Posted by
Dave Asprey in
Cloud, Cloud-based Security, Cyber crime, DataCenter, Deep Security, hybrid-cloud, IaaS, private cloud, public cloud, SaaS, Secure Data Centers, Securing the Cloud, Security, Smart Protection Network, Threats from the Cloud
Jun 2nd, 2011 |
Comments Off
This is pretty cool. I gave a talk last week at the Glue Conference in Denver about how ambient clouds ( http://cloud.trendmicro.com/good-clouds-evil-clouds-why-microsoft-has… )work and even used Skype as an example of a massive-scale ambient cloud.
This case raises some very important new questions around ambient clouds. For instance, if you create an ambient cloud, one that you control using your own protocol, but where you have no control over when an endpoint may join it, what are the legal implications if someone else uses your protocol?
In an open source world, slapping a lawsuit on...
Posted by
Dave Asprey in
Cloud, Cloud-based Security, Cyber crime, IaaS, Malware, PaaS, SaaS, Secure Data Centers, Securing the Cloud, Security, Smart Protection Network, Threats, Threats from the Cloud
Feb 6th, 2011 |
6 Comments
In a recent eWeek interview, Citrix CTO Simon Crosby described Conficker malware as “the world’s largest cloud.” He’s right. Cybercriminals use Conficker to create massive clouds of remotely-controlled PCs capable of carrying out a variety of cyber-attacks, including DDoS (Distributed Denial of Service) attacks on a scale larger than any centralized cloud provider could. We tend to think about data center-based clouds with names like Infrastructure-as-a-Service or Software-as-a-Service, but the future of really big clouds looks more like Conficker’s very powerful networks of distributed...
Posted by
Justin Foster in
Cloud-based Security, Cyber crime, Privacy, Compliance and Identity, Secure Data Centers, Securing the Cloud, Threats from the Cloud, Virtualization
Dec 13th, 2010 |
Comments Off
Cloud Security Alliance Congress 2010 Summary – Part 4 of 4
The Cloud Security Alliance kicked off its first major event November 16-17, 2010 in Orlando, Florida. The CSA Congress 2010 successfully hosted 370 people with talks covering all aspects of cloud security over two days.
For those who were not in attendance at Congress, this four-part series summarizes some of the most popular sessions at the event. This is the final part of a four-part series summarizing popular sessions at the Cloud Security Alliance Congress.
Top Threats and Risks to Cloud Computing
Michael Sutton from Zscaler...
Posted by
admin in
Securing the Cloud
Jun 13th, 2010 |
1 Comment
As I read different blogs, IT industry analysts and media, I see contradictions galore. Some articles position cloud computing as more secure (like this one) while other journalists highlight new security challenges (here, here, here and here). The concept of the cloud is still emerging and fallacies around cloud computing abound. Below are the five myths that I encounter most frequently while listening to conversations about cloud computing:
1) Virtual private clouds provided by Infrastructure-as-a-Service (IaaS) players are as secure as internal datacenters
“Virtual private clouds”...
Posted by
Rik Ferguson in
Threats from the Cloud
Dec 14th, 2009 |
Comments Off
2009 has been a notable year for malware and malicious online activity for a number of reasons and several of them relate to what is known as botnets. A zombie, or a bot, is a PC infected by malware that brings it under the remote control of a criminal. Criminals run networks that can range from thousands to millions of infected machines and they use them to power most of the cybercrime we see today including spam, DDoS, scareware, phishing, and malicious or illegal website hosting. They have a finger in every cybercriminal pie.
In the first half of the year, the Conficker worm (also known as Downadup...
Posted by
Jon Oliver in
Securing the Cloud
Nov 2nd, 2009 |
1 Comment
Recently, there have been some high profile failures of cloud computing, including the Sidekick outage, the DDos attack on Amazon’s EC2 and disruption to Google’s hosted email. Following these debacles, some people have expressed scepticism about the cloud computing model. For example, a response to a CNET article was: “Putting all your beans in a single point of failure for users (in an enterprise or corporation) is suicide.”
Here I will consider a range of activities as “Cloud Computing” including SaaS, PaaS and IaaS. All three raise some concerns for companies. Companies that...
Posted by
admin in
Securing the Cloud
Oct 26th, 2009 |
2 Comments
Trend Micro has been talking to many data center security folks and Infrastructure-as-a-Service (IaaS) providers to understand the dynamics of cloud security. Something that strikes me is their frequent (mis)perception that the Infrastructure-as-a-Service provider will take care of security in the public cloud.
IaaS providers are doing a decent job of baseline security (physical security, perimeter firewall, load balancing, perhaps a network IDS/IPS, etc) and have to provide a basic ante to the game. While the occasional IaaS vendor strives to differentiate themselves with higher degrees of...
Posted by
admin in
Cloud-based Security, Threats from the Cloud
Oct 9th, 2009 |
Comments Off
Amazon EC2 customers recently suffered from a concerted Distributed Denial of Service (DDoS) attack that caused some consternation for the web-based code hosting service Bitbucket (news courtesy of my favorite IT tabloid, The Register). An unfortunate fact of life about the massive DDoS such as Bitbucket appears to have suffered is that there is no defense once the incoming network pipes are full other than shutting off the DDoS.
Trend Micro has to wrestle with DDoS attacks as part of our antivirus business as well as our hosted security business (shameless sales plug: check out InterScan Hosted...
Posted by
Dave Rand in
Securing the Cloud, Virtualization
Sep 22nd, 2009 |
Comments Off
Hypervisors bring new capabilities to us, but they also bring new computing risks. Understanding this new environment is important. As virtualization becomes mainstream, we need to find ways to identify risks and protect these new infrastructures. Hypervisors, while central to all virtualization methods, are a core risk area.
Hypervisors are a “meta” operating system in a virtualized environment. They have access to all physical devices in a server, including all disk and memory. Hypervisors both schedule access to these devices, and help to protect clients from each other. A server...
