Welcome!

Microservices Journal Authors: Mike Kavis, Leo Reiter, Hovhannes Avoyan, Ruxit Blog, Pat Romanski

Related Topics: Cloud Expo, Java, Microservices Journal, Linux, Security, Big Data Journal

Cloud Expo: Article

Common Gotchas: Cloud Security Problems to Avoid

For organizations looking to adopt the cloud, securing sensitive information outside the corporate perimeter isn’t as daunting

Cloud computing security can be a conundrum. The point of using the public cloud is to outsource certain infrastructure and application needs to third party providers, after all. How can you secure your data once it leaves your perimeter and your control? As puzzling as it may seem, there is hope.

Luckily for organizations looking to adopt the cloud, securing sensitive information outside the corporate perimeter isn't as daunting (or as impossible) as it may appear. Technologies exist to enable cloud computing security strong enough for companies to remain in compliance while taking full advantage of the flexibility, agility, and economies of scale of the cloud. Avoid these common pitfalls for a secure cloud experience.

Pitfall 1: Assuming that responsibility for cloud computing security rests with your CSP
If your cloud service provider is the one housing your data, then doesn't responsibility (and legal liability) rest with them when it comes to cloud computing security?

It stands to reason but isn't true. While recent revisions to data privacy regulations like HIPAA do specify that third-party contractors bear some responsibility for data security - and while CSPs take security very seriously - that doesn't shift the burden from covered entities at all. In the event of a breach of your organization's data, your organization will still be held liable and still have to make a public breach disclosure. Look for ways to retain control over the privacy and integrity of your data no matter which CSP you choose.

Pitfall 2: Not encrypting enough
Your key vulnerability lies in the public Internet connections that data has to traverse between your perimeter and your CSPs, right?

Not quite, and therefore encryption in transit isn't enough. Encryption in transit is a cloud computing security standard, of course. It protects data from would-be eavesdroppers while that data's en route from your premises to the CSPs. Data should always be encrypted in transit.

But encryption in transit is only one part of the story. Last year, the NSA's MUSCULAR program made waves when the news came out that the agency had tapped directly into Google and Yahoo internal networks in order to intercept data as it moved between their data centers. Encryption in transit wouldn't be much help there. Choose a cloud data encryption solution that will protect your data every step of the way - in transit to the cloud, at rest in the cloud, and even while in motion or in use in the cloud.

Pitfall 3: Forgetting your neighbors
As one of many customers of a public cloud provider, you're analogous to a renter in an apartment complex. Multi-tenancy can raise cloud computing security issues. Fortunately, taking steps to secure your data addresses those issues. Choose a cloud data encryption solution that gives your organization exclusive access to the encryption keys. This way, even if your data is inadvertently leaked or disclosed, no one can read it or do anything with it without your knowledge and consent.

Cloud computing security concerns can make companies hesitant to adopt the cloud, but they don't need to be. There is a solution to the data privacy challenges created by the cloud, and that solution is control. Maintain control of your data from the moment it leaves your perimeter throughout its life cycle in the cloud and maintain control of your encryption keys, and your data can remain safe no matter where it roams.

More Stories By Paige Leidig

Paige Leidig is SVP at CipherCloud. He has 20 years of experience in technology, marketing, and selling enterprise application solutions and managing trusted customer relationships. As SVP of Marketing, he is responsible for all aspects of marketing at CipherCloud. Paige was previously in the Office of the CEO at SAP, where he was responsible for leading and coordinating SAP’s acquisition and integration activities on a global basis. He has managed a number of marketing initiatives at SAP, including responsibility for all go-to-market activities for SAP’s Cloud applications portfolio. Preceding his SAP career, Paige held senior management positions with Ariba, Elance, and E*Trade.

Comments (0)

Share your thoughts on this story.

Add your comment
You must be signed in to add a comment. Sign-in | Register

In accordance with our Comment Policy, we encourage comments that are on topic, relevant and to-the-point. We will remove comments that include profanity, personal attacks, racial slurs, threats of violence, or other inappropriate material that violates our Terms and Conditions, and will block users who make repeated violations. We ask all readers to expect diversity of opinion and to treat one another with dignity and respect.


@MicroservicesExpo Stories
It was just two years ago, in March of 2013, that the PaaS company dotCloud decided to open-source its container technology under the name "Docker." Docker quickly became a hit, with Docker Meetups spawning weekly worldwide and downloads occurring at record-breaking rates. The dotCloud team quickly changed direction, renamed the company "Docker," and brought in new CEO Ben Golub in July 2013 to lead the new business model. At the time, Docker was about a twenty-person company. Fast-forward to to...
What’s hot in today’s cloud computing world? Containers are fast becoming a viable alternative to virtualization for the right use cases. But to understand why containers can be a better option, we need to first understand their origins. In basic terms, containers are application-centric environments that help isolate and run workloads far more efficiently than the traditional hypervisor technology found in commodity cloud Infrastructure as a Service. Modern operating systems (Linux, Windows, e...
We’re living in exciting but demanding technological times. Big Data, Internet of Things, Apple Watch, ubiquitous computing, smart machines, robotics, and home automation . . . things that were the talk of science fiction only a few short years ago are on every CIOs wish list today. But to the point, the revolution in technology has led to major shifts in how organizations today ideate, plan, develop, and deploy software solutions. It used to be that software release cycles would take upwards of...
This is a no-hype, pragmatic post about why I think you should consider architecting your next project the way SOA and/or microservices suggest. No matter if it’s a greenfield approach or if you’re in dire need of refactoring. Please note: considering still keeps open the option of not taking that approach. After reading this, you will have a better idea about whether building multiple small components instead of a single, large component makes sense for your project. This post assumes that you...
SYS-CON Events announced today Isomorphic Software, the global leader in high-end, web-based business applications, will exhibit at SYS-CON's DevOps Summit 2015 New York, which will take place on June 9-11, 2015, at the Javits Center in New York City, NY. Isomorphic Software is the global leader in high-end, web-based business applications. We develop, market, and support the SmartClient & Smart GWT HTML5/Ajax platform, combining the productivity and performance of traditional desktop software ...
SYS-CON Events announced today the DevOps Foundation Certification Course, being held June ?, 2015, in conjunction with DevOps Summit and 16th Cloud Expo at the Javits Center in New York City, NY. This sixteen (16) hour course provides an introduction to DevOps – the cultural and professional movement that stresses communication, collaboration, integration and automation in order to improve the flow of work between software developers and IT operations professionals. Improved workflows will res...
This digest provides an overview of good resources that are well worth reading. We’ll be updating this page as new content becomes available, so I suggest you bookmark it. Also, expect more digests to come on different topics that make all of our IT-hearts go boom!
SYS-CON Events announced today that B2Cloud, a provider of enterprise resource planning software, will exhibit at SYS-CON's 16th International Cloud Expo®, which will take place on June 9-11, 2015, at the Javits Center in New York City, NY. B2cloud develops the software you need. They have the ideal tools to help you work with your clients. B2Cloud’s main solutions include AGIS – ERP, CLOHC, AGIS – Invoice, and IZUM
I woke up this morning to the devastating news about the earthquake in Nepal. Sitting here in California that destruction is literally on the other side of the world but my mind immediately went to thinking about my good friend Jeremy Geelan. See Jeremy and his family have been living in Kathmandu for a while now. His wife, in fact, is the Danish Ambassador to Nepal!
There is no doubt that Big Data is here and getting bigger every day. Building a Big Data infrastructure today is no easy task. There are an enormous number of choices for database engines and technologies. To make things even more challenging, requirements are getting more sophisticated, and the standard paradigm of supporting historical analytics queries is often just one facet of what is needed. As Big Data growth continues, organizations are demanding real-time access to data, allowing immed...
Containers and microservices have become topics of intense interest throughout the cloud developer and enterprise IT communities. Accordingly, attendees at the upcoming 16th Cloud Expo at the Javits Center in New York June 9-11 will find fresh new content in a new track called PaaS | Containers & Microservices Containers are not being considered for the first time by the cloud community, but a current era of re-consideration has pushed them to the top of the cloud agenda. With the launch ...
The world's leading Cloud event, Cloud Expo has launched Microservices Journal on the SYS-CON.com portal, featuring over 19,000 original articles, news stories, features, and blog entries. DevOps Journal is focused on this critical enterprise IT topic in the world of cloud computing. Microservices Journal offers top articles, news stories, and blog posts from the world's well-known experts and guarantees better exposure for its authors than any other publication. Follow new article posts on T...
SYS-CON Events announced today that MangoApps will exhibit at SYS-CON's 16th International Cloud Expo®, which will take place on June 9-11, 2015, at the Javits Center in New York City, NY., and the 17th International Cloud Expo®, which will take place on November 3–5, 2015, at the Santa Clara Convention Center in Santa Clara, CA. MangoApps provides private all-in-one social intranets allowing workers to securely collaborate from anywhere in the world and from any device. Social, mobile, and eas...
So I guess we’ve officially entered a new era of lean and mean. I say this with the announcement of Ubuntu Snappy Core, “designed for lightweight cloud container hosts running Docker and for smart devices,” according to Canonical. “Snappy Ubuntu Core is the smallest Ubuntu available, designed for security and efficiency in devices or on the cloud.” This first version of Snappy Ubuntu Core features secure app containment and Docker 1.6 (1.5 in main release), is available on public clouds, ...
There are 182 billion emails sent every day, generating a lot of data about how recipients and ISPs respond. Many marketers take a more-is-better approach to stats, preferring to have the ability to slice and dice their email lists based numerous arbitrary stats. However, fundamentally what really matters is whether or not sending an email to a particular recipient will generate value. Data Scientists can design high-level insights such as engagement prediction models and content clusters that a...
SYS-CON Events announced today the IoT Bootcamp – Jumpstart Your IoT Strategy, being held June 9–10, 2015, in conjunction with 16th Cloud Expo and Internet of @ThingsExpo at the Javits Center in New York City. This is your chance to jumpstart your IoT strategy. Combined with real-world scenarios and use cases, the IoT Bootcamp is not just based on presentations but includes hands-on demos and walkthroughs. We will introduce you to a variety of Do-It-Yourself IoT platforms including Arduino, Ras...
The cloud has transformed how we think about software quality. Instead of preventing failures, we must focus on automatic recovery from failure. In other words, resilience trumps traditional quality measures. Continuous delivery models further squeeze traditional notions of quality. Remember the venerable project management Iron Triangle? Among time, scope, and cost, you can only fix two or quality will suffer. Only in today's DevOps world, continuous testing, integration, and deployment upend...
Cloud computing seems destined to be the way enterprises will use information technology. The drastic cost reductions and impressive operational improvements make the transition an unstoppable trend. The “What is cloud computing?” question now, however, seems to be morphing into “Where is cloud computing going?” While software-as-a-service (SaaS) providers see their market rocketing upward as the easiest and quickest path for cloud adoption, infrastructure-as-a-service providers are suffering...
What exactly is a cognitive application? In her session at 16th Cloud Expo, Ashley Hathaway, Product Manager at IBM Watson, will look at the services being offered by the IBM Watson Developer Cloud and what that means for developers and Big Data. She'll explore how IBM Watson and its partnerships will continue to grow and help define what it means to be a cognitive service, as well as take a look at the offerings on Bluemix. She will also check out how Watson and the Alchemy API team up to off...
SYS-CON Events announced today that Site24x7, the cloud infrastructure monitoring service, will exhibit at SYS-CON's 16th International Cloud Expo®, which will take place on June 9-11, 2015, at the Javits Center in New York City, NY. Site24x7 is a cloud infrastructure monitoring service that helps monitor the uptime and performance of websites, online applications, servers, mobile websites and custom APIs. The monitoring is done from 50+ locations across the world and from various wireless carr...