Author: admini

Interest Growing in Private Cloud Computing

Posted on by admini

“Customers are quickly moving beyond the core hypervisor and focusing on mobility, self-provisioning, and metering and chargeback capabilities,” said Matt Eastwood, group vice president of Enterprise Platforms at IDC. Eastwood, along with a host of analysts, pundits and vendors, have a name for these next-generation virtualization deployments: the private cloud.

Settling on a precise definition of the term isn’t easy, since the term “cloud,” on its own, remains rather nebulous, but for the purposes of initiating a discussion, let’s say that the private cloud boils down to a set of scalable, dynamically provisioned, IT services which, unlike the public cloud, are hosted within an organization’s corporate data center.

All the elasticity and convenience of a public cloud service, with the same option to go hug your servers that IT admins have always had—or so the sales pitch goes.

CA Technologies swept up a bunch of startups and recently released CA 3Tera AppLogic 2.9, a turnkey platform that facilitates the rapid delivery of application-centric public and private clouds.

And CA is far from alone: A broad swath of vendors, from server manufacturers on up has some product targeted at building and/or maintaining the private cloud.

At this year’s VMworld, VMware announced a slew of products to enhance vSphere with private cloud functionality, such as support for pooling virtual infrastructure resources for delivery as catalog-based services, and for chargeback models to measure and assign costs of virtual machines.

Amazon EC2 or Salesforce.com weren’t built in a day, and companies that are in the business of providing utility compute services as their core business will always boast more resources, know-how and sheer scale than will be available to any single private enterprise.

With that said, there’s value in maintaining your own private IT resources that’s not easily obtained from the public cloud, particularly where security, compliance and legal discovery are concerned.

What’s more, a lack for public cloud-size scale doesn’t mean that organizations can’t derive real benefits from organizing your infrastructure into a more cloud-like form.

For enterprises already embracing x86 server consolidation to boost utilization and agility, combining multiple departmental virtual server farms into a single private cloud can, if executed well, lead to more efficient use of these resources.

“It isn’t necessarily that public cloud services are insecure by nature, but rather that they are not under a company’s direct control,” said Scott Crenshaw, vice president and general manager of the Cloud at Red Hat.

According to Eric Chiu, president and CEO of Hytrust, “the challenge becomes how to thrive in a multitenancy environment while preserving VM and data segregation as well as separation of duties.”

Assess the current regulatory environment and make sure that you can build a private cloud that is compliant today and hopefully in the future, or at least be updated when future changes occur.

Organizations must demonstrate compliance with regulatory requirements such as HIPAA (Health Insurance Portability and Accountability Act), Sarbanes-Oxley Act and PCI, even as these regulations change.

Managing virtual sprawl is one thing, but building a secure environment that preserves security controls over applications, data, personnel and the virtual machines is another.

“Many enterprises realize one day that they have terabytes or petabytes of files and they literally have no idea what is in them,” said to Steve Akers, CTO and founder of Digital Reef, a company that provides e-discovery and governance solutions.

Several current initiatives offer on-premise, cloud-like options for customers that entail the possibility of tapping a hybrid model in the future—you organize your internal stuff in a cloud-like way, you get more flexibility internally, and you get the option of hitting up public cloud resources to solve that elusive scale or capacity bursting bit of the equation when you need it and when you’re comfortable with it.

A DMTF (Desktop Management Task Force) initiative, OVF promises to facilitate portable VM packaging, among other things, but difficulties regarding portability of VM’s remain.

Read more

Most large companies hit by hack attacks, survey shows

Posted on by admini

Fourteen percent of those surveyed attributed their intrusion problem to “hacker/network attack,” 12% cited “lack of adequate security policies/measures,” 10% said “employee Web usage,” 9% pointed to “virus/malware/spyware,” 8% faulted other employee carelessness, negligence,” 6% said “unauthorized access by current/former employees,” 5% blamed “weak passwords,” 5% thought it was because of “lack of software updates,” and 5% simply said “software security flaw/bug.”

About half of respondents said their organizations have a formal security audit by an outside organization at least once a year, up from 35% in 2009. Forty-seven percent felt internal audits helped identify security problems, but 30% said the audit didn’t go far enough and 40% felt the audits should occur more frequently.

http://www.computerworld.com/s/article/9190559/Most_large_companies_hit_by_hack_attacks_survey_shows?source=CTWNLE_nlt_dailyam_2010-10-12

Read more

Six Tips For Application Security Monitoring Success

Posted on by admini

“PCI has driven a good ecosystem in the log management space, so the back-end technology is there,” says Gunnar Peterson, contributing analyst for Securosis and managing partner of Arctec Group.

The trick is figuring out the right technologies to act as the sensors feeding data into that SIEM system and developing a sound means of implementation. Peterson says technologies such as Web application firewalls and XML security gateways should play a more prominent role in application-layer activity that has thus far been difficult for many organizations to track. “Those can play a pretty important role because they are outside of the application so the security teams don’t have to necessarily get involved with the application build process as much,” he says. “But at the same time to support something that’s going to be useful you have to be down at the message data level.”

As for best practices, Peterson says it varies by industry — but he has some suggestions for any organization to get started.

You can’t count on port numbers to identify applications. As House points out, applications such as BitTorrent and Skype hide in HTTP traffic specifically to elude security controls. “A monitoring solution that just classifies traffic on port 80 as HTTP is potentially exposing the organization to infected content online, especially pirated software and media files with embedded malware,” he warns.

Peterson says organizations need to leverage standards, such as CEE, which is being pushed by Mitre, or XDAS, which the OpenGroup is supporting, to help the front-end monitoring solutions “talk” with the back-end log management systems and enable you to fine-tune the data that makes it into the hands of the incident response team. “To mitigate this threat, an application monitoring solution needs to be able to identify and control both the content and the applications that are part of social networking sites,” he says. “Developers and security architects should spend time with those incident response teams just as if they were your business user — because, in fact, they are your business user — and interview them,” he says.

http://www.darkreading.com/security_monitoring/security/management/showArticle.jhtml?articleID=227701138

Read more

Global Critical Infrastructure Increasingly Being Penetrated By Cyber Crooks

Posted on by admini

As per the report, among those who have been already targeted, companies usually reported sustaining around 10 attacks in the last five years.

Cris Paden, a Symantec Spokesman stated that the Stuxnet worm was an instance that politically provoked attacks, while unusual, was real and could be successful, as reported by SCMagazineUS on October 7, 2010.

http://www.spamfighter.com/News-15211-Global-Critical-Infrastructure-Increasingly-Being-Penetrated-By-Cyber-Crooks.htm

Read more

Intel, McAfee Merger Plugs Network Security Hole

Posted on by admini

These devices can be cell-phone switching systems, power grid controllers and HVAC systems, and they can also be network-equipped television sets, video disc players and DVRs. And we haven’t gotten to the mobile devices that people carry around, such as iPods, smartphones and GPS receivers. At first glance, it’s hard to see how these network-attached devices could threaten your enterprise, but on further inspection, networked devices are perhaps the single greatest area of risk in security today.

I was reminded of the nature of this threat when I was at Best Buy a couple of weeks ago shopping for a new television set. What I hadn’t expected was the flood of new consumer electronics that have reached the market lately boasting network connectivity. Every major vendor of televisions featured 802.11n wireless connectivity on some models, and some had wired Ethernet as well. There were network-aware Blu-ray players in all price ranges. None, as far as I could tell, included any sort of security.

The only reason I can think of that these devices haven’t been used as malware vectors is that the criminals who create malware haven’t gotten around to it. But there will come a time when some devices reach a critical mass, and—because of the unique vulnerability of these devices—start serving up attacks against your network or someone else’s.

In some ways the threat posed by mobile devices is even worse since they have a more direct connection to the Internet.

This is the future that Intel sees, and it’s why the company bought McAfee.

As nice as it might be to have a profitable business selling AV software, it will be a lot nicer for Intel to have the in-house expertise to create hardware-based security for as many of those network-equipped devices as it can supply network interfaces for. Because these devices are already connected, all Intel and McAfee need to do is create an ecosystem of device updating and reporting that not only keeps the protection current but also reports on emerging threats, much as McAfee’s current computer security products do.

http://www.eweek.com/c/a/Security/Intel-McAfee-Merger-Plugs-Network-Security-Hole-696433/?kc=rss&utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+RSS%2Feweeksecurity+%28eWEEK+Security%29

Read more

Virtualization Beyond Consolidation

Posted on by admini

The ability to easily generate virtual machines tends to lead to a willingness to do more, and soon the IT manager finds virtual machine sprawl on his hands. In some cases, overallocation shortchanges operations elsewhere. Then as the number of virtual machines per host server increases, I/O problems start to develop.

Meantime, third parties had already spotted the issue. Xsigo, with its I/O Director, and others seek to virtualize the I/O and move it out of the hypervisor’s virtual switch onto a hardware device, where packets are separated into their respective storage and network destinations, relieving the host server of work.

As we shall see, management tools are paramount once the virtual environment is generated.

When Moon Son, director of IT infrastructure at Orchard Supply Hardware, a California chain of 91 stores, became head of the company’s data center in 2006, he realized immediately he would have to rebuild from the ground up around virtualization. He virtualized 13 host servers, and in the end, tripled the number of production systems to meet expanded company goals.

http://www.informationweek.com/news/storage/virtualization/showArticle.jhtml?articleID=226800073

Read more