Welcome!

@CloudExpo Authors: Liz McMillan, Charles Araujo, Kevin Benedict, Yeshim Deniz, Ed Witkovic

Related Topics: @CloudExpo, Cloud Security

@CloudExpo: Blog Feed Post

Is Cloud Security an Oxymoron? By @GiladPN | @CloudExpo [#Cloud]

A recent cloud security survey conducted by HP reveals that 70 percent of all respondents say they are using some form of cloud

Cloud computing is increasingly becoming part of the enterprise IT landscape. In fact, a recent cloud security survey conducted by HP reveals that 70 percent of all respondents say their company is using some form of the cloud. The study also found that cloud penetration jumps to 80 percent for enterprise-size organizations. With such dramatic growth figures, it is no wonder that enterprise companies are carefully reviewing cloud security policies’ implication on cloud data. Here’s another fact from that same survey: While more than half of those using the public cloud are confident that critical and sensitive data can be secured in the public cloud, 16 percent of all companies in the cloud reported at least one public cloud breach in the past 12 months.

So, does this mean that migrating data and apps to the cloud inherently harms your security policies?

Cloud security and the shared responsibility model

Simply put, leading cloud vendors are providing a highly secure infrastructure, most probably on par or stronger than security measures implemented in many enterprise datacenters (a fact that might explain the sense of security expressed in the HP survey). The problem is that cloud security is a shared responsibility. While the cloud vendor will own and manage security for virtualization and other elements it manages, it is the customer’s responsibility to implement security measures around the data. Security measures will vary according to the cloud type (Software as a Service clouds will allow limited control, while Infrastructure as a Service clouds will provide more flexibility with regards to security tools implementation), but one fact is constant: It is your responsibility to secure your data.

When it comes to comparing the old datacenter and the new cloud, chances are that the infrastructure you rely on is even more secure in the cloud. Cloud providers such as Amazon Web Services or HP Helion have more resources to invest in the infrastructure than most companies operating a datacenter. And since the responsibility to secure the data is yours both in the datacenter and in the cloud, it seems that you are only improving your policies by relying on a public cloud.

Software is the new hardware

As you’d expect, cloud computing added a significant complexity to enterprise security policies. Let’s take encryption and management of the encryption keys, for example. In the datacenter, you managed and secured your own keys, so their fate was always in your hands.

In the cloud, some companies find themselves having to trust third parties with their keys, which presents a problem both to security policies and to regulatory compliance. Other companies have been storing their keys in the cloud, alongside their data. In case of a breach, the key is exposed along with the data. And some are trying to force existing on-premise solutions such as Hardware Security Modules (HSM) to the cloud encryption strategy.

Cloud security solutions

There’s a need for a fundamentally different approach for cloud data encryption, one that leverages the benefits of the cloud (software only, scale as you grow, pay as you go) without compromising security and compliance requirements for data ownership and split-knowledge. One example is the use of split key encryption with homomorphic key management.

The split key method, as its name implies, splits your encryption key in two “shares.” One share is managed by a key management service, and one share remains always in the customer’s control. This way, even if one share is hacked or compromised in some way, it is useless without its counterpart.

With homomorphic key management, the customer’s project master key share is itself encrypted. This way, even while it is in use in the cloud, it is safe.

Combining these two innovations ensures that your cloud security policies are the strongest in the industry. Hackers cannot break them. Employees of cloud providers have no access to them. Even subpoenas cannot access your data; the worst they can do is get half of the key, which is unusable without the half that is always in your possession.

Strengthening Cloud Security Policies

In fact, migrating data out of a physical datacenter and into the cloud can potentially strengthen your security policies, not weaken them. That is because:

In a cloud, infrastructure is maintained by greater resources

By using split key encryption and homomorphic key management, no one can get your encryption keys

Compliance with regulations such as healthcare’s HIPAA and finance/ecommerce’s PCI DSS can be achieved with these cloud security precautions.

The post Is Cloud Security an Oxymoron? appeared first on Porticor Cloud Security.

Read the original blog entry...

More Stories By Gilad Parann-Nissany

Gilad Parann-Nissany, Founder and CEO at Porticor is a pioneer of Cloud Computing. He has built SaaS Clouds for medium and small enterprises at SAP (CTO Small Business); contributing to several SAP products and reaching more than 8 million users. Recently he has created a consumer Cloud at G.ho.st - a cloud operating system that delighted hundreds of thousands of users while providing browser-based and mobile access to data, people and a variety of cloud-based applications. He is now CEO of Porticor, a leader in Virtual Privacy and Cloud Security.

@CloudExpo Stories
"We're focused on how to get some of the attributes that you would expect from an Amazon, Azure, Google, and doing that on-prem. We believe today that you can actually get those types of things done with certain architectures available in the market today," explained Steve Conner, VP of Sales at Cloudistics, in this SYS-CON.tv interview at 21st Cloud Expo, held Oct 31 – Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA.
Sanjeev Sharma Joins November 11-13, 2018 @DevOpsSummit at @CloudEXPO New York Faculty. Sanjeev Sharma is an internationally known DevOps and Cloud Transformation thought leader, technology executive, and author. Sanjeev's industry experience includes tenures as CTO, Technical Sales leader, and Cloud Architect leader. As an IBM Distinguished Engineer, Sanjeev is recognized at the highest levels of IBM's core of technical leaders.
As Cybric's Chief Technology Officer, Mike D. Kail is responsible for the strategic vision and technical direction of the platform. Prior to founding Cybric, Mike was Yahoo's CIO and SVP of Infrastructure, where he led the IT and Data Center functions for the company. He has more than 24 years of IT Operations experience with a focus on highly-scalable architectures.
JETRO showcased Japan Digital Transformation Pavilion at SYS-CON's 21st International Cloud Expo® at the Santa Clara Convention Center in Santa Clara, CA. The Japan External Trade Organization (JETRO) is a non-profit organization that provides business support services to companies expanding to Japan. With the support of JETRO's dedicated staff, clients can incorporate their business; receive visa, immigration, and HR support; find dedicated office space; identify local government subsidies; get...
Dion Hinchcliffe is an internationally recognized digital expert, bestselling book author, frequent keynote speaker, analyst, futurist, and transformation expert based in Washington, DC. He is currently Chief Strategy Officer at the industry-leading digital strategy and online community solutions firm, 7Summits.
Bill Schmarzo, author of "Big Data: Understanding How Data Powers Big Business" and "Big Data MBA: Driving Business Strategies with Data Science," is responsible for setting the strategy and defining the Big Data service offerings and capabilities for EMC Global Services Big Data Practice. As the CTO for the Big Data Practice, he is responsible for working with organizations to help them identify where and how to start their big data journeys. He's written several white papers, is an avid blogge...
DXWorldEXPO LLC announced today that Dez Blanchfield joined the faculty of CloudEXPO's "10-Year Anniversary Event" which will take place on November 11-13, 2018 in New York City. Dez is a strategic leader in business and digital transformation with 25 years of experience in the IT and telecommunications industries developing strategies and implementing business initiatives. He has a breadth of expertise spanning technologies such as cloud computing, big data and analytics, cognitive computing, m...
22nd International Cloud Expo, taking place June 5-7, 2018, at the Javits Center in New York City, NY, and co-located with the 1st DXWorld Expo will feature technical sessions from a rock star conference faculty and the leading industry players in the world. Cloud computing is now being embraced by a majority of enterprises of all sizes. Yesterday's debate about public vs. private has transformed into the reality of hybrid cloud: a recent survey shows that 74% of enterprises have a hybrid cloud ...
In past @ThingsExpo presentations, Joseph di Paolantonio has explored how various Internet of Things (IoT) and data management and analytics (DMA) solution spaces will come together as sensor analytics ecosystems. This year, in his session at @ThingsExpo, Joseph di Paolantonio from DataArchon, added the numerous Transportation areas, from autonomous vehicles to “Uber for containers.” While IoT data in any one area of Transportation will have a huge impact in that area, combining sensor analytic...
Bill Schmarzo, author of "Big Data: Understanding How Data Powers Big Business" and "Big Data MBA: Driving Business Strategies with Data Science," is responsible for setting the strategy and defining the Big Data service offerings and capabilities for EMC Global Services Big Data Practice. As the CTO for the Big Data Practice, he is responsible for working with organizations to help them identify where and how to start their big data journeys. He's written several white papers, is an avid blogge...
Charles Araujo is an industry analyst, internationally recognized authority on the Digital Enterprise and author of The Quantum Age of IT: Why Everything You Know About IT is About to Change. As Principal Analyst with Intellyx, he writes, speaks and advises organizations on how to navigate through this time of disruption. He is also the founder of The Institute for Digital Transformation and a sought after keynote speaker. He has been a regular contributor to both InformationWeek and CIO Insight...
Michael Maximilien, better known as max or Dr. Max, is a computer scientist with IBM. At IBM Research Triangle Park, he was a principal engineer for the worldwide industry point-of-sale standard: JavaPOS. At IBM Research, some highlights include pioneering research on semantic Web services, mashups, and cloud computing, and platform-as-a-service. He joined the IBM Cloud Labs in 2014 and works closely with Pivotal Inc., to help make the Cloud Found the best PaaS.
It is of utmost importance for the future success of WebRTC to ensure that interoperability is operational between web browsers and any WebRTC-compliant client. To be guaranteed as operational and effective, interoperability must be tested extensively by establishing WebRTC data and media connections between different web browsers running on different devices and operating systems. In his session at WebRTC Summit at @ThingsExpo, Dr. Alex Gouaillard, CEO and Founder of CoSMo Software, presented ...
@DevOpsSummit at Cloud Expo, taking place November 12-13 in New York City, NY, is co-located with 22nd international CloudEXPO | first international DXWorldEXPO and will feature technical sessions from a rock star conference faculty and the leading industry players in the world.
In a world where the internet rules all, where 94% of business buyers conduct online research, and where e-commerce sales are poised to fall between $427 billion and $443 billion by the end of this year, we think it's safe to say that your website is a vital part of your business strategy. Whether you're a B2B company, a local business, or an e-commerce site, digital presence is key to maintain in your drive towards success. Digital Performance will take priority in 2018 for the following reason...
I think DevOps is now a rambunctious teenager - it's starting to get a mind of its own, wanting to get its own things but it still needs some adult supervision," explained Thomas Hooker, VP of marketing at CollabNet, in this SYS-CON.tv interview at DevOps Summit at 20th Cloud Expo, held June 6-8, 2017, at the Javits Center in New York City, NY.
What's the role of an IT self-service portal when you get to continuous delivery and Infrastructure as Code? This general session showed how to create the continuous delivery culture and eight accelerators for leading the change. Don Demcsak is a DevOps and Cloud Native Modernization Principal for Dell EMC based out of New Jersey. He is a former, long time, Microsoft Most Valuable Professional, specializing in building and architecting Application Delivery Pipelines for hybrid legacy, and cloud ...
In this presentation, you will learn first hand what works and what doesn't while architecting and deploying OpenStack. Some of the topics will include:- best practices for creating repeatable deployments of OpenStack- multi-site considerations- how to customize OpenStack to integrate with your existing systems and security best practices.
The “Digital Era” is forcing us to engage with new methods to build, operate and maintain applications. This transformation also implies an evolution to more and more intelligent applications to better engage with the customers, while creating significant market differentiators. In both cases, the cloud has become a key enabler to embrace this digital revolution. So, moving to the cloud is no longer the question; the new questions are HOW and WHEN. To make this equation even more complex, most ...
CloudEXPO New York 2018, colocated with DXWorldEXPO New York 2018 will be held November 11-13, 2018, in New York City and will bring together Cloud Computing, FinTech and Blockchain, Digital Transformation, Big Data, Internet of Things, DevOps, AI, Machine Learning and WebRTC to one location.
DevOpsSummit New York 2018, colocated with CloudEXPO | DXWorldEXPO New York 2018 will be held November 11-13, 2018, in New York City. Digital Transformation (DX) is a major focus with the introduction of DXWorldEXPO within the program. Successful transformation requires a laser focus on being data-driven and on using all the tools available that enable transformation if they plan to survive over the long term. A total of 88% of Fortune 500 companies from a generation ago are now out of bus...