#bigdata cloudcomputing infosec

[shakayumi]

The Benefits and Risks of Big Data

The volume of data that businesses collect is exploding exponentially. This includes financial transactions, location-based data, customer interactions, the supply chain, as well as data produced by employees, contractors, partners and suppliers using social networking sites, intranets, extranets, and corporate wikis. In fact, sources such as mobile and online transactions, social media traffic and GPS coordinates now generate more than 2.5 quintillion bytes of “big data” every day, according to IBM. 

The commercial impacts of big data analytics—the practice of performing increasingly sophisticated analysis on massive amounts of data, predominantly unstructured—have the potential to generate significant productivity growth for a number of vertical industry sectors. In short, big data analytics presents an opportunity to create unprecedented business advantage and better service delivery. At the same time, it promises benefits for information security while also presenting increased risks.

Senior executives and boards the world over are now faced with extremely large amounts of data, and this can be viewed as both a burden and an opportunity for their business. Research suggests that companies capturing and using big data and business analytics to guide their decision-making are more productive and have higher returns on equity than competitors that do not. 

Research conducted by the McKinsey Global Institute points to big data having the capability to create substantial value and commercial impact. McKinsey found the potential of a 60 percent increase in retailers’ operating margins, 0.7 percent increase in productivity in U.S. health care, all translating into a $300 billion value per year. In addition, there’s the potential increase in demand for deep analytical talent positions, estimated between 140,000 and 190,000.

Pressure is mounting on businesses to embrace big data because of the enormous insights and competitive advantage it can provide. Computers are increasingly crunching numbers to find answers previously thought indecipherable. This is introducing new problems. For example, poor quality information or untested models can send businesses off course. 

As big data changes the game for businesses, the security risks have become much greater. From an information security standpoint, the key issues surrounding big data—both pro and con—tend to fall into the following five buckets:

Data breaches: With more transactions, conversations, interactions and data now online, the incentives for cybercriminals have never been better. Companies have more to worry about than the one-off data breaches or hacker attack stories that make headlines; breaches involving big data could have farreaching consequences and mean reputational damage, legal liability and even financial ruin. Cyber resilience and preparedness strategies are crucial for big data. However, using big data security analytics could also help identify cybercriminals or zero day attacks.

Data in the cloud: The pressure for businesses to quickly adopt and implement new technologies such as cloud services, often to support big data’s challenging storage and processing needs, comes with unforeseen risks and consequences. Big data in the cloud is a highly attractive target for harvesting data and places more demand on businesses to get their secure cloud sourcing strategy right. Furthermore, importing data into a big data store in the cloud can result in the removal of permissions or confidentiality restrictions on the original data. 

Consumerization: Together with the growth of big data is the proliferation of new mobile devices used to gather, store, access and transfer data. The challenge for businesses is in managing and securing personal devices brought into the workplace by employees and balancing the need for security with productivity. Businesses should enforce employee acceptable usage policies and continue to manage mobile devices in line with their established security policy Businesses should also consider how they might use big data analytics tools to identify any misuse or unusual access to systems through remote login, mobile or other personal devices. 

Interconnected supply chains: Organizations are part of often complex, global and interdependent supply chains, which can be their weakest link. There is a key role for information security in coordinating the contracting and provisioning of business relationships, including outsourcers, offshorers and supply chain and cloud providers. Big data analytics has the potential to create an overarching view of an organization’s supply chain security by analyzing  high-risk suppliers’ data and comparing suppliers across different dimensions of information security risk.

Privacy: As huge amounts of data are generated, stored and analyzed, privacy concerns are becoming an even larger issue. Businesses need to start planning for new data protection requirements as soon as possible while monitoring for further legislative and regulatory developments in other jurisdictions where your customers are based. Also, they should consider using big data analytics tools to identify where private personal information is being stored and how it is protected.

Big data analytics have the potential to reduce the growing number of cyber security risks and increase business agility. Businesses eager to adopt these new technologies for business benefit will be well advised to set out clear good practice guidelines for big data. They need to understand the legal and other restrictions that may apply to data they collect, store and use across multiple jurisdictions. Companies should also implement privacy best practices, designing them into the analytics programs they are using for big data, and build in transparency and accountability, all the while considering the impact of big data usage on people, processes and technology. 

[shakayumi]

BYOD is the solution, not the problem

The BYOD movement can be a source of problems for IT pros. Enterprises are learning how to mitigate the security and compliance issues that arise when employees use personal mobile devices to access business applications. And when the benefits and goals of BYOD hinder the productivity advantages of cloud computing, things can get ugly.

Bring your own device (BYOD) policies complicate cloud because they limit a company's ability to optimize application delivery to a single platform -- a major benefit of cloud adoption. There are ways, however, to optimize the cloud so enterprises don't have to choose between either a cloud project or BYOD.

Creating a BYOD-compatible cloud The first casualty of the BYOD and cloud collision will be custom client software. Some users have relied on graphical user interface tools or virtual desktops to create worker views of data; however, mobile devices offer limited support for application-specific clients. To expect client support on all popular mobile device OSes is unrealistic, and products such as Windows RT or Firefox OS will likely drive developers in too many different directions. Instead, focus on building a cloud computing environment that supports a modern -- and rapidly changing -- BYOD business.

The first rule of building a BYOD-compatible cloud is to base application interfaces on browser thin-client technology exclusively. This browser-based strategy means you should first ensure cloud applications are thin-client compatible. Next, you'll need to make certain all devices in your environment support necessary applications.

To build a browser-based BYOD cloud strategy, all applications must be exposed using URLs. Most modern software tools and nearly all cloud services work this way, but legacy applications that are hosted on Infrastructure as a Service (IaaS) platforms may include nonstandard interfaces. Some companies have also adopted Web services interfaces (using SOAP), which can be difficult to support on mobile devices, particularly if you can't target a single device type.

Once your applications are presented as URLs, you can build mobile device interfaces using Web-authoring tools. Keep in mind that not all browsers are the same; the HTML and scripting features various mobile browsers supported vary greatly. A quick Web search can find charts to help you understand particular Web-page features you can expect to use to support mobile-based cloud applications. Support for HTML5, cascading style sheets (CSS) features and scripting languages likely will be the most problematic.

Most enterprises correctly believe that HTML5 is the long-term future of UI, and most mobile browsers will support the basic features of HTML5. However, HTML5 does not support many database, device control and productivity tool functions on certain devices.

Extending support to mobile devices is an evolving process; some experts believe advanced HTML5 features will be widely available sooner than advanced scripting tools. The best strategy could be to start with basic HTML5 and evolve BYOD device screens as the support for HTML5 features expand. When it comes to older mobile devices with outdated OSes, it may be best to stick with older-generation HTML screens and use minimal to no scripting.

There are two options for browser support of applications: have the browser assemble the pages and access individual URLs, or have an agent process (a software that resides on the server and acts on behalf of the browser) assemble data from application URLs and present that data in a single screen to all browsers. The former approach allows for better control over what HTML features are used, while the latter method can offer better control over application and data integrity in the event of a failure.

When cloud processes are assembled to create a single virtual application for the end user, it's critical that any transaction can either be fully processed by all application elements or backed out completely. When the device has this responsibility, loss of connection may make it impossible to synchronize data state.

Managing devices and securing enterprise data All cloud process frameworks for BYOD include device management and methods to secure enterprise IT resources. The use of URL-based device screens may make it difficult to manage and secure devices, because it is necessary to validate a device against browser tools the cloud processes use and also to ensure the device is secure.

One option is to use a security or management tool on each device that provide access to data and secures the device against most threats. But this hinges on the availability of a common utility that works with user-defined devices; your only option may be to check with the each vendor about compatibility.

Despite problems, BYOD and the cloud can live in harmony. As HTML5 support matures, it's likely the feature overlap among various mobile browsers will increase, solving one of the major problems with BYOD in the workplace. By developing effective processes in the present and planning for the future, a company can build a cloud strategy that supports BYOD.

[shakayumi]

Does big data belong in the public cloud?

Data scientists and business bigwigs discussed the thorny logistics and ethics of big data analytics last week at MIT, and whether this type of data belongs in the public cloud.

  When a panel of two data scientists and a business expert here were asked about cloud computing's role in the big data trend, some expressed skepticism about its trustworthiness.

  "We will continue to invest in internal infrastructure," said Claudia Perlich, chief scientist for media6degrees, a marketing research firm based in New York. "Our customers don't necessarily trust cloud providers, and we like as much control as we can get."

  She said it is in the company's best interest to invest in its own infrastructure, even though it may cost more than using a public cloud service. A company that's less focused on data processing at its core, which just uses big data for decision support, might feel differently, she conceded.

  But more and more businesses have begun to run big data operations in the cloud, according to MIT conference attendee Mike Olson, CEO of Cloudera, an Apache Hadoop-based software and services business in Palo Alto, Calif. Not necessarily even because it's cheaper -- in some cases it's not -- but because of the flexibility of scale, he said.

  In fact, there are a lot of startups in the big data space that were born on the public cloud and find it a better way to keep infrastructure and management costs low, said panelist Tom Davenport, a professor at Harvard Business School and Babson College.

  This is also the reason for the prevalence of open source tools in the big data market currently, Davenport said. But he added he'd be surprised to see large enterprise companies running big data operations on Amazon Web Services' public cloud.

  Another panelist, Rachel Schutt, a senior statistician at Google Research, was sanguine about private cloud deployments in support of big data projects. She pointed out that big data usually won't fit on one machine, requiring a scale-out approach to computing in which multiple models run across multiple machines, which can be scaled quickly. Google's big data research runs on an infrastructure it hosts itself, of course.

  One thing the panelists agreed upon is the need to educate the next generation of data scientists on the ethics of what they do. A later presentation by MIT Media Lab professor Alex "Sandy" Pentland detailed his work with the European Union as well as the United States on a Data Bill of Rights. "It has to be you that controls data about you," Pentland said.

  But there are tradeoffs to consider when it comes to privacy versus the public good and the use of advanced big data techniques to analyze information such as health records and user behavior to stop the spread of disease, for example. With end users' permission, more invasive big data analytics might be helpful, Pentland said.

[shakayumi]

Mobile Backend as a Service bridges legacy systems and mobile devices

IT shops that want to support a mobile workforce without ripping and replacing legacy infrastructure to do it can use new middleware appliances known as Mobile Backend as a Service.

Mobile Backend as a Service (MBaaS) vendors such as Apigee Corp., StackMob Inc. and Layer7 Technologies provide prebuilt appliances that connect mobile applications to an organization's existing data repositories through application programming interfaces (APIs). Other vendors in this burgeoning mobile technology niche offer customers the ability to build custom apps alongside managing database connectors from companies such as Xamarin Inc. and FileMaker Inc.

"Any time we go into an organization and the service layer that sits between the databases and what will be a mobile app isn't there, we immediately put a pause on things," said Matt Bridges, chief technology officer for Intrepid Pursuits, a Cambridge, Mass.-based mobile app development shop.

Intrepid has worked with organizations that don't understand which data will be used by employees on a mobile device, how the mobile app will access that data and how the organization will properly secure access to that data in transit, Bridges said. "The front end of the app is what gets all the attention, but you can't just jump into mobile without understanding the intention behind the tool," he said. "That service layer for exposing data is the critical component for enabling mobility."

Mobile Backend as a Service bridges back-end business processes and mobility The middleware layer that exposes on-premises APIs also allows application developers to use public APIs from such cloud services as Google's mapping technology to build out tools much faster than they would otherwise, said Stefan Rust, CEO of Exicon, a Hong Kong-based mobile application lifecycle vendor.

The Spillers Group, a company in Dallas that manages three large restaurants, sought a way to push performance metrics stored on spreadsheets in Google Drive out to employees at each location. Spillers piloted Roambi, MeLLmo Inc.'s mobile business app that uses a database connector to pull information and deliver it to mobile devices in a visually appealing way. After deploying Roambi, the restaurant group saw a 10% savings in labor and food costs, according to Shane Spillers, co-founder of the Spillers Group. "We're able to reallocate resources much faster because we have a mobile tool that takes advantage of all the data metrics we're generating," he said. Previously, he generated PDFs at the end of every month. By automating and mobilizing that same business process, he can get the necessary data into the hands of his decision makers within two or three days.

Organizations like Spillers Group can enable mobility simply by identifying existing business processes, writing mobile applications for that process and combining it with an API back into the database, said Benjamin Robbins, principal at Palador Inc., a mobile consulting firm based in Seattle.

MBaaS version control and security While MBaaS can aid enterprise mobility, there are snags that IT should prepare for when using this type of middleware. Version control can be problematic when such third-party vendors as Google or Salesforce.com update their APIs or when organizations update their own APIs.

DevOps teams need to make sure the updated APIs don't break the system and the mobile apps before deploying them, said Mark O'Neill, founder and chief technology officer at Vordel Inc., an API management vendor based in Boston. APIs are also a common avenue for hackers to harvest data for private information, perform denial-of-service attacks on the network, and cause other security problems, he said. "The more lines of code an API has, the more difficult it is to secure it," he added.

Developers can protect APIs with Secure Sockets Layer encryption and client-side certificates, or even by requiring, for instance, that request signatures need a timestamp.

[shakayumi]

How iOS encryption and Data Protection work

Apple's Data Protection and built-in iOS encryption provide a powerful system for securing information, but only if those technologies are properly implemented.

If workers don't enable Data Protection on their devices, or if they use apps that don't utilize it, devices rely on basic iOS encryption to protect sensitive data, which only makes the devices easier to wipe. Making sure that users have Data Protection and associated settings enabled will help you take advantage of the robust encryption that Apple's system provides.

When Apple released iOS 4, the company added an important new feature: Data Protection, an architectural enhancement that beefs up iOS encryption on devices. It works in conjunction with the encryption mechanisms built into devices' hardware and firmware to protect data better. In iOS 5, Apple enhanced Data Protection to provide more flexibility for file access even if a device is locked, without putting data at risk.

Built-in iOS encryption Since the release of the iPhone 3GS, Apple has built encryption into the hardware and firmware of its iPads and iPhones. Every iOS device now has a dedicated Advanced Encryption Standard (AES) 256-bit crypto engine that sits between the flash storage and main system memory. The engine works in conjunction with the SHA-1 cryptographic hash function – which is implemented in the hardware as well -- to reduce overhead for cryptographic operations.

Also built into the device's hardware is the unique identifier (UID), an AES 256-bit key fused into the application processor. The UID is specific to the device and is not recorded anywhere else. No software or firmware can read it directly. They can see only the results of the encryption and decryption operations. Plus, because the key is burnt into the silicon, it cannot be tampered with or bypassed. Only the crypto engine can access it. As a result, data is cryptographically tied to a specific device and cannot be related to any other identifier or device.

Building encryption into the physical architecture makes it easier to encrypt all data stored on an iOS device. In fact, Apple enables this level of encryption by default and does not permit it to be disabled. But such iOS encryption provides little in the way of real protection, other than to facilitate a fast, secure wipe of the system. This is an important feature, especially if a device is lost or stolen and remote wipe has been configured beforehand. Under such circumstances, a device's data can theoretically be erased before someone can hack or jailbreak it. But if a device can't be wiped quickly enough, a hacker can crack the security and get at sensitive data.

Enabling iOS Data Protection That's where iOS Data Protection comes in. Data Protection is implemented at the software level and works with the hardware and firmware encryption to provide a greater degree of security.

When Data Protection is enabled, each data file is associated with a specific class that supports a different level of accessibility and protects data based on when it needs to be accessed. The encryption and decryption operations associated with each class are based on a complex key hierarchy that utilizes the device's UID and passcode, plus a class key, file system key and per-file key. The per-file key is used to encrypt the file content. The class key is wrapped around the per-file key and stored in the file's metadata. The file system key is used to encrypt the metadata. The UID and passcode protect the class key.

Fortunately, this operation is invisible to users. They access their apps as they always have. The important thing to take from this is not the specifics of how the encryption-related mechanisms work together (unless you're a developer), but that for a device to utilize Data Protection, a passcode must be used when accessing that device. The passcode not only unlocks the device, but also becomes inextricably enmeshed with the UID to create iOS encryption keys that are more resistant to hacking efforts and brute-force attacks. In fact, users need to enable passcodes on their devices to enable Data Protection.

Protecting data in iOS If you support iOS devices in your organization, your policies should direct workers to use passcodes to help protect sensitive data. But remember that not all passcodes are created equal. On an iOS device, passcodes come in two types: the simple, four-digit, numerical passcode and the more complex alphanumeric passcode, which is normally much greater in length. Not surprisingly, the more complex the alphanumeric passcode, the better.

For example, according to Apple documentation, a brute-force attack on a device that uses a nine-digit numerical passcode will take 2.5 years to try all possible combinations, in part because iOS enforces escalating time delays to help discourage such attacks. On the other hand, a six-character passcode that mixes numbers and lowercase letters will take 5.5 years. As you would expect, a four-digit numerical passcode should take no time at all. Of course, if users set their devices to be automatically wiped after 10 failed attempts, the number of tries is not an issue (unless the passcode can be discovered within those 10 attempts). Even if a hacker were able to jailbreak a device and bypass the passcode, the data would still be inaccessible because the hacker would not know the passcode.

Yet passcodes are not the only consideration if you want to take full advantage of iOS Data Protection. An app must be designed to use the Data Protection application program interfaces to ensure that data is protected when it's accessed by the application. The app must also ensure that data can't be moved to apps that don't use Data Protection. In other words, an unsecure app should not be able to access the data in a secure app. Keep in mind that, even if an application is designed to protect all its data, it can run up against limitations out of its control. For example, Data Protection can't be used on files that participate in iCloud storage.

With the release of iOS 6, users have a bit more control over apps being able to access secure data in other apps. Although the encryption mechanisms themselves did not change in iOS 6, the operating system now requires a user's permission before a newly installed app can access private data, such as calendars, reminders and contacts. Users can now also modify data access for certain application in the device's settings (under Privacy).

The key to taking full advantage of iOS encryption resides not only in enforcing passcode policies, but also in maintaining complete control of the apps implemented on iOS devices, or at least those apps that deal with your organization's sensitive data. Anything less can amount to practically no protection at all.

[shakayumi]

SAFE-certified devices make Android work for businesses

The Samsung Approved for Enterprise program adds IT administration features to certain Android smartphones and tablets, which could make managing and securing devices significantly easier.

Samsung Approved for Enterprise (SAFE) is one of several efforts by manufacturers to beef up Android devices, overcome the OS' shortcomings and increase its enterprise appeal. SAFE offers proprietary extensions IT administrators can use to assert broader, deeper control over some Android smartphones and tablets.

Filling Android's gaps Many consumers love Android, but IT often fears it. Although Google continues to improve Android's enterprise-readiness, this mobile OS is still playing catchup on remote administration and platform security. Some highly sensitive organizations narrow the gap by installing custom Android builds, such as Security-Enhanced Android, to find and address gaps in security, but that approach requires significant IT effort and won't help on user-owned devices. Organizations that want more advanced control over off-the-shelf Android devices may prefer ones that ship with manufacturer and carrier-blessed enhancements. That's where SAFE comes in.

SAFE-certified devices, including the Galaxy Note II, Galaxy S III and Galaxy Tab 2, contain proprietary Samsung capabilities and application program interfaces (APIs) that go beyond industry standards. The APIs are tested for interoperability with third-party mobile device management (MDM) software and virtual private networks (VPNs). There is no need to load a SAFE-certified device with alternative firmware, although you may choose to install a third-party MDM agent or VPN client to get the most out of SAFE.

SAFE features Some of the enhancements you'll find in SAFE-certified devices include:

Deeper device management: Using SAFE APIs, admins can permit and disable features, such as camera, voice recording, screen capture and removable storage that IT administrators can't control through ordinary Android Device Admin APIs. Admins also have better control over Bluetooth and Wi-Fi network use. Employers who are concerned about expenses can also use SAFE to define and enforce voice and short message service (SMS) budgets.

Broader application management: SAFE APIs let third-party MDM clients silently install and remove applications (including those pulled from app stores), add and remove widgets, configure the home screen and notifications, and disable certain keys to create kiosk-mode devices. These enhancements help IT enable consumer-grade smartphones for business use without ever physically touching the devices.

Enhanced Exchange ActiveSync: One common Android challenge is that consumer-grade native mail clients can have limited Exchange ActiveSync (EAS) support. SAFE-certified phones support 50 EAS attributes and client capabilities such as out-office responses, message flags, download limits and SMS/voicemail synchronization. They also let users view messages by category or conversation. Some employers will still prefer third-party enterprise email clients such as NitroDesk TouchDown for Android or Good for Enterprise, but SAFE extensions yield a native client that is more business-friendly than most from original equipment manufacturers.

Stronger data encryption: A major Android security concern is the lack of full-device encryption. Android 3.0 Honeycomb (for tablets) and Android 4.0 Ice Cream Sandwich (for smartphones) added OS encryption features, but most currently deployed Android devices still lack hardware support for encryption. SAFE-certified devices not only support Federal Information Processing Standards (FIPS) 140-2 certified Android device encryption, they also provide Samsung On-Device Encryption (ODE), a hardware-accelerated second layer of protection for preferences, databases and Secure Digital card contents. ODE can be turned on using MDM software, EAS or manual settings. To better protect data in motion, SAFE also offers enhanced control over native and certified third-party VPN client configurations.

Tapping into SAFE extensions End users can configure some SAFE enhancements, such as ODE, but most require a third-party server. This is not a limitation of SAFE, but rather a key part of SAFE's appeal. SAFE's goal is to help IT remotely secure and manage off-the-shelf Android devices by integrating with existing enterprise infrastructure. For example:

MDM agents can remotely read or write device attributes, install or remove applications, or initiate actions such as remote wipe, find and lock. With SAP Afaria, Juniper Junos Pulse MSS, MobileIron MyPhone@Work, SOTI Mobicontrol or AirWatch, companies that use MDM can access many of the above-noted SAFE extensions. MDM vendors constantly adapt to new APIs from Samsung and other OEMs, so expect to find differences in SAFE controls that will surface through each MDM agent's graphical user interface. All SAFE-certified MDM products have passed rigorous interoperability tests with Samsung.

Companies that use VPN tunnels to authenticate and encrypt mobile enterprise access will find that IT can remotely configure quite a bit more on SAFE-certified devices. Notably, businesses that use Cisco, Juniper or F5 VPN gateways can benefit from SAFE-tested VPN clients and configuration settings, including Cisco AnyConnect client extensions.

Businesses that use any of the above-mentioned third-party servers to manage and secure Android devices can freely use SAFE to gain deeper, broader control over some Samsung phones and tablets. Unfortunately, SAFE can't be used on other Android devices, or with other third-party MDM software.

Think about SAFE as a way to raise the bar for certain users, groups or use cases. You might not be able to take advantage of SAFE on every personal device, but you might offer better support or additional apps to devices that are SAFE-certified. You might also procure SAFE-certified Android devices in situations that warrant enterprise ownership or platform standardization, such as tablets used in kiosk scenarios or phones field workers share to replace old, ruggedized Windows CE devices.

Finally, Samsung isn't the only Android vendor to offer proprietary device management or EAS extensions. Other examples include Motorola, with its Enterprise Device Management, and Nitrodesk, with TouchDown. Don't assume you're limited to industry-standard Android APIs. If you're looking for tighter control over Android devices that employees use for business, dig further and take a hard look at enhancements such as SAFE.