your questions below and I will be sure to answer them over the next few posts. Stay safe out there!
By: Tracey Mooney
Subscribe to:
Posts (Atom)