#norexpnw

[norexpnw]

Cloud Security WebForum Brief

The Cloud Security session was good with over 100 participants.  Although most of the participants indicated a limited usage of the cloud currently, the interest in the topic we see during WebForums and Roundtables shows that cloud usage is increasing.

Much of the discussion centered on the security standards that cloud providers should be able to adhere to, such as 

SOC 1 and SOC 2 (Service Organization Controls which involve security audits)

ISO27002 (International Organization for Standardization’s Information Security Standard)

FIPS (Federal Information Processing Standards)

21CFR (Code of Federal Regulations section effecting organizations subject to FDA controls)

HIPAA BAA (Health Information Portability and Accountability Act Business Associate Agreement effecting organizations that must secure PHI-Private Health Information)

Basically these are the various security-related standards that organizations must adhere to and are important to address in contracts with cloud providers. 

Recommended tools included:

DataSafe as a cloud provider that can adhere to HIPAA and will sign a BAA.

Netskope as a tool to evaluate the risk of putting specific applications in the cloud.

Box was  recommended for cloud file sharing and online collaboration. One member said it has saved his organization significant dollars by reducing the need to purchase on-premises storage. 

Encryption was another big issue.  In many cases, it is recommended that data be encrypted at both ends…by the cloud provider and the organization using the cloud…for an extra measure of security.

[norexpnw]

AntiVirus/Malware Notes

Written by: Chuck Shaleen

We had a very good session today on antivirus/malware issues.  Malware, which is short for malicious software, is the general term for computer threats. A virus, on the other hand, is a self-replicating program that infects other files. Although both terms are often used interchangeably, a virus is technically part of the malware family that includes trojans, worms and spyware.

We actually started with the latest news about the recent Microsoft Internet Explorer security threat (Heartbleed) that prompted Microsoft to issue a warning not use their browser.  Since then a patch has been delivered that has solved the problem and many of the participants have allowed IE to be used again, although the usage of alternative browsers will probably increase on a permanent basis.

A key take-away from the session is the advice that there is not one tool that can do it all. There are just so many threats that come from so many directions that most organizations are using at least two tools. One member even said they are using a four tier approach. The most commonly mentioned ones included  Sophos, Symantec End Point Protection, McAfee, TrendMicro, Kaspersky, Malwarebytes, ProofPoint, Mimecast and FireEye,

One tool that was given poor marks is Microsoft’s System Center Endpoint Protection.  Two members who tried MS SCEP as a Symantec replacement are going back to Symantec SEP. 

There were also several recommendations on the importance of user training.  As one participant stated, “What good does a lock do when somebody opens the door to anybody who knocks.”  

Many of the tools are available either on premises or via the cloud.  Although some organizations are still reluctant to have their security tools hosted offsite, there seems to be growing acceptance of the cloud based model because a sense that cloud providers are more “on top” of things.    

[norexpnw]

Software as a Service - NOREX Member Workshop

Had a great workshop relating to Software as a Service last week.  

Here were some of the key ideas:

Work Day (Previously of PeopleSoft before they were bought out by Oracle) is a new SaaS HR product that came highly recommended by a member during the meeting. Excellent service during the data collection and implementation phase.  Took 3-4 months for the complete transition to this HR SaaS model.

Look at expense investment vs. capital.  Starting from scratch makes sense but if you have already spent a significant amount in capital it might not be.  The learning curve is completely different as well.  Cost model shifts from hitting IT to hitting other departments.  They can see how much it will cost them.  In the case with WorkDay, the VP of HR was the project owner

SaaS providers have a financial incentive to keep the product running well.  If something goes bad for one person it goes bad for everyone.

SaaS makes sense for needs that are not highly customized and required standardization can be a good thing for stability and upgrades. Not so good for the end-users due to inflexibility for unique environments.  

Up-time and reliability are major factors but things can go down in-house just as easily.  Who do you trust more?  Often times these SaaS providers have the ability to put more manpower on a problem than you do.  You can negotiate discounts for downtime over a certain amount of time with Salesforce.   You’ll typically want to keep mission-critical in-house.

There is a lot of data that you can put in the cloud.  They are heavily regulated when it comes to consumer protection.  However, in the event of a breach, the vendor is not responsible.  It will come straight back to you.  There has to be a clear chain of custody.  A member mentioned looking into cyber insurance.  Even if the data is right next door doesn't mean it is any safer than in the cloud.

For WorkDay you have 60 days at the end of the contract to extract the information you want.  They will help you write scripts.  They also have multi-tenancy.  Sometimes you can pay more to control your own release dates.

Members mentioned a bunch of products to steer clear of.  Usually the larger vendors who lack at service for on-prem, lack at service for cloud versions as well.  And what you are paying for is service with a SaaS model.

If you're interested in learning more about our group, let me know!  NOREX is all across the nation but I represent the Pacific Northwest states of Washington and Oregon.