John Mayer At Dell World 2015!! (Oh, I'll be there too.)

 

 ( This content is being syndicated through multiple channels. The opinions expressed are solely those of the author and do not represent the views of GovCloud Network, GovCloud Network Partners or any other corporation or organization.)




( Thank you. If you enjoyed this article, get free updates by email or RSS - © Copyright Kevin L. Jackson 2015)

Data-centric Security: The New Must Have

( Thank you. If you enjoyed this article, get free updates by email or RSS - © Copyright Kevin L. Jackson 2015)

Personal email:Pathway to Cybersecurity Breaches

As a business communications tool, email is the dominant option, and many corporations have policies that allow the use of personal email on corporate computers. In a recent Adobe Systems commissioned online survey of 400 U.S. white-collar, adult workers, more than 90 percent of them admitted checking personal emails at work. The workers questioned in the poll estimated they spend 6.3 hours a day checking emails, with 3.2 hours devoted to work emails and 3.1 hours to personal messages. Nearly half of the respondents also said that their use of emails for work will increase in coming years with 19 percent saying it will go up substantially.

Employers generally have the discretion to monitor and restrict employees’ personal computer usage as they see fit and, in most cases, email messages are not subject to any personal privacy laws. But even with these stipulations, Dell SonicWall channel partner Michael Crean, President and CEO of Solutions Granted, says that allowing personal email on corporate PCs is just not worth the risk. Solutions Granted, a small veteran-owned business, is certified as a SonicWALL Managed Security Service Provider. According to Crean, the threat of malicious attacks and subsequent remediation cost far outweighs any gain from allowing personal email access. “If your employees need to check their email in the car, they use their personal phone. So why can’t they do the same at work?”

Email phishing, the attempt to acquire sensitive information for malicious reasons by masquerading as a trustworthy entity, is a significant cybersecurity threat.

“In one incident investigated by Dell SecureWorks, attackers phished an employee at a manufacturing company to obtain the login credentials for the company’s Citrix platform. The attackers were able to use the credentials to connect to internal corporate resources, then move laterally through the network and harvest intellectual property using the company’s Altris platform, which remotely distributes new software and patches to all the endpoints.”

The most sophisticated attacks are grouped in two categories:

• Indirect Phishing Attacks –attackers direct a series of emails, usually in combination with organizational information from other sources such as LinkedIn, that add up to a successful phishing campaign. An example would be an employee being tricked into giving away Yahoo credentials as part of an attack, which can give access to contact or calendar information. Another example would be an employee with a cloud-based company email (i.e. Office 365 or Gmail for Business accounts) could be successfully phished. This could give the attacker a platform for sending malicious emails that appear safe.

• Direct Phishing Attacks – Cybercriminals seek login credentials for actual business systems. During Q2 2015 security analysts found multiple examples of phishing attempts on Outlook credentials. Aside from email access, these credentials are frequently used for domain logins, providing an attacker with access to other cloud-based services, such as Dropbox or Salesforce. This sort of breech could also provide an attacker with direct access to corporate proprietary information.

Phishing is often described as spam and, according to Secure List, generally followed the same template:

• Very little text (the email generally contains a typical header consisting of several words which is exactly repeated in the body of the message)
• One or more links which load a brightly decorated picture (sometimes in parts) with all the necessary advertising data (a more detailed advertising text plus contacts: website address, phone number, company name)
• Another long link that leads to a resource that corresponds to the content of the email
• Additional ‘white noise’ text to bulk out the email

The white noise text consists of random phrases or single words in any language which may not be the same as the language of the mass mailing. This text is generally invisible to the reader of as it is written in white or pale color on a standard white background.  Email is also often used to distribute malicious attachments in Microsoft Word or Excel.

Phishing is an equal opportunity threat with “Global Internet Portals”, which include email and search portals taking the brunt of the attacks. As a trusted advisor to their customers, Solutions Granted recommends the following:

• Severely restrict or eliminate employee access to personal email via company-owned assets;
• Don’t let preferences of your human resources team overrule the need for IT security; and
• Use industry proven cybersecurity technologies and best practices.

This post was written as part of the Dell Insight Partners program, which provides news and analysis about the evolving world of tech. Dell sponsored this article, but the opinions are my own and don’t necessarily represent Dell’s positions or strategies.





( Thank you. If you enjoyed this article, get free updates by email or RSS - © Copyright Kevin L. Jackson 2015)

IEEE Cloud Computing: Legal Clouds

This special issue looks at how to balance
privacy with legitimate surveillance and lawful data access. Some of the specific areas covered are:

•     Balancing Privacy and Surveillance in the Cloud;
•     Data Flow Management and Compliance in Cloud Computing;
•     Anonymous Credential-Based Access Control Scheme for Clouds; and
•     End-to-End Privacy for Open Big Data Markets.

This issue also features articles on cloud forensics and the strategic value of cloud.

I am also very proud to present my debut article for IEEE; "IEEE GovCloud: Making a Difference for Global Governments":

On February 8, 2011, then United States CIO Vivek Kundra released the US Federal Cloud Computing Strategy[1]. In the executive summary he laid out the inefficient state of affairs that was the US Federal Government’s IT environment:
 
The Federal Government’s current Information Technology (IT) environment is characterized by low asset utilization, a fragmented demand for resources, duplicative systems, environments which are difficult to manage, and long procurement lead times. These inefficiencies negatively impact the Federal Government’s ability to serve the American public.

Cloud computing has the potential to play a major part in addressing these inefficiencies and improving government service delivery. The cloud computing model can significantly help agencies grappling with the need to provide highly reliable, innovative services quickly despite resource constraints.”

These words heralded the start of the US Federal Government’s Cloud First policy. It also turned out to be the start of a global trend towards the adoption of cloud computing services by governments around the world...."





This content is being syndicated through multiple channels. The opinions expressed are solely those of the author and do not represent the views of GovCloud Network, GovCloud Network Partners or any other corporation or organization.



( Thank you. If you enjoyed this article, get free updates by email or RSS - © Copyright Kevin L. Jackson 2015)

Cloud hosting: Look beyond cost savings and weigh pros, cons

Is your company struggling with the idea of using “cloud hosting” in order to save money?
Truth be known, using cost savings as the primary reason for moving to cloud will almost guarantee failure. Some reasons that typically lead to cloud computing costing more include:

• Building and migrating to a private cloud, which will almost always cost more than staying in a traditional data center;
• Migrating legacy applications that weren’t designed to operate in a virtualized environment or are tied to very specific environments run on older operating systems or require out-of-date drivers;
• Special or very unique auditing requirements;
• Failure to modify or update enterprise IT policies to reflect the new IT consumption model; and
• Failure to modify operational practices in a way that takes advantage of the “pay-as-you-go” economic model.

With that said, however, over 82 percent of companies have saved money just by implementing cloud computing, 14 percent were able to shrink the size of their IT department and 80 percent reported extreme productivity improvements.[1] That means that moving to the cloud can actually make money!
An organization’s decision to move to the cloud is, above all else, a cultural change that could affect much more than the IT department.
First, using either cloud computing or traditional data center hosting comes with a decision to outsource all or a portion of your organization’s IT infrastructure. This should drive your initial decision of whether to consider cloud computing as a viable option. Although characterizing these observations as advantages or disadvantages depends on the enterprise’s specific situation, environment and requirements. Generally accepted views are reflected in Table 1.

Second, I’d like to point out that the term “cloud hosting” is very misleading. Even though it is broadly used in the marketplace to represent a fusion of cloud computing and data center hosting, the two business models are complete opposite.

• In data center hosting, the customer dictates the hardware, software, security, and operational processes that will be used by the provider. The provider will customize the offering to meet those dictates. The customer bears the capital expense of doing this through a long-term financial agreement with the provider.
• In cloud computing, the cloud service provider dictates the hardware, software, security, and operational processes that can be used by the customer. The provider typically will not customize their offerings to meet customer dictates. Because the capital expense of building the cloud offering is borne completely by the provider, it recoups the cost through a pay-per-use operational charging model.

This background is essential to putting the advantages and disadvantages of both into perspective because they are driven by their respective embedded business models. See Table 2.




The choices between outsourcing vs. insourcing or cloud computing vs. data center hosting are not a science, nor are they absolute. An organization of any significant size will most likely pursue an “all the above” strategy with constant corrections driven by cultural and business environments. As soon as you’ve made a decision you’ll probably start the process all over again.
So, my final piece of advice is to plan for and expect constant change because the most successful organizations have change management as a core competency.

For more views regarding this important decision, you should check out the following:

• Outsourcing Vs. Insourcing: You Need Both
  
• Cloud, Colocation and the Transforming Data Center: What You Need To Know
• Colo in the age of cloud
• The Total Cost of Ownership: In-House vs. Cloud-Based Development Environments

 This post was written as part of the Dell Insight Partners program, which provides news and analysis about the evolving world of tech. For more on these topics, visit Dell's thought leadership site Power More. Dell sponsored this article, but the opinions are my own and don't necessarily represent Dell's positions or strategies.






( Thank you. If you enjoyed this article, get free updates by email or RSS - © Copyright Kevin L. Jackson 2015)