https://aws.amazon.com/blogs/aws/glacier-vault-lock/
For orgs that want to move AWS data (e.g., S3, EBS) to offline storage Glacier is the answer.
However, an org will want to set access controls and retention periods for the data "vaults" in Glacier.
Per the link above, one can do that via the API. Note that the output screenshots show JSON.
Wednesday, March 9, 2016
Understanding NoSQL
Many technology professionals who are not developers seem to have some difficulty in understanding the nuances of NoSQL. So, please see the article below:
http://www.isaca.org/Journal/archives/2012/Volume-3/Documents/12v3-A-Primer-on-Nonrelational.pdf
The bottom-line is that NoSQL is more flexible, but traditionally less secure out of the box.
Hopefully, homomorphic encryption (HE) will assist: http://www.zdnet.com/article/encryptions-holy-grail-is-getting-closer-one-way-or-another/.
http://www.isaca.org/Journal/archives/2012/Volume-3/Documents/12v3-A-Primer-on-Nonrelational.pdf
The bottom-line is that NoSQL is more flexible, but traditionally less secure out of the box.
Hopefully, homomorphic encryption (HE) will assist: http://www.zdnet.com/article/encryptions-holy-grail-is-getting-closer-one-way-or-another/.
Tuesday, March 8, 2016
AWS Inspector = AWS DAST Scanning
https://aws.amazon.com/inspector/
Nice work AWS! However, does this include the AWS WAF and / or AWS API Gateway?
Also, how does one integrate Inspector's findings in GRC & ticketing systems?
Will WhiteHat feel the heat from the competition? Chances are yes as they run on the high side, though many orgs have loads of apps for DAST scanning, on and off AWS.
Nice work AWS! However, does this include the AWS WAF and / or AWS API Gateway?
Also, how does one integrate Inspector's findings in GRC & ticketing systems?
Will WhiteHat feel the heat from the competition? Chances are yes as they run on the high side, though many orgs have loads of apps for DAST scanning, on and off AWS.
Monday, March 7, 2016
HIPAA & PCI Contact Center Compliance
HIPAA & PCI compliance transcends traditional IT security and privacy controls to include business processing.
HIPAA EDI, PCI, and / or contact center compliance is a different nut to crack with management needing to decide whether to tokenize, mask, or ecncrypt PHI or CHD recorded data.
Beyond the need to notify some or all of the parties that calls may be recorded, management must decided whether to take an all or focused (PHI, CHD) protection strategy. Deciding factors include size, scale, geographic location, and / or the budget for protecting sensitive information.
HIPAA EDI, PCI, and / or contact center compliance is a different nut to crack with management needing to decide whether to tokenize, mask, or ecncrypt PHI or CHD recorded data.
Beyond the need to notify some or all of the parties that calls may be recorded, management must decided whether to take an all or focused (PHI, CHD) protection strategy. Deciding factors include size, scale, geographic location, and / or the budget for protecting sensitive information.
Thursday, March 3, 2016
Cloud Security & Key Management
Does one leverage a cloud provider's implicit encryption keys, their own key management system (KMS) service, or use a third-party?
First, it makes sense for an org to rely on a cloud provider's implicit key management until they are of scale to have InfoSec FTEs.
Second, some cloud consumers use multiple cloud providers (AWS, Rackspace), while some use a cloud provider via multiple regions. So, as always it is about the requirements and budget.
With that said, here are some options:
First, it makes sense for an org to rely on a cloud provider's implicit key management until they are of scale to have InfoSec FTEs.
Second, some cloud consumers use multiple cloud providers (AWS, Rackspace), while some use a cloud provider via multiple regions. So, as always it is about the requirements and budget.
With that said, here are some options:
- AWS KMS
- Rackspace / OpenStack Cloud Keep
- Vormetric
- KeyNexus
- Intuit
- Microsoft
- Oracle
As usual, there is no silver bullet, though crypto is something that a org certainly needs to do correctly.
Wednesday, March 2, 2016
U.S. Federal Government Bug Bounty Program
http://www.wired.com/2016/03/pentagon-launches-feds-first-bug-bounty-hackers/
Will they eventually have issues similar to Facebook / Instagram?
http://www.forbes.com/sites/thomasbrewster/2015/12/17/facebook-instagram-security-research-threats/#dd31bd22d82a
Will they eventually have issues similar to Facebook / Instagram?
http://www.forbes.com/sites/thomasbrewster/2015/12/17/facebook-instagram-security-research-threats/#dd31bd22d82a
Tuesday, March 1, 2016
More prescriptive guidance on EU / US Privacy Shield
https://beta.commerce.gov/sites/commerce.gov/files/media/files/2016/eu_us_privacy_shield_full_text.pdf.pdf
Don't we need prescriptive guidance on security here? Maybe not on par with PCI DSS, but somewhere close.
Don't we need prescriptive guidance on security here? Maybe not on par with PCI DSS, but somewhere close.
Subscribe to:
Posts (Atom)