Security News Curated from across the world
The ACS Enterprise Cloud can be integrated into the company’s ITIL-compliant ACS Management Platform to speed the deployment of standardized business applications from the cloud.
Xerox said the ACS Enterprise Cloud solution extends the ACS Management Platform (AMP v1.0) delivered through a partnership with Novell that utilizes its Intelligent Workload Management solutions.
http://itmanagement.earthweb.com/netsys/article.php/3883971/Xeroxs-ACS-Rolls-Out-Public-Private-Cloud-Service.htm
Rather than just creating a platform such as Microsoft Azure or Google App Engine, IBM is trying to create an ecosystem where each partner addresses a discrete business process, said Dewitt.
http://www.itbusinessedge.com/cm/blogs/vizard/ibms-rapidly-evolving-cloud-computing-strategy/?cs=41386
· The ability to create the illusion of infinite capacity performance is the same if scaled for one or one hundred or one thousand users with consistent service-level characteristics.
· Abstraction of the infrastructure so applications are not locked into devices or locations.
· Pay-as-you-go usage of the IT service; you only pay for what you use, with no or minimal up-front investment costs.
These technical characteristics can also be found in many non-disruptive technology solutions.
What sets the promise of cloud computing apart is that the rate of change, magnitude of cost reduction and specific technical performance impact that cloud computing can provide is not just incremental, but can give a five-to-ten times order of magnitude of improvement. The famous graphic used by Amazon Web Services illustrating the capacity versus utilization curve has become an icon in cloud computing. The model illustrates the central idea around cloud-based services enabled through an on-demand business provisioning model to meet actual usage. This model is important to businesses because one of the core precepts of cloud computing is to avoid the cost impact of over-provisioning and under-provisioning of computing resources. This benefit is in addition to the opportunity for cost, revenue, and margin advantages of business services enabled by rapid deployment of cloud services with low entry cost, as well as the potential to enter and exploit new markets.
The problem with using the view of capacity and utilization alone is that it is a technology provider/seller viewpoint essentially based on key performance indicators (KPIs) rather than business benefit metrics. What is needed instead is a set of business metrics that build on the cloud computing model.
Cloud computing creates additional cost transformation benefits by reducing delays in decision costs by adopting pre-built services and a faster rate of transition to new capabilities.
1. The speed and rate of change
2. Total cost of ownership optimization
3. Rapid provisioning
4. Increased margin and cost control
5. Dynamic usage
6. Risk and compliance improvement
7. Enhanced capacity utilization
8. Access to business skills and capability improvement
The work of The Open Group is developing tools and frameworks to enable businesses to evaluate these cloud computing opportunities to focus on how flexibility, competitive advantage, compliance risk and security in all aspects of the cost of cloud adoption can be better defined in a business language.
http://www.computerworld.com/s/article/9177387/8_Ways_to_Measure_Cloud_ROI
In fact, president and CMO of Apparent Networks Jim Melvin called the fact that cloud computing providers can’t or won’t take responsibility for network performance issues once information leaves their data center “one of the big stumbling blocks for the growth of cloud computing in general.”
With the increasing use of SaaS applications and accelerating cloud storage demands driven by users out on the “edge” of your network, the WAN pipe to the Headquarters is increasingly getting clogged.
In addition to edge caching (which will only be helpful for large bulk data transfers but not for live, dynamic, chatty traffic), what may be needed is a dynamic scaling up of edge servers to meet edge user demands in real time.
http://sandhill.com/opinion/daily_blog.php?id=71&post=650
Without a reward, “You are not providing any incentive for the managed security service provider to detect breaches,” says Asunur Cezar, the paper’s lead author and an instructor at the Middle East Technical University in Ankara, Turkey. “It may be penalized after some investigation, but that does not necessarily act as an incentive.”
The research also found that, when penalties are limited in some way, the second variant — using one MSSP for monitoring and another for detection — provides better security. The researchers pointed to court cases that limit penalties against service providers, concluding that such real-world limits mean having one provider essentially audit the other leads to the best performance.
The results of the study could be interesting academically, but they might not translate well to real-world MSSP contracts, says John Pescatore, vice president of analyst firm Gartner. In the real world, service firms are providing a specific function, not blanket protection, so it is usually difficult to penalize the companies for a breach. “The contract is to manage your firewalls or manage your firewalls, intrusion detection system, and antiviral — they are not saying, ‘Sign up with us, and we will protect you against all breaches,'” Pescatore says.
http://www.darkreading.com/securityservices/security/management/showArticle.jhtml?articleID=225200295&cid=RSSfeed
The rampant use of default passwords within live database environments continues to plague the security of enterprise data, researchers say. “It’s a problem that has been around for a long, long time,” says Alex Rothacker, manager of Team SHATTER, Application Security Inc.’s research arm. “A lot of default passwords out there get installed when you deploy a database, you install an add-on to it, or even if you install a third-party application that uses the database.” As he puts it, the problem of default passwords lingering in the wild has built up during the years as a result of cumulative errors by both vendors and database administrators.
In the past, the majority of vendors had no compunction about pushing out installers that automatically created default accounts to expedite the deployment of new databases, add-ons, or applications on top of the database.
Rothacker says the situation on the vendor front has improved considerably in recent years, but default passwords continue to be a problem for a number of reasons.
Organizations that choose to skip such a review could be leaving themselves at serious risk, says Rich Mogull of Securosis.
Team SHATTER last week launched a series of week-long database vulnerability-a-day awareness campaigns to draw attention to a wide range of database deployment deficiencies in the enterprise.
http://www.darkreading.com/database_security/security/app-security/showArticle.jhtml?articleID=225200102&cid=RSSfeed