Welcome!

@CloudExpo Authors: Derek Weeks, Elizabeth White, Anders Wallgren, Pat Romanski, Miska Kaipiainen

Blog Feed Post

Cloudy with a Chance of Pharma Security

pharmaceutical compliance HIPAA Compliance Cloud Security Cloud HIPAA Cloud Encryption  pharm cloud security Cloudy with a Chance of Pharma SecurityCloud computing changes the way companies consume IT resources. It shifts the burden of purchasing and maintaining IT infrastructure to specialized IT providers and allows the users to pay only for the resources they need, when they need them. In this new paradigm, cloud security is a top concern.  Companies want to reap the benefits of cloud computing, but are often hesitant because of concerns about security and compliance. In the 21CFR11 regulation, the FDA focused on requirements for ensuring electronic record integrity, accuracy, and availability for agency review throughout the retention period.  The regulation emphasizes record protection from unauthorized access and system validation. Other international agencies have similar regulations. This article captures key points from an interview with Gilad Parann-Nissany, a cloud security pioneer. He addressed some hard questions that have been the main obstacles to getting more regulated healthcare and life sciences companies to adopt cloud infrastructures.

Gilad Parann-Nissany built SaaS Clouds for medium and small enterprises and contributed to SAP products reaching more than 8 million users. He created a consumer Cloud at G.ho.st – a cloud operating system that provided browser-based and mobile access to data, people and applications.  He is now CEO of Porticor, a cloud security company.

AG: We realize the benefits of public clouds, mainly our ability to use and pay for what we need at any given time and not having to deal with the hassle of buying and managing our own data centers, but is there a way we can truly trust that our systems are still compliant with FDA regulations and our data is secured in a public cloud and is protected to ensure record integrity and confidentiality?

GPN: Yes, the FUD is that public cloud seems open to hackers, corporate spies, government surveillance, and the like. When you analyze this perception, it comes down to the fact that people are used to having walls around their servers and data storage. In the cloud, you manage your servers and disks using a browser, and the concern is that the bad guys can access you servers and disks with equal convenience. It’s actually a reasonable concern.

Yet there is a serious way to replace walls.  Strong data encryption, of course, is the accepted best practice.  Basically you are replacing physical walls with mathematical walls. If you do it right, you end up more secure in the cloud then you would be at the typical company.

You must choose the right encryption techniques. Once your data is encrypted, the management of the encryption keys becomes critical.

If you encrypt your data and store your encryption keys in the same place, the keys become vulnerable to the same threats.  If you give the keys to your cloud provider, then you have lost control of your data. People worry whether cloud provider employees are trustworthy, and of course from a regulatory point of view – you are simply not allowed to farm out ownership of your sensitive healthcare data. So the way to keep ownership and still enjoy the cloud, is to encrypt data and keep ownership of your encryption keys.

A technical solution to this need is split key encryption.  It’s like the safety deposit box systems, which have two keys.  Your data is encrypted, and the encryption key is split into two parts where one part is held only by you.  Both parts are always required to access the data.  This way, only you control your data and the public cloud becomes effectively private and confidential.

AG: Regulatory agencies require that electronic records be available for inspection throughout their retention period, which can be many years. Is it possible to ensure record availability in 15-20 years, considering technology changes and the risk that the vendor will no longer provide the service?

GPN: The possibility that technology will change or that a vendor will stop providing the service does of course need to be taken into account. The most basic answer involves ensuring ease of copying out data and meta-data from one solution and into another.

Copying out your terabyte of data to some new place may take some time, yet it’s not something you do every day. The important point is to ensure that your technology of choice, and your vendor of choice, make it possible if necessary. This should be a standard operation – for example, for copying out data, it is best to ensure that standard copying commands are available; for copying out meta-data, ensure you have standard APIs, such as RESTful APIs.

You do need to be thoughtful choose the right approach to the cloud, but for the typical small to medium company – building out such capabilities yourself is ridiculous compared with the price/performance of the cloud solution.

AG: For validated systems, will adding a security layer require revalidation of the applications?  Will it modify the way our applications handle data? Will the applications require any modification?

GPN: By default, the best solutions out there will give you a transparent encryption and key management solution. They should also allow you to do something special (with an API), if that is justified by your needs – but they should not require it.

Your chosen security solution should be able to be inserted transparently between the application layer and the data layer. Deployment models could be as an agent (which you install on your servers, but does not change your application), or as a Virtual Appliance (which does not touch your servers at all, and is available as a virtual machine running independently in your cloud). Good solutions will offer both options and let you choose.

AG: Are security technologies platform independent? Will adding a security layer require us to limit our systems to certain platforms?

GPN: The good ones will work on all the major cloud platforms and with all the major operating systems (Windows, Linux, Unix, etc).

AG: Will the cost of adding a security layer negate the cost benefit of using a cloud?

GPN: Hell no. But you need to choose right. Some vendors out there are trying to sell you the old economic model even when you move to the cloud, which means in practice a high up front cost for getting a solution. You should look for a solution that is pay as you go, so that you pay only for what you use and only when you use it. That’s the cloud economic model, it should be a no brainer. If you select right – you’ll actually end up better than before.

Cloud security and Cloud encryption can protect your data in the public cloud, and meet the regulatory requirements. Bottom line, for many of the Healthcare workloads out there, it is a strong and secure contender.

The post Cloudy with a Chance of Pharma Security appeared first on Porticor Cloud Security.

Read the original blog entry...

More Stories By Gilad Parann-Nissany

Gilad Parann-Nissany, Founder and CEO at Porticor is a pioneer of Cloud Computing. He has built SaaS Clouds for medium and small enterprises at SAP (CTO Small Business); contributing to several SAP products and reaching more than 8 million users. Recently he has created a consumer Cloud at G.ho.st - a cloud operating system that delighted hundreds of thousands of users while providing browser-based and mobile access to data, people and a variety of cloud-based applications. He is now CEO of Porticor, a leader in Virtual Privacy and Cloud Security.

@CloudExpo Stories
Major trends and emerging technologies – from virtual reality and IoT, to Big Data and algorithms – are helping organizations innovate in the digital era. However, to create real business value, IT must think beyond the ‘what’ of digital transformation to the ‘how’ to harness emerging trends, innovation and disruption. Architecture is the key that underpins and ties all these efforts together. In the digital age, it’s important to invest in architecture, extend the enterprise footprint to the cl...
SYS-CON Events announced today the Kubernetes and Google Container Engine Workshop, being held November 3, 2016, in conjunction with @DevOpsSummit at 19th Cloud Expo at the Santa Clara Convention Center in Santa Clara, CA. This workshop led by Sebastian Scheele introduces participants to Kubernetes and Google Container Engine (GKE). Through a combination of instructor-led presentations, demonstrations, and hands-on labs, students learn the key concepts and practices for deploying and maintainin...
Cognitive Computing is becoming the foundation for a new generation of solutions that have the potential to transform business. Unlike traditional approaches to building solutions, a cognitive computing approach allows the data to help determine the way applications are designed. This contrasts with conventional software development that begins with defining logic based on the current way a business operates. In her session at 18th Cloud Expo, Judith S. Hurwitz, President and CEO of Hurwitz & ...
SYS-CON Events announced today that Tintri Inc., a leading producer of VM-aware storage (VAS) for virtualization and cloud environments, will exhibit at the 19th International Cloud Expo, which will take place on November 1–3, 2016, at the Santa Clara Convention Center in Santa Clara, CA. Tintri VM-aware storage is the simplest for virtualized applications and cloud. Organizations including GE, Toyota, United Healthcare, NASA and 6 of the Fortune 15 have said “No to LUNs.” With Tintri they mana...
In his keynote at 18th Cloud Expo, Andrew Keys, Co-Founder of ConsenSys Enterprise, provided an overview of the evolution of the Internet and the Database and the future of their combination – the Blockchain. Andrew Keys is Co-Founder of ConsenSys Enterprise. He comes to ConsenSys Enterprise with capital markets, technology and entrepreneurial experience. Previously, he worked for UBS investment bank in equities analysis. Later, he was responsible for the creation and distribution of life sett...
Fifty billion connected devices and still no winning protocols standards. HTTP, WebSockets, MQTT, and CoAP seem to be leading in the IoT protocol race at the moment but many more protocols are getting introduced on a regular basis. Each protocol has its pros and cons depending on the nature of the communications. Does there really need to be only one protocol to rule them all? Of course not. In his session at @ThingsExpo, Chris Matthieu, co-founder and CTO of Octoblu, walk you through how Oct...
Fact is, enterprises have significant legacy voice infrastructure that’s costly to replace with pure IP solutions. How can we bring this analog infrastructure into our shiny new cloud applications? There are proven methods to bind both legacy voice applications and traditional PSTN audio into cloud-based applications and services at a carrier scale. Some of the most successful implementations leverage WebRTC, WebSockets, SIP and other open source technologies. In his session at @ThingsExpo, Da...
SYS-CON Events announced today that ReadyTalk, a leading provider of online conferencing and webinar services, has been named Vendor Presentation Sponsor at the 19th International Cloud Expo, which will take place on November 1–3, 2016, at the Santa Clara Convention Center in Santa Clara, CA. ReadyTalk delivers audio and web conferencing services that inspire collaboration and enable the Future of Work for today’s increasingly digital and mobile workforce. By combining intuitive, innovative tec...
SYS-CON Events announced today that Secure Channels will exhibit at the 19th International Cloud Expo, which will take place on November 1–3, 2016, at the Santa Clara Convention Center in Santa Clara, CA. The bedrock of Secure Channels Technology is a uniquely modified and enhanced process based on superencipherment. Superencipherment is the process of encrypting an already encrypted message one or more times, either using the same or a different algorithm.
Vidyo, Inc., has joined the Alliance for Open Media. The Alliance for Open Media is a non-profit organization working to define and develop media technologies that address the need for an open standard for video compression and delivery over the web. As a member of the Alliance, Vidyo will collaborate with industry leaders in pursuit of an open and royalty-free AOMedia Video codec, AV1. Vidyo’s contributions to the organization will bring to bear its long history of expertise in codec technolo...
Traditional on-premises data centers have long been the domain of modern data platforms like Apache Hadoop, meaning companies who build their business on public cloud were challenged to run Big Data processing and analytics at scale. But recent advancements in Hadoop performance, security, and most importantly cloud-native integrations, are giving organizations the ability to truly gain value from all their data. In his session at 19th Cloud Expo, David Tishgart, Director of Product Marketing ...
SYS-CON Events announced today that Bsquare has been named “Silver Sponsor” of SYS-CON's @ThingsExpo, which will take place on November 1–3, 2016, at the Santa Clara Convention Center in Santa Clara, CA. For more than two decades, Bsquare has helped its customers extract business value from a broad array of physical assets by making them intelligent, connecting them, and using the data they generate to optimize business processes.
Digitization is driving a fundamental change in society that is transforming the way businesses work with their customers, their supply chains and their people. Digital transformation leverages DevOps best practices, such as Agile Parallel Development, Continuous Delivery and Agile Operations to capitalize on opportunities and create competitive differentiation in the application economy. However, information security has been notably absent from the DevOps movement. Speed doesn’t have to negat...
If you’re responsible for an application that depends on the data or functionality of various IoT endpoints – either sensors or devices – your brand reputation depends on the security, reliability, and compliance of its many integrated parts. If your application fails to deliver the expected business results, your customers and partners won't care if that failure stems from the code you developed or from a component that you integrated. What can you do to ensure that the endpoints work as expect...
The Transparent Cloud-computing Consortium (abbreviation: T-Cloud Consortium) will conduct research activities into changes in the computing model as a result of collaboration between "device" and "cloud" and the creation of new value and markets through organic data processing High speed and high quality networks, and dramatic improvements in computer processing capabilities, have greatly changed the nature of applications and made the storing and processing of data on the network commonplace.
Your business relies on your applications and your employees to stay in business. Whether you develop apps or manage business critical apps that help fuel your business, what happens when users experience sluggish performance? You and all technical teams across the organization – application, network, operations, among others, as well as, those outside the organization, like ISPs and third-party providers – are called in to solve the problem.
The vision of a connected smart home is becoming reality with the application of integrated wireless technologies in devices and appliances. The use of standardized and TCP/IP networked wireless technologies in line-powered and battery operated sensors and controls has led to the adoption of radios in the 2.4GHz band, including Wi-Fi, BT/BLE and 802.15.4 applied ZigBee and Thread. This is driving the need for robust wireless coexistence for multiple radios to ensure throughput performance and th...
Enterprise IT has been in the era of Hybrid Cloud for some time now. But it seems most conversations about Hybrid are focused on integrating AWS, Microsoft Azure, or Google ECM into existing on-premises systems. Where is all the Private Cloud? What do technology providers need to do to make their offerings more compelling? How should enterprise IT executives and buyers define their focus, needs, and roadmap, and communicate that clearly to the providers?
SYS-CON Events announced today that Commvault, a global leader in enterprise data protection and information management, has been named “Bronze Sponsor” of SYS-CON's 19th International Cloud Expo, which will take place on November 1–3, 2016, at the Santa Clara Convention Center in Santa Clara, CA. Commvault is a leading provider of data protection and information management solutions, helping companies worldwide activate their data to drive more value and business insight and to transform moder...
The Internet of Things can drive efficiency for airlines and airports. In their session at @ThingsExpo, Shyam Varan Nath, Principal Architect with GE, and Sudip Majumder, senior director of development at Oracle, will discuss the technical details of the connected airline baggage and related social media solutions. These IoT applications will enhance travelers' journey experience and drive efficiency for the airlines and the airports. The session will include a working demo and a technical d...