Welcome!

@CloudExpo Authors: Elizabeth White, Rene Buest, Liz McMillan, Mehdi Daoudi, Astadia CloudGPS

Related Topics: @CloudExpo, Cloud Security

@CloudExpo: Blog Feed Post

Is Cloud Security an Oxymoron? By @GiladPN | @CloudExpo [#Cloud]

A recent cloud security survey conducted by HP reveals that 70 percent of all respondents say they are using some form of cloud

Cloud computing is increasingly becoming part of the enterprise IT landscape. In fact, a recent cloud security survey conducted by HP reveals that 70 percent of all respondents say their company is using some form of the cloud. The study also found that cloud penetration jumps to 80 percent for enterprise-size organizations. With such dramatic growth figures, it is no wonder that enterprise companies are carefully reviewing cloud security policies’ implication on cloud data. Here’s another fact from that same survey: While more than half of those using the public cloud are confident that critical and sensitive data can be secured in the public cloud, 16 percent of all companies in the cloud reported at least one public cloud breach in the past 12 months.

So, does this mean that migrating data and apps to the cloud inherently harms your security policies?

Cloud security and the shared responsibility model

Simply put, leading cloud vendors are providing a highly secure infrastructure, most probably on par or stronger than security measures implemented in many enterprise datacenters (a fact that might explain the sense of security expressed in the HP survey). The problem is that cloud security is a shared responsibility. While the cloud vendor will own and manage security for virtualization and other elements it manages, it is the customer’s responsibility to implement security measures around the data. Security measures will vary according to the cloud type (Software as a Service clouds will allow limited control, while Infrastructure as a Service clouds will provide more flexibility with regards to security tools implementation), but one fact is constant: It is your responsibility to secure your data.

When it comes to comparing the old datacenter and the new cloud, chances are that the infrastructure you rely on is even more secure in the cloud. Cloud providers such as Amazon Web Services or HP Helion have more resources to invest in the infrastructure than most companies operating a datacenter. And since the responsibility to secure the data is yours both in the datacenter and in the cloud, it seems that you are only improving your policies by relying on a public cloud.

Software is the new hardware

As you’d expect, cloud computing added a significant complexity to enterprise security policies. Let’s take encryption and management of the encryption keys, for example. In the datacenter, you managed and secured your own keys, so their fate was always in your hands.

In the cloud, some companies find themselves having to trust third parties with their keys, which presents a problem both to security policies and to regulatory compliance. Other companies have been storing their keys in the cloud, alongside their data. In case of a breach, the key is exposed along with the data. And some are trying to force existing on-premise solutions such as Hardware Security Modules (HSM) to the cloud encryption strategy.

Cloud security solutions

There’s a need for a fundamentally different approach for cloud data encryption, one that leverages the benefits of the cloud (software only, scale as you grow, pay as you go) without compromising security and compliance requirements for data ownership and split-knowledge. One example is the use of split key encryption with homomorphic key management.

The split key method, as its name implies, splits your encryption key in two “shares.” One share is managed by a key management service, and one share remains always in the customer’s control. This way, even if one share is hacked or compromised in some way, it is useless without its counterpart.

With homomorphic key management, the customer’s project master key share is itself encrypted. This way, even while it is in use in the cloud, it is safe.

Combining these two innovations ensures that your cloud security policies are the strongest in the industry. Hackers cannot break them. Employees of cloud providers have no access to them. Even subpoenas cannot access your data; the worst they can do is get half of the key, which is unusable without the half that is always in your possession.

Strengthening Cloud Security Policies

In fact, migrating data out of a physical datacenter and into the cloud can potentially strengthen your security policies, not weaken them. That is because:

In a cloud, infrastructure is maintained by greater resources

By using split key encryption and homomorphic key management, no one can get your encryption keys

Compliance with regulations such as healthcare’s HIPAA and finance/ecommerce’s PCI DSS can be achieved with these cloud security precautions.

The post Is Cloud Security an Oxymoron? appeared first on Porticor Cloud Security.

Read the original blog entry...

More Stories By Gilad Parann-Nissany

Gilad Parann-Nissany, Founder and CEO at Porticor is a pioneer of Cloud Computing. He has built SaaS Clouds for medium and small enterprises at SAP (CTO Small Business); contributing to several SAP products and reaching more than 8 million users. Recently he has created a consumer Cloud at G.ho.st - a cloud operating system that delighted hundreds of thousands of users while providing browser-based and mobile access to data, people and a variety of cloud-based applications. He is now CEO of Porticor, a leader in Virtual Privacy and Cloud Security.

@CloudExpo Stories
"We're here to tell the world about our cloud-scale infrastructure that we have at Juniper combined with the world-class security that we put into the cloud," explained Lisa Guess, VP of Systems Engineering at Juniper Networks, in this SYS-CON.tv interview at 20th Cloud Expo, held June 6-8, 2017, at the Javits Center in New York City, NY.
"With Digital Experience Monitoring what used to be a simple visit to a web page has exploded into app on phones, data from social media feeds, competitive benchmarking - these are all components that are only available because of some type of digital asset," explained Leo Vasiliou, Director of Web Performance Engineering at Catchpoint Systems, in this SYS-CON.tv interview at DevOps Summit at 20th Cloud Expo, held June 6-8, 2017, at the Javits Center in New York City, NY.
Your homes and cars can be automated and self-serviced. Why can't your storage? From simply asking questions to analyze and troubleshoot your infrastructure, to provisioning storage with snapshots, recovery and replication, your wildest sci-fi dream has come true. In his session at @DevOpsSummit at 20th Cloud Expo, Dan Florea, Director of Product Management at Tintri, provided a ChatOps demo where you can talk to your storage and manage it from anywhere, through Slack and similar services with...
"Peak 10 is a hybrid infrastructure provider across the nation. We are in the thick of things when it comes to hybrid IT," explained Michael Fuhrman, Chief Technology Officer at Peak 10, in this SYS-CON.tv interview at 20th Cloud Expo, held June 6-8, 2017, at the Javits Center in New York City, NY.
As enterprise cloud becomes the norm, businesses and government programs must address compounded regulatory compliance related to data privacy and information protection. The most recent, Controlled Unclassified Information and the EU’s GDPR have board level implications and companies still struggle with demonstrating due diligence. Developers and DevOps leaders, as part of the pre-planning process and the associated supply chain, could benefit from updating their code libraries and design by in...
SYS-CON Events announced today that Calligo, an innovative cloud service provider offering mid-sized companies the highest levels of data privacy and security, has been named "Bronze Sponsor" of SYS-CON's 21st International Cloud Expo ®, which will take place on Oct 31 - Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA. Calligo offers unparalleled application performance guarantees, commercial flexibility and a personalised support service from its globally located cloud plat...
"We are an IT services solution provider and we sell software to support those solutions. Our focus and key areas are around security, enterprise monitoring, and continuous delivery optimization," noted John Balsavage, President of A&I Solutions, in this SYS-CON.tv interview at 20th Cloud Expo, held June 6-8, 2017, at the Javits Center in New York City, NY.
"We were founded in 2003 and the way we were founded was about good backup and good disaster recovery for our clients, and for the last 20 years we've been pretty consistent with that," noted Marc Malafronte, Territory Manager at StorageCraft, in this SYS-CON.tv interview at 20th Cloud Expo, held June 6-8, 2017, at the Javits Center in New York City, NY.
There is a huge demand for responsive, real-time mobile and web experiences, but current architectural patterns do not easily accommodate applications that respond to events in real time. Common solutions using message queues or HTTP long-polling quickly lead to resiliency, scalability and development velocity challenges. In his session at 21st Cloud Expo, Ryland Degnan, a Senior Software Engineer on the Netflix Edge Platform team, will discuss how by leveraging a reactive stream-based protocol,...
"We are focused on SAP running in the clouds, to make this super easy because we believe in the tremendous value of those powerful worlds - SAP and the cloud," explained Frank Stienhans, CTO of Ocean9, Inc., in this SYS-CON.tv interview at 20th Cloud Expo, held June 6-8, 2017, at the Javits Center in New York City, NY.
"DivvyCloud as a company set out to help customers automate solutions to the most common cloud problems," noted Jeremy Snyder, VP of Business Development at DivvyCloud, in this SYS-CON.tv interview at 20th Cloud Expo, held June 6-8, 2017, at the Javits Center in New York City, NY.
DevOps at Cloud Expo, taking place October 31 - November 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA, is co-located with 21st Cloud Expo and will feature technical sessions from a rock star conference faculty and the leading industry players in the world. The widespread success of cloud computing is driving the DevOps revolution in enterprise IT. Now as never before, development teams must communicate and collaborate in a dynamic, 24/7/365 environment. There is no time to w...
"As we've gone out into the public cloud we've seen that over time we may have lost a few things - we've lost control, we've given up cost to a certain extent, and then security, flexibility," explained Steve Conner, VP of Sales at Cloudistics,in this SYS-CON.tv interview at 20th Cloud Expo, held June 6-8, 2017, at the Javits Center in New York City, NY.
Internet of @ThingsExpo, taking place October 31 - November 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA, is co-located with 21st Cloud Expo and will feature technical sessions from a rock star conference faculty and the leading industry players in the world. The Internet of Things (IoT) is the most profound change in personal and enterprise IT since the creation of the Worldwide Web more than 20 years ago. All major researchers estimate there will be tens of billions devic...
"The Striim platform is a full end-to-end streaming integration and analytics platform that is middleware that covers a lot of different use cases," explained Steve Wilkes, Founder and CTO at Striim, in this SYS-CON.tv interview at 20th Cloud Expo, held June 6-8, 2017, at the Javits Center in New York City, NY.
"We want to show that our solution is far less expensive with a much better total cost of ownership so we announced several key features. One is called geo-distributed erasure coding, another is support for KVM and we introduced a new capability called Multi-Part," explained Tim Desai, Senior Product Marketing Manager at Hitachi Data Systems, in this SYS-CON.tv interview at 20th Cloud Expo, held June 6-8, 2017, at the Javits Center in New York City, NY.
21st International Cloud Expo, taking place October 31 - November 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA, will feature technical sessions from a rock star conference faculty and the leading industry players in the world. Cloud computing is now being embraced by a majority of enterprises of all sizes. Yesterday's debate about public vs. private has transformed into the reality of hybrid cloud: a recent survey shows that 74% of enterprises have a hybrid cloud strategy. Me...
SYS-CON Events announced today that DXWorldExpo has been named “Global Sponsor” of SYS-CON's 21st International Cloud Expo, which will take place on Oct 31 – Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA. Digital Transformation is the key issue driving the global enterprise IT business. Digital Transformation is most prominent among Global 2000 enterprises and government institutions.
SYS-CON Events announced today that Datera, that offers a radically new data management architecture, has been named "Exhibitor" of SYS-CON's 21st International Cloud Expo ®, which will take place on Oct 31 - Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA. Datera is transforming the traditional datacenter model through modern cloud simplicity. The technology industry is at another major inflection point. The rise of mobile, the Internet of Things, data storage and Big...
Kubernetes is an open source system for automating deployment, scaling, and management of containerized applications. Kubernetes was originally built by Google, leveraging years of experience with managing container workloads, and is now a Cloud Native Compute Foundation (CNCF) project. Kubernetes has been widely adopted by the community, supported on all major public and private cloud providers, and is gaining rapid adoption in enterprises. However, Kubernetes may seem intimidating and complex ...