Securing Big Data in the Cloud: Towards a More Focused and Data Driven Approach. Ragib Hasan, UAB Anthony Skjellum, Auburn 2014 NSF Big Data Workshop

Size: px
Start display at page:

Download "Securing Big Data in the Cloud: Towards a More Focused and Data Driven Approach. Ragib Hasan, UAB Anthony Skjellum, Auburn 2014 NSF Big Data Workshop"

Transcription

1 Securing Big Data in the Cloud: Towards a More Focused and Data Driven Approach Ragib Hasan, UAB Anthony Skjellum, Auburn 2014 NSF Big Data Workshop

2 [Cloud Computing] is a security nightmare and it can't be handled in traditional ways. John Chambers CISCO CEO 2

3 The Age of Big Data and Clouds The global market for clouds is growing 30% Compound Annual Growth Rate (CAGR) reaching $270 billion in 2020 (Market Research Media) Growth happening both in private and government sectors (US Federal government s spending on the cloud is approx. $792 million in 2013 (INPUT) Big Data is also becoming ubiquitous, going mainstream from academic and research usage A 4300% growth predicted by Clouds are the most suitable platform to make any sense of big data

4 So, if cloud computing is so effective in dealing with Big Data, why isn t everyone doing it? Clouds are still subject to traditional data confidentiality, integrity, availability, and privacy issues, plus some additional attacks 4

5 Why are Big Data and cloud security different from traditional security? Multi-tenancy Same hardware/network shared by many users Trust asymmetry Users have to completely trust the cloud provider for everything Lack of accountability There is a lack of accountability in part of the cloud service provider Securing a house Owner and user are often the same entity Securing a motel Owner and users are almost invariably distinct entities 5

6 Many major challenges remain in securing clouds and Big Data Novel attacks Trustworthy cloud architectures Data integrity and availability Computation integrity Data and computation privacy Data forensics Misbehavior detection Malicious use of clouds 6

7 Co-tenancy in clouds creates new attack vectors A cloud is shared by multiple users Malicious users can now legally be in the same infrastructure Misusing co-tenancy, attackers can launch side channel attacks on victims Research question: How to prevent attackers from exploiting co-tenancy in attacking the infrastructure and/or other clients?

8 Today s cloud architectures act like big black boxes Clients have no idea of or control over what is happening inside the cloud Clients are forced to trust cloud providers completely Research Question: How do we design cloud computing architectures that are semi-transparent and provide clients with control over security? 8

9 Today s clouds provide no guarantee about outsourced data Problem: Dishonest cloud providers can throw data away or lose data. Malicious intruders can delete or tamper with data. Clients need reassurance that the outsourced data is available, has not been tampered with, and remains confidential. Amazon s Terms of services Research Question: How can clients get assurance/proofs that the cloud provider is actually storing data, is not tampering with data, and can make the data available ondemand? 9

10 Ensuring confidentiality of data in outsourced computation is difficult Most type of computations require decrypting data before any computations If the cloud provider is not trusted, this may result in breach of confidentiality Research Question: How can we ensure confidentiality of data and computations in a cloud? 10

11 Clients have no way of verifying computations outsourced to a Cloud Scenario User sends her data processing job to the cloud. Clouds provide dataflow operation as a service (e.g., MapReduce, Hadoop etc.) Problem: Users have no way of evaluating the correctness of results Research question: How can we verify the accuracy of outsourced computation? 11

12 Data Forensics in Clouds is difficult Certain Government regulations mandate the ability to audit and run forensic analysis on critical business or healthcare data Clouds complicate forensic analysis, since the same storage infrastructure is shared by many clients Cloud providers are not willing to open up their entire storage for forensic investigations. Research question: How can we augment cloud infrastructures to allow forensic investigations? 12

13 (Largely) Unexplored Areas Legal/policy issues and regulatory compliance: Cloud based storage is still subject to regulatory compliance and legal orders. Implementing things such as litigation hold in a cloud is very difficult. Proving a cloud is fully compliant with pre-cloud law is challenging Research question: How does cloud computing fit in with data security laws and regulations such as SOX, HIPAA, or with Litigation holds? 13

14 Making Big Data and Clouds Secure focus on the data! Our solution: Take a data driven approach Focus on data, it s location, generation, and transmission the provenance of data Look at the lifecycle of data and Ensure trustworthy computation and attribution Make Provenance a fundamental part of clouds

15 Why aren t today s clouds accountable? Users do not know What happened to their data inside the cloud? What applications generated their data? How did the state of the cloud change? Cloud providers act like black boxes Clouds do not provide any information about internal operation to users Since they are in full control, any evidence/forensic investigation must go through them, making that less transparent 15

16 Cloud Provenance is Key to Solving Cloud Security Data provenance: The modification and movement history of data objects as they enter/leave the cloud and are modified Application provenance: The history and activities of applications and users State provenance: The state history of the cloud computing system itself 16

17 Challenges in Cloud Provenance Provenance collection: How do we efficiently collect it? Provenance storage: Where do we store it? What structures do we use? Securing provenance: How do we prevent attacks and forgery? Access to provenance: How can we give access to provenance while preserving cloud s/other users privacy? 17

18 How to provide accountability to users using Provenance-based Proofs? Proof of past data possession Proof of data possession Proof of data deletion Proof of capability Proof of work/task completion and Correctness 18

19 Current Results PPDP: Proof of past data possession (Zawoad and Hasan, CyberSec 2012, journal 2012) PPDP attests that a User U possessed a File F at a given past time. An Auditor can use PPDP to check the Past Data Possession. File can be deleted but PPDP can still preserve the proof of data possession. 19

20 Current Results SecLaaS: Secure Log Access as a Service (Zawoad and Hasan, ASIACCS 2013) Ext VM VM VM NC Attacker Attack Communication Log DB Proof DB API Web Server Investigator 20

21 Ongoing projects Provenance Aware Cloud (PAC) We are building a provenance-capable cloud using the openstack platform A small scale testbed has been developed for cloud security research. 21

22 John Chambers CISCO CEO [Cloud Computing] is a security nightmare and it can't be handled in traditional ways can be handled using Trustworthy provenance Details? Visit or 22

CS573 Data privacy and security in the cloud. Slide credits: Ragib Hasan, Johns Hopkins University

CS573 Data privacy and security in the cloud. Slide credits: Ragib Hasan, Johns Hopkins University CS573 Data privacy and security in the cloud Slide credits: Ragib Hasan, Johns Hopkins University What is Cloud Computing? Let s hear from the experts 2 What is Cloud Computing? The infinite wisdom of

More information

Security and Privacy in Cloud Computing

Security and Privacy in Cloud Computing Security and Privacy in Cloud Computing Ragib Hasan Johns Hopkins University en.600.412 Spring 2010 Lecture 1 01/25/2010 Welcome to the class Administrative details When? : Monday 3pm-3.50pm Where?: Shaffer

More information

Cloud Security Who do you trust?

Cloud Security Who do you trust? Thought Leadership White Paper Cloud Computing Cloud Security Who do you trust? Nick Coleman, IBM Cloud Security Leader Martin Borrett, IBM Lead Security Architect 2 Cloud Security Who do you trust? Cloud

More information

Business Cloud Systems Challenges and Uncertainty

Business Cloud Systems Challenges and Uncertainty 1 Business Cloud Systems Challenges and Uncertainty Dr. Adnan Agbaria SAP Labs 1 Computing Evolution Time 1970 1980 1990 2000 2010 Serial computing 2020 Cluster computing Grid computing Cloud computing?

More information

Lecture 10 Cloud Security. modified from slides of Lawrie Brown, Ragib Hasan, YounSun Cho, Anya Kim

Lecture 10 Cloud Security. modified from slides of Lawrie Brown, Ragib Hasan, YounSun Cho, Anya Kim Lecture 10 Cloud Security modified from slides of Lawrie Brown, Ragib Hasan, YounSun Cho, Anya Kim Cloud Computing NIST defines cloud computing as follows: A model for enabling ubiquitous, convenient,

More information

Cloud Computing Trends, Examples & What s Ahead

Cloud Computing Trends, Examples & What s Ahead Cloud Computing Trends, Examples & What s Ahead Mike Klein President, Online Tech June 21, 2010 Cloud Computing Defined One Definition: On-Demand Computing Elastic & Scalable Rapidly Provisioned Virtualized

More information

Requirements of Secure Storage Systems for Healthcare Records

Requirements of Secure Storage Systems for Healthcare Records Requirements of Secure Storage Systems for Healthcare Records Ragib Hasan 1, Marianne Winslett 1, and Radu Sion 2 1 University of Illinois at Urbana-Champaign Urbana, IL 61801, USA (rhasan, winslett)@cs.uiuc.edu

More information

HIPAA: MANAGING ACCESS TO SYSTEMS STORING ephi WITH SECRET SERVER

HIPAA: MANAGING ACCESS TO SYSTEMS STORING ephi WITH SECRET SERVER HIPAA: MANAGING ACCESS TO SYSTEMS STORING ephi WITH SECRET SERVER With technology everywhere we look, the technical safeguards required by HIPAA are extremely important in ensuring that our information

More information

WHITEPAPER. Data Security for Office 365 Balancing control & usability

WHITEPAPER. Data Security for Office 365 Balancing control & usability WHITEPAPER Data Security for Office 365 Balancing control & usability Contents Executive Summary... 2 Top Security Issues for Office 365... 4 Compelled Disclosures... 4 Unauthorized Sharing... 4 External

More information

PROTECTING DATA IN MULTI-TENANT CLOUDS

PROTECTING DATA IN MULTI-TENANT CLOUDS 1 Introduction Today's business environment requires organizations of all types to reduce costs and create flexible business processes to compete effectively in an ever-changing marketplace. The pace of

More information

Secure cloud access system using JAR ABSTRACT:

Secure cloud access system using JAR ABSTRACT: Secure cloud access system using JAR ABSTRACT: Cloud computing enables highly scalable services to be easily consumed over the Internet on an as-needed basis. A major feature of the cloud services is that

More information

Cloud Security Who do you trust?

Cloud Security Who do you trust? Thought Leadership White Paper Cloud Computing Cloud Security Who do you trust? Nick Coleman, IBM Cloud Security Leader Martin Borrett, IBM Lead Security Architect 2 Cloud Security Who do you trust? Cloud

More information

Cloud Forensic Investigation using Digital Provenance Scheme

Cloud Forensic Investigation using Digital Provenance Scheme Cloud Forensic Investigation using Digital Provenance Scheme Nay Aung Aung, and Myat Myat Min Abstract In recent year, Cloud computing has become popular as a cost-effective and efficient computing paradigm.

More information

The problem of cloud data governance

The problem of cloud data governance The problem of cloud data governance Vasilis Tountopoulos, Athens Technology Center S.A. (ATC) CSP EU Forum 2014 - Thursday, 22 nd May, 2014 Focus on data protection in the cloud Why data governance in

More information

Everything You Always Wanted to Know About Log Management But Were Afraid to Ask. August 21, 2013

Everything You Always Wanted to Know About Log Management But Were Afraid to Ask. August 21, 2013 Everything You Always Wanted to Know About Log Management But Were Afraid to Ask August 21, 2013 Logging and Log Management Logging and Log Management The authoritative Guide to Understanding the Concepts

More information

Sarbanes-Oxley Act. Solution Brief. Sarbanes-Oxley Act. Publication Date: March 17, 2015. EventTracker 8815 Centre Park Drive, Columbia MD 21045

Sarbanes-Oxley Act. Solution Brief. Sarbanes-Oxley Act. Publication Date: March 17, 2015. EventTracker 8815 Centre Park Drive, Columbia MD 21045 Publication Date: March 17, 2015 Solution Brief EventTracker 8815 Centre Park Drive, Columbia MD 21045 About EventTracker EventTracker delivers business critical software and services that transform high-volume

More information

MANAGED FILE TRANSFER: 10 STEPS TO SOX COMPLIANCE

MANAGED FILE TRANSFER: 10 STEPS TO SOX COMPLIANCE WHITE PAPER MANAGED FILE TRANSFER: 10 STEPS TO SOX COMPLIANCE 1. OVERVIEW Do you want to design a file transfer process that is secure? Or one that is compliant? Of course, the answer is both. But it s

More information

SOC on Amazon Web Services (AWS) What You Need To Know Understanding the regulatory roadmap for SOC on AWS

SOC on Amazon Web Services (AWS) What You Need To Know Understanding the regulatory roadmap for SOC on AWS SOC on Amazon Web Services (AWS) What You Need To Know Understanding the regulatory roadmap for SOC on AWS Jeff Cook November 2015 Summary Service Organization Control (SOC) reports (formerly SAS 70 or

More information

VMware vcloud Architecture Toolkit Public VMware vcloud Service Definition

VMware vcloud Architecture Toolkit Public VMware vcloud Service Definition VMware vcloud Architecture Toolkit Version 2.0.1 October 2011 This product is protected by U.S. and international copyright and intellectual property laws. This product is covered by one or more patents

More information

SMS. Cloud Computing. Systems Management Specialists. Grupo SMS www.grupo-sms.com 949.223.9240 option 3 for sales

SMS. Cloud Computing. Systems Management Specialists. Grupo SMS www.grupo-sms.com 949.223.9240 option 3 for sales SMS Systems Management Specialists Cloud Computing Grupo SMS www.grupo-sms.com 949.223.9240 option 3 for sales Cloud Computing The SMS Model: Cloud computing is a model for enabling ubiquitous, convenient,

More information

Data Protection: From PKI to Virtualization & Cloud

Data Protection: From PKI to Virtualization & Cloud Data Protection: From PKI to Virtualization & Cloud Raymond Yeung CISSP, CISA Senior Regional Director, HK/TW, ASEAN & A/NZ SafeNet Inc. Agenda What is PKI? And Value? Traditional PKI Usage Cloud Security

More information

Security within a development lifecycle. Enhancing product security through development process improvement

Security within a development lifecycle. Enhancing product security through development process improvement Security within a development lifecycle Enhancing product security through development process improvement Who I am Working within a QA environment, with a focus on security for 10 years Primarily web

More information

Understanding Enterprise Cloud Governance

Understanding Enterprise Cloud Governance Understanding Enterprise Cloud Governance Maintaining control while delivering the agility of cloud computing Most large enterprises have a hybrid or multi-cloud environment comprised of a combination

More information

ISO 27001 COMPLIANCE WITH OBSERVEIT

ISO 27001 COMPLIANCE WITH OBSERVEIT ISO 27001 COMPLIANCE WITH OBSERVEIT OVERVIEW ISO/IEC 27001 is a framework of policies and procedures that include all legal, physical and technical controls involved in an organization s information risk

More information

Cyber Security and Cloud Computing. Dr Daniel Prince Course Director MSc in Cyber Security d.prince@lancaster.ac.uk

Cyber Security and Cloud Computing. Dr Daniel Prince Course Director MSc in Cyber Security d.prince@lancaster.ac.uk Cyber Security and Cloud Computing Dr Daniel Prince Course Director MSc in Cyber Security d.prince@lancaster.ac.uk Scope of Today SME Attractors for Cloud Switching to the Cloud Public Private Hybrid Big

More information

Control your corner of the cloud.

Control your corner of the cloud. Chapter 1 of 5 Control your corner of the cloud. From the halls of government to the high-rise towers of the corporate world, forward-looking organizations are recognizing the potential of cloud computing

More information

Cloud Computing An Auditor s Perspective

Cloud Computing An Auditor s Perspective Cloud Computing An Auditor s Perspective Sailesh Gadia, CPA, CISA, CIPP sgadia@kpmg.com December 9, 2010 Discussion Agenda Introduction to cloud computing Types of cloud services Benefits, challenges,

More information

POWER PROTECT PROMOTE. Information Governance In The Cloud

POWER PROTECT PROMOTE. Information Governance In The Cloud Information Governance In The Cloud Galina Datskovsky, Ph. D., CRM President of ARMA International SVP Information Governance Solutions Topics Cloud Characteristics And Risks Information Management In

More information

ViPNet EDI. drive your collaboration secure

ViPNet EDI. drive your collaboration secure ViPNet EDI drive your collaboration secure What is ViPNet EDI? Electronic data interchange (EDI) systems are used for standardized electronic data exchange. They include exchange standards, electronic

More information

FECloud: A Trustworthy Forensics-Enabled Cloud Architecture

FECloud: A Trustworthy Forensics-Enabled Cloud Architecture FECloud: A Trustworthy Forensics-Enabled Cloud Architecture Shams Zawoad and Ragib Hasan {zawoad, ragib}@cis.uab.edu University of Alabama at Birmingham Birmingham, Alabama 35294-1170, USA Abstract The

More information

Consor;um (partners) ARES conference Toulouse, 24 August 2015

Consor;um (partners) ARES conference Toulouse, 24 August 2015 1 2 3 Consor;um (partners) 4 The honest- but- curious CSP model (cloud service provider)? 5 an attack tolerant framework Ambi;on in the context of honest-but-curious CSPs preserving the benefits associated

More information

VMware vcloud Service Definition for a Public Cloud. Version 1.6

VMware vcloud Service Definition for a Public Cloud. Version 1.6 Service Definition for a Public Cloud Version 1.6 Technical WHITE PAPER 2011 VMware, Inc. All rights reserved. This product is protected by U.S. and international copyright and intellectual property laws.

More information

Who Am I? Mark Cusack Chief Architect 9 years@rainstor Founding developer Ex UK Ministry of Defence Research InfoSec projects

Who Am I? Mark Cusack Chief Architect 9 years@rainstor Founding developer Ex UK Ministry of Defence Research InfoSec projects 1 Who Am I? Mark Cusack Chief Architect 9 years@rainstor Founding developer Ex UK Ministry of Defence Research InfoSec projects 2 RainStor: a SQL Database on Hadoop SCALE (MPP, Shared everything) LOAD

More information

ALERT LOGIC FOR HIPAA COMPLIANCE

ALERT LOGIC FOR HIPAA COMPLIANCE SOLUTION OVERVIEW: ALERT LOGIC FOR HIPAA COMPLIANCE AN OUNCE OF PREVENTION IS WORTH A POUND OF CURE Alert Logic provides organizations with the most advanced and cost-effective means to secure their healthcare

More information

Cloud Computing: Outsourcing Computation without Outsourcing Control

Cloud Computing: Outsourcing Computation without Outsourcing Control Cloud Computing: Outsourcing Computation without Outsourcing Control Richard Chow, PARC Philippe Golle, PARC Markus Jakobsson, PARC Ryusuke Masuoka, Fujitsu Jesus Molina, Fujitsu Elaine Shi, PARC Jessica

More information

A Guide to. Cloud Services for production workloads

A Guide to. Cloud Services for production workloads A Guide to Cloud Services for production workloads Intro Workload Requirements Matter Intro With the benefits of the cloud supported by both research and case studies, a growing number of cloud service

More information

Top 10 Cloud Risks That Will Keep You Awake at Night

Top 10 Cloud Risks That Will Keep You Awake at Night Top 10 Cloud Risks That Will Keep You Awake at Night Shankar Babu Chebrolu Ph.D., Vinay Bansal, Pankaj Telang Photo Source flickr.com .. Amazon EC2 (Cloud) to host Eng. Lab testing. We want to use SalesForce.com

More information

Balancing Security Investment Against Today's Threat Environment

Balancing Security Investment Against Today's Threat Environment Balancing Security Investment Against Today's Threat Environment Niel Pandya Data Security, Senior Manager, Oracle ASEAN The following is intended to outline our general product direction.

More information

John Essner, CISO Office of Information Technology State of New Jersey

John Essner, CISO Office of Information Technology State of New Jersey John Essner, CISO Office of Information Technology State of New Jersey http://csrc.nist.gov/publications/nistpubs/800-144/sp800-144.pdf Governance Compliance Trust Architecture Identity and Access Management

More information

The Trusted Cloud: Addressing Security and Compliance

The Trusted Cloud: Addressing Security and Compliance The Trusted Cloud: Addressing Security and Compliance by Enrique Castro-Leon, Enterprise and Data Center Architect & Technology Strategist, Intel Corporation, and Raghu Yeluri, Principal Engineer, Intel

More information

Efficient Integrity Checking Technique for Securing Client Data in Cloud Computing

Efficient Integrity Checking Technique for Securing Client Data in Cloud Computing International Journal of Electrical & Computer Sciences IJECS-IJENS Vol: 11 No: 05 41 Efficient Integrity Checking Technique for Securing Client Data in Cloud Computing Abstract-- It has been widely observed

More information

Systems of Discovery The Perfect Storm of Big Data, Cloud and Internet-of-Things

Systems of Discovery The Perfect Storm of Big Data, Cloud and Internet-of-Things Systems of Discovery The Perfect Storm of Big Data, Cloud and Internet-of-Things Mac Devine CTO, IBM Cloud Services Division IBM Distinguished Engineer wdevine@us.ibm.com twitter: mac_devine Forecast for

More information

Cloud Courses Description

Cloud Courses Description Courses Description 101: Fundamental Computing and Architecture Computing Concepts and Models. Data center architecture. Fundamental Architecture. Virtualization Basics. platforms: IaaS, PaaS, SaaS. deployment

More information

Executive Summary. Architectural Overview WHITE PAPER

Executive Summary. Architectural Overview WHITE PAPER WHITE PAPER Securing Your Cloud-Based Data Integration A Best Practices Checklist A Report on Secure Integration Techniques Targeted at the Information Technology Executive Prepared by Mercury Consulting,

More information

whitepaper Ten Essential Steps for Achieving Continuous Compliance: A Complete Strategy for Compliance

whitepaper Ten Essential Steps for Achieving Continuous Compliance: A Complete Strategy for Compliance Ten Essential Steps for Achieving Continuous Compliance: A Complete Strategy for Compliance Table of Contents 3 10 Essential Steps 3 Understand the Requirements 4 Implement IT Controls that Affect your

More information

Appendix to; Assessing Systemic Risk to Cloud Computing Technology as Complex Interconnected Systems of Systems

Appendix to; Assessing Systemic Risk to Cloud Computing Technology as Complex Interconnected Systems of Systems Appendix to; Assessing Systemic Risk to Cloud Computing Technology as Complex Interconnected Systems of Systems Yacov Y. Haimes and Barry M. Horowitz Zhenyu Guo, Eva Andrijcic, and Joshua Bogdanor Center

More information

Build (develop) and document Acceptance Transition to production (installation) Operations and maintenance support (postinstallation)

Build (develop) and document Acceptance Transition to production (installation) Operations and maintenance support (postinstallation) It is a well-known fact in computer security that security problems are very often a direct result of software bugs. That leads security researches to pay lots of attention to software engineering. The

More information

Understanding the Significance of SOX Compliance. www.cognoscape.com

Understanding the Significance of SOX Compliance. www.cognoscape.com Understanding the Significance of SOX Compliance www.cognoscape.com Understanding the Significance of SOX Compliance The Sarbanes-Oxley Act (SOX) became effective in 2006 and was implemented to hold all

More information

Solving data residency and privacy compliance challenges Delivering business agility, regulatory compliance and risk reduction

Solving data residency and privacy compliance challenges Delivering business agility, regulatory compliance and risk reduction Solving data residency and privacy compliance challenges Delivering business agility, regulatory compliance and risk reduction Introduction In today s dynamic business environment, corporation s intangible

More information

Data Security In The Cloud

Data Security In The Cloud Data Security In The Cloud LOGO Presented by: Gary Dischner TxMQ Enterprise Architect What Is The Cloud? NIST 800-145 Cloud computing is a model for enabling ubiquitous, convenient, on-demand network access

More information

Cloud Computing Security Considerations

Cloud Computing Security Considerations Cloud Computing Security Considerations Roger Halbheer, Chief Security Advisor, Public Sector, EMEA Doug Cavit, Principal Security Strategist Lead, Trustworthy Computing, USA January 2010 1 Introduction

More information

How DataSunrise Helps to Comply with SOX, PCI DSS and HIPAA Requirements

How DataSunrise Helps to Comply with SOX, PCI DSS and HIPAA Requirements How DataSunrise Helps to Comply with SOX, PCI DSS and HIPAA Requirements DataSunrise, Inc. https://www.datasunrise.com Note: the latest copy of this document is available at https://www.datasunrise.com/documentation/resources/

More information

IBM InfoSphere Guardium Data Activity Monitor for Hadoop-based systems

IBM InfoSphere Guardium Data Activity Monitor for Hadoop-based systems IBM InfoSphere Guardium Data Activity Monitor for Hadoop-based systems Proactively address regulatory compliance requirements and protect sensitive data in real time Highlights Monitor and audit data activity

More information

Solution Brief for HIPAA HIPAA. Publication Date: Jan 27, 2015. EventTracker 8815 Centre Park Drive, Columbia MD 21045

Solution Brief for HIPAA HIPAA. Publication Date: Jan 27, 2015. EventTracker 8815 Centre Park Drive, Columbia MD 21045 Publication Date: Jan 27, 2015 8815 Centre Park Drive, Columbia MD 21045 HIPAA About delivers business critical software and services that transform high-volume cryptic log data into actionable, prioritized

More information

Keeping watch over your best business interests.

Keeping watch over your best business interests. Keeping watch over your best business interests. 0101010 1010101 0101010 1010101 IT Security Services Regulatory Compliance Services IT Audit Services Forensic Services Risk Management Services Attestation

More information

Index Terms Cloud Storage Services, data integrity, dependable distributed storage, data dynamics, Cloud Computing.

Index Terms Cloud Storage Services, data integrity, dependable distributed storage, data dynamics, Cloud Computing. Volume 3, Issue 5, May 2013 ISSN: 2277 128X International Journal of Advanced Research in Computer Science and Software Engineering Research Paper Available online at: www.ijarcsse.com Privacy - Preserving

More information

Clinical Trials in the Cloud: A New Paradigm?

Clinical Trials in the Cloud: A New Paradigm? Marc Desgrousilliers CTO at Clinovo Clinical Trials in the Cloud: A New Paradigm? Marc Desgrousilliers CTO at Clinovo What is a Cloud? (1 of 3) "Cloud computing is a model for enabling convenient, on-demand

More information

4 Essential Steps to a Successful HIPAA Audit. by Roman Diaz, Touchstone Compliance President. Assessment & solutions for meeting HIPAA standards

4 Essential Steps to a Successful HIPAA Audit. by Roman Diaz, Touchstone Compliance President. Assessment & solutions for meeting HIPAA standards 4 Essential Steps to a Successful HIPAA Audit by Roman Diaz, Touchstone Compliance President Assessment & solutions for meeting HIPAA standards Introduction There are certain steps a practice can take

More information

Logging and Alerting for the Cloud

Logging and Alerting for the Cloud Logging and Alerting for the Cloud What you need to know about monitoring and tracking across your enterprise The need for tracking and monitoring is pervasive throughout many aspects of an organization:

More information

Paxata Security Overview

Paxata Security Overview Paxata Security Overview Ensuring your most trusted data remains secure Nenshad Bardoliwalla Co-Founder and Vice President of Products nenshad@paxata.com Table of Contents: Introduction...3 Secure Data

More information

Cisco SAFE: A Security Reference Architecture

Cisco SAFE: A Security Reference Architecture Cisco SAFE: A Security Reference Architecture The Changing Network and Security Landscape The past several years have seen tremendous changes in the network, both in the kinds of devices being deployed

More information

CLOUD STORAGE SECURITY INTRODUCTION. Gordon Arnold, IBM

CLOUD STORAGE SECURITY INTRODUCTION. Gordon Arnold, IBM CLOUD STORAGE SECURITY INTRODUCTION Gordon Arnold, IBM SNIA Legal Notice The material contained in this tutorial is copyrighted by the SNIA. Member companies and individual members may use this material

More information

Security Information Lifecycle

Security Information Lifecycle Security Information Lifecycle By Eric Ogren Security Analyst, April 2006 Copyright 2006. The, Inc. All Rights Reserved. Table of Contents Executive Summary...2 Figure 1... 2 The Compliance Climate...4

More information

Auditing Cloud Computing. A Security and Privacy Guide. Wiley Corporate F&A

Auditing Cloud Computing. A Security and Privacy Guide. Wiley Corporate F&A Brochure More information from http://www.researchandmarkets.com/reports/2213812/ Auditing Cloud Computing. A Security and Privacy Guide. Wiley Corporate F&A Description: The auditor's guide to ensuring

More information

Brainloop Cloud Security

Brainloop Cloud Security Whitepaper Brainloop Cloud Security Guide to secure collaboration in the cloud www.brainloop.com Sharing information over the internet The internet is the ideal platform for sharing data globally and communicating

More information

Security and Privacy in Cloud Computing

Security and Privacy in Cloud Computing Security and Privacy in Cloud Computing Ragib Hasan Johns Hopkins University en.600.412 Spring 2010 Lecture 2 02/01/2010 Threats, vulnerabilities, and enemies Goal Learn the cloud computing threat model

More information

Research Challenges in Virtualization. Steven Hand Senior Architect, Citrix R&D Reader in Computer Systems, U. Cambridge

Research Challenges in Virtualization. Steven Hand Senior Architect, Citrix R&D Reader in Computer Systems, U. Cambridge Research Challenges in Virtualization Steven Hand Senior Architect, Citrix R&D Reader in Computer Systems, U. Cambridge About Citrix Global company with around 5,000 employees Approx 300 R&D folks in Europe

More information

Effective Software Security Management

Effective Software Security Management Effective Software Security Management choosing the right drivers for applying application security Author: Dharmesh M Mehta dharmeshmm@mastek.com / dharmeshmm@owasp.org Table of Contents Abstract... 1

More information

Whitepaper. What You Need to Know About Infrastructure as a Service (IaaS) Encryption

Whitepaper. What You Need to Know About Infrastructure as a Service (IaaS) Encryption Whitepaper What You Need to Know About Infrastructure as a Service (IaaS) Encryption What You Need to Know about IaaS Encryption What You Need to Know About IaaS Encryption Executive Summary In this paper,

More information

Is your business prepared for Cyber Risks in 2016

Is your business prepared for Cyber Risks in 2016 Is your business prepared for Cyber Risks in 2016 The 2016 GSS Find out Security with the Assessment Excellus BCBS customers hurt by security breach Hackers Access 80 Mn Medical Records At Anthem Hackers

More information

Protecting Your Data On The Network, Cloud And Virtual Servers

Protecting Your Data On The Network, Cloud And Virtual Servers Protecting Your Data On The Network, Cloud And Virtual Servers How SafeGuard Encryption can secure your files everywhere The workplace is never static. Developments include the widespread use of public

More information

The Business Benefits of Logging

The Business Benefits of Logging WHITEPAPER The Business Benefits of Logging Copyright 2000-2011 BalaBit IT Security All rights reserved. www.balabit.com 1 Table of Content Introduction 3 The Business Benefits of Logging 4 Security as

More information

MANAGED FILE TRANSFER: 10 STEPS TO HIPAA/HITECH COMPLIANCE

MANAGED FILE TRANSFER: 10 STEPS TO HIPAA/HITECH COMPLIANCE WHITE PAPER MANAGED FILE TRANSFER: 10 STEPS TO HIPAA/HITECH COMPLIANCE 1. OVERVIEW Do you want to design a file transfer process that is secure? Or one that is compliant? Of course, the answer is both.

More information

Big Data and Cyber Security A bibliometric study Jacky Akoka, Isabelle Comyn-Wattiau, Nabil Laoufi Workshop SCBC - 2015 (ER 2015) 1 Big Data a new generation of technologies and architectures, designed

More information

Cyber Security Pr o t e c t i n g y o u r b a n k a g a i n s t d a t a b r e a c h e s

Cyber Security Pr o t e c t i n g y o u r b a n k a g a i n s t d a t a b r e a c h e s Cyber Security Pr o t e c t i n g y o u r b a n k a g a i n s t d a t a b r e a c h e s 1 Agenda Data Security Trends Root causes of Cyber Attacks How can we fix this? Secure Infrastructure Security Practices

More information

Building Secure Cloud Applications. On the Microsoft Windows Azure platform

Building Secure Cloud Applications. On the Microsoft Windows Azure platform Building Secure Cloud Applications On the Microsoft Windows Azure platform Contents 1 Security and the cloud 3 1.1 General considerations 3 1.2 Questions to ask 3 2 The Windows Azure platform 4 2.1 Inside

More information

MASSIVE NETWORKS Online Backup Compliance Guidelines... 1. Sarbanes-Oxley (SOX)... 2. SOX Requirements... 2

MASSIVE NETWORKS Online Backup Compliance Guidelines... 1. Sarbanes-Oxley (SOX)... 2. SOX Requirements... 2 MASSIVE NETWORKS Online Backup Compliance Guidelines Last updated: Sunday, November 13 th, 2011 Contents MASSIVE NETWORKS Online Backup Compliance Guidelines... 1 Sarbanes-Oxley (SOX)... 2 SOX Requirements...

More information

The Race to Secure the Cloud 2.0

The Race to Secure the Cloud 2.0 The Race to Secure the Cloud 2.0 How Best Practices in Cryptography and Key Management Will Create Competitive Advantage When Securing the Cloud First one to secure Cloud 2.0 wins. The Cloud, it seems,

More information

Email Compliance in 5 Steps

Email Compliance in 5 Steps Email Compliance in 5 Steps Introduction For most businesses, email is a vital communication resource. Used to perform essential business functions, many organizations rely on email to send sensitive confidential

More information

Ensuring Security in Cloud with Multi-Level IDS and Log Management System

Ensuring Security in Cloud with Multi-Level IDS and Log Management System Ensuring Security in Cloud with Multi-Level IDS and Log Management System 1 Prema Jain, 2 Ashwin Kumar PG Scholar, Mangalore Institute of Technology & Engineering, Moodbidri, Karnataka1, Assistant Professor,

More information

APPLICATION COMPLIANCE AUDIT & ENFORCEMENT

APPLICATION COMPLIANCE AUDIT & ENFORCEMENT TELERAN SOLUTION BRIEF Building Better Intelligence APPLICATION COMPLIANCE AUDIT & ENFORCEMENT For Exadata and Oracle 11g Data Warehouse Environments BUILDING BETTER INTELLIGENCE WITH BI/DW COMPLIANCE

More information

AIRDEFENSE SOLUTIONS PROTECT YOUR WIRELESS NETWORK AND YOUR CRITICAL DATA SECURITY AND COMPLIANCE

AIRDEFENSE SOLUTIONS PROTECT YOUR WIRELESS NETWORK AND YOUR CRITICAL DATA SECURITY AND COMPLIANCE AIRDEFENSE SOLUTIONS PROTECT YOUR WIRELESS NETWORK AND YOUR CRITICAL DATA SECURITY AND COMPLIANCE THE CHALLENGE: SECURE THE OPEN AIR Wirelesss communication lets you take your business wherever your customers,

More information

Security Considerations for Public Mobile Cloud Computing

Security Considerations for Public Mobile Cloud Computing Security Considerations for Public Mobile Cloud Computing Ronnie D. Caytiles 1 and Sunguk Lee 2* 1 Society of Science and Engineering Research Support, Korea rdcaytiles@gmail.com 2 Research Institute of

More information

CONTROLLING DATA IN THE CLOUD: OUTSOURCING COMPUTATION WITHOUT OUTSOURCING CONTROL

CONTROLLING DATA IN THE CLOUD: OUTSOURCING COMPUTATION WITHOUT OUTSOURCING CONTROL CONTROLLING DATA IN THE CLOUD: OUTSOURCING COMPUTATION WITHOUT OUTSOURCING CONTROL Paper By: Chow, R; Golle, P; Jakobsson, M; Shai, E; Staddon, J From PARC & Masuoka, R And Mollina From Fujitsu Laboratories

More information

OCF: An Open Cloud Forensics Model for Reliable Digital Forensics

OCF: An Open Cloud Forensics Model for Reliable Digital Forensics OCF: An Open Cloud Forensics Model for Reliable Digital Forensics Shams Zawoad, Ragib Hasan, and Anthony Skellum* {zawoad, ragib}@cis.uab.edu, skellum@auburn.edu Department of Computer and Information

More information

Cloud Security Standards. Aziza Al Rashdi Director, Cyber Security Professional Services Oman National CERT Information Technology Authority

Cloud Security Standards. Aziza Al Rashdi Director, Cyber Security Professional Services Oman National CERT Information Technology Authority Cloud Security Standards Aziza Al Rashdi Director, Cyber Security Professional Services Oman National CERT Information Technology Authority Introduction Sign Off December 2012 Information Technology Authority

More information

Cloud Computing. Cloud Computing An insight in the Governance & Security aspects

Cloud Computing. Cloud Computing An insight in the Governance & Security aspects Cloud Computing An insight in the Governance & Security aspects AGENDA Introduction Security Governance Risks Compliance Recommendations References 1 Cloud Computing Peter Hinssen, The New Normal, 2010

More information

Surviving an Identity Audit

Surviving an Identity Audit What small and midsize organizations need to know about the identity portion of an IT compliance audit Whitepaper Contents Executive Overview.......................................... 2 Introduction..............................................

More information

Trustworthy Clouds. Underpinning the Future Internet. Cloudscape III, Brussels, March 2011 Elmar Husmann, Corinna Schulze IBM.

Trustworthy Clouds. Underpinning the Future Internet. Cloudscape III, Brussels, March 2011 Elmar Husmann, Corinna Schulze IBM. Trustworthy Clouds Underpinning the Future Internet Cloudscape III, Brussels, March 2011 Elmar Husmann, Corinna Schulze IBM 1 of 12 80% Of enterprises consider security the #1 inhibitor to cloud adoptions

More information

INSTANT MESSAGING SECURITY

INSTANT MESSAGING SECURITY INSTANT MESSAGING SECURITY February 2008 The Government of the Hong Kong Special Administrative Region The contents of this document remain the property of, and may not be reproduced in whole or in part

More information

Using Data Encryption to Achieve HIPAA Safe Harbor in the Cloud

Using Data Encryption to Achieve HIPAA Safe Harbor in the Cloud Using Data Encryption to Achieve HIPAA Safe Harbor in the Cloud 1 Contents The Obligation to Protect Patient Data in the Cloud................................................... Complying with the HIPAA

More information

Enterprise Key Management: A Strategic Approach ENTERPRISE KEY MANAGEMENT A SRATEGIC APPROACH. White Paper February 2010 www.alvandsolutions.

Enterprise Key Management: A Strategic Approach ENTERPRISE KEY MANAGEMENT A SRATEGIC APPROACH. White Paper February 2010 www.alvandsolutions. Enterprise Key Management: A Strategic Approach ENTERPRISE KEY MANAGEMENT A SRATEGIC APPROACH White Paper February 2010 www.alvandsolutions.com Overview Today s increasing security threats and regulatory

More information

2.2 The Security of Electronic Medical Records (EMR) DOH, the Executive Yuan August 19, 2009

2.2 The Security of Electronic Medical Records (EMR) DOH, the Executive Yuan August 19, 2009 Topic 2: Privacy Protection and Ensuring Security of Network Applications or Services 2.2 The Security of Electronic Medical Records (EMR) DOH, the Executive Yuan August 19, 2009 1 Agenda 1. The Vision

More information

International Journal of Advanced Research in Computer Science and Software Engineering

International Journal of Advanced Research in Computer Science and Software Engineering Volume 3, Issue 3, March 3 ISSN: 2277 128X International Journal of Advanced Research in Computer Science and Software Engineering Research Paper Available online at: www.ijarcsse.com Using Third Party

More information

White Paper Achieving SOX Compliance through Security Information Management. White Paper / SOX

White Paper Achieving SOX Compliance through Security Information Management. White Paper / SOX White Paper Achieving SOX Compliance through Security Information Management White Paper / SOX Contents Executive Summary... 1 Introduction: Brief Overview of SOX... 1 The SOX Challenge: Improving the

More information

HIPAA Myths. WEDI Member Town Hall. Chris Apgar, CISSP Apgar & Associates

HIPAA Myths. WEDI Member Town Hall. Chris Apgar, CISSP Apgar & Associates HIPAA Myths WEDI Member Town Hall Chris Apgar, CISSP Apgar & Associates Overview Missed Regulatory Requirements Common HIPAA Privacy Myths Common HIPAA Security Myths Other Related Myths Finding the Right

More information

Why Email Encryption is Essential to the Safety of Your Business

Why Email Encryption is Essential to the Safety of Your Business Why Email Encryption is Essential to the Safety of Your Business What We ll Cover Email is Like a Postcard o The Cost of Unsecured Email 5 Steps to Implement Email Encryption o Know Your Compliance Regulations

More information

AIRDEFENSE SOLUTIONS PROTECT YOUR WIRELESS NETWORK AND YOUR CRITICAL DATA SECURITY AND COMPLIANCE

AIRDEFENSE SOLUTIONS PROTECT YOUR WIRELESS NETWORK AND YOUR CRITICAL DATA SECURITY AND COMPLIANCE AIRDEFENSE SOLUTIONS PROTECT YOUR WIRELESS NETWORK AND YOUR CRITICAL DATA SECURITY AND COMPLIANCE THE CHALLENGE: SECURE THE OPEN AIR Wirelesss communication lets you take your business wherever your customers,

More information

Managing Privileged Identities in the Cloud. How Privileged Identity Management Evolved to a Service Platform

Managing Privileged Identities in the Cloud. How Privileged Identity Management Evolved to a Service Platform Managing Privileged Identities in the Cloud How Privileged Identity Management Evolved to a Service Platform Managing Privileged Identities in the Cloud Contents Overview...3 Management Issues...3 Real-World

More information

The NREN s core activities are in providing network and associated services to its user community that usually comprises:

The NREN s core activities are in providing network and associated services to its user community that usually comprises: 3 NREN and its Users The NREN s core activities are in providing network and associated services to its user community that usually comprises: Higher education institutions and possibly other levels of

More information