Musings of a Corporate Consigliere

Thoughts & Advice on Consulting Challenges

Home Archives for cloud computing

Leave a Comment

Staunch the Bleeding – From Heartbleed to Cloudbleed

I'm Meeeelllllttttinggg

Heartbleed and Cloudbleed. Different name, similar mess.

More dispatches from the front for this week’s post.  Cloudflare, a premier cloud hosting and security provider was compromised back in September 2016.  Several lines of faulty code in an HTML parser allowed user session data (cookies, credentials, keys, tokens, etc.) to be scattered about unrelated web sessions by the millions.  This data was apparently spread in plain-text and is very difficult to remediate since the information was randomly dropped into unrelated sessions across a massive customer base.  According to Cloudflare, the worst data leakage occurred between February 13 – 18th 2017.

I was approached by Snapmunk to provide commentary on this issue, which I did.  However I have also have provided similar advice to clients more times than I care to count.  We can point back to when the Heartbleed bug was identified back in 2014 but had been running rampant since 2012.  Remediation of this issue isn’t the investment of a boatload of expensive tech solutions but can tackle this problem

Here a few of the tips I have provided:

1. What steps would you advise businesses affected by Cloudflare’s data leak take following the leak? How should they go about damage control?

They should immediately activate their breach incident response program. Then coordinate with Cloudflare on a daily basis to ensure they have the latest information on the scope and impact of the Cloudbleed breach. Depending on where the company is located they may have to contact state and local authorities that they have been impacted by the Cloudbleed.

The most proactive damage control would be to contact the users of your company’s services immediately. State what actions you are taking to address the breach and have a defined plan to follow up with those customers to keep them informed.

Internally these companies must review their security posture from top to bottom. Ensure that the CloudBleed incident did not compromise credentials that can access corporate assets and cause further security breaches in the future.

2. What can we learn from a breach like this?

We can assume that Cloudflare was using the latest security technologies with a focus on a “Defense-in-Depth” strategy. However one error in a line of code invalidated millions of dollars in expensive technology. The takeaway for both consumers and companies is no technology service is 100% percent secure. Companies will need to aggressively review software for vulnerabilities. This will sometimes mean very expensive software migrations from legacy applications. On the consumer side, customers have to realize that using the same password for multiple sites, especially sensitive ones, is a very bad idea.

[Read more…]

Leave a Comment

HIPAA and the Cloud – Clearing the Air

Healthcare entities and Cloud Service Providers (CSPs) have been reluctant to form business partnerships due to the uncertainty of HIPAA Privacy and Security concerns.  Cloud technology was not mentioned in the original HIPAA legislation from 1996 nor included in the HITECH Act of 2009.  Barring large-scale EMR outsourcing to a private cloud hosted by their vendor; healthcare organizations shied away from other CSP services.  The Department of Health and Human Services had not provided any definitive guidance and healthcare providers did not have a clear understanding of the risk and compliance pitfalls.

This hasn’t stopped healthcare staff from utilizing all manner of consumer-grade cloud solutions. From Dropbox, Box and iCloud, healthcare staff sync their mobile, tablet and laptop device files to readily available solutions that are not HIPAA “compliant” nor do any of these entities have a Business Associate Agreement (BAA) with the overall healthcare provider.  This is a huge compliance risk to healthcare organizations.  There will be a large cost associated with the move toward CSPs who will sign a Business Associates Agreement (BAA) since many consumer solutions will not agree to the privacy and security stipulations of HIPAA.

Recently HHS released their Guidance on HIPAA & Cloud Computing.  Providing the basic risk and compliance building blocks so healthcare entities can start making appropriate decisions with an eye toward managing their compliance and risk obligations.

I had the opportunity to review the new guidance document with the Connected Health Initiative (CHI).   This group is heavily involved in the promotion of innovation in mHealth, telehealth and provides a group of like-minded companies to discuss and navigate the regulatory waters in healthcare. [Read more…]

Leave a Comment

Just Add Water. Cloud Computing Can Enhance Security

The Cloud Can Have a Security Silver Lining…Really

Houston-based technology consulting firm, Xvand (IsUtility) graciously offered the opportunity to provide content for their cloud computing blog. I worked closely with firm representative Yehuda Cagen on the topic of how Cloud Computing can actually increase enterprise security if correctly applied.

The article, 3 Top Things IT Experts Won’t Tell You About Cloud Computing Security, covers Managed Security Service Providers (MSSP), Cloud Disaster Recovery strategies and Mobile Device Management (MDM).  These solutions are particularly relevant to those firms who do not have the internal resources available to address the multitude of issues that are currently breaking over the enterprise

Cloud security is a still an immature practice, yet the services mentioned above can cover significant security gaps in your organization, reduce the risk of data loss or allow the effective management of the consumerization trend in the enterprise.

With security and IT teams strapped for resources and time, these services can allow for a more proactive approach to information security and risk management.

Please feel free to sound off in the comments below!

Leave a Comment

Local Interest: Cloud over the James (Part 2)

Switching Cloud Providers Can be Risky

(This article is part two of a two-part series on Cloud Computing and its usage by companies located in Richmond, Virginia)

A question that was fielded by the panel was what is the process when organization decides to switch between cloud providers.  Mark Eichenberger of Microsoft responded by saying if a customer in the Public Cloud space decides to switch providers Microsoft will send the data to the customer.  If the customer is on a Private Cloud, the data is sent to the customer and the drives that were used to store the data are shredded.

All the panelists agreed that both the provider and consumer of the Cloud service should plan their exit strategy on the front end of the Cloud services agreement.  How the data will be transferred and the contract terminated must be agreed to up front to ensure that expectations are set and understood by all parties before the cloud service commences.  Jason Carnes of VMWare stated that Cloud consumers should ensure that they avoid “vendor lock-in” to a specific cloud service.  VMWare attempts to avoid this issue by only working (co-branding) with cloud vendors that meet VMWare’s support framework.

As for moving information from Cloud Provider A to Cloud Provider B, there are no standards or agreements in place amongst the big cloud players.  There are are specific instances where a cloud consumer can engage a web services firm to move their data from one cloud provider to another, but this is a case-by-case basis.   Mark Eichenburger stated that a standard protocol amongst cloud providers will be a long way off.  As an example of lengthy industry standard development efforts, HTML5 has been in development for over a decade and is only now moving toward agreement and implementation.

The next topic posed to the panelists was the security of the Cloud.  Mr. Eichenberger stated that this is one of the first topics that a customer talks to Microsoft about as they look to move toward the Cloud.  It is Microsoft’s strategy to assuage a potential customer’s security concerns before they move deeper into developing a solution.  If the client still expresses significant discomfort at the thought of their data in the Cloud, Microsoft will not pursue the relationship. [Read more…]

Leave a Comment

Local Interest: Cloud Over the James (Part 1)

This fog is entirely composed of vendor hype!

(This article is part one of a two-part series on Cloud Computing and its usage by companies located in Richmond, Virginia)

Plying the stormy cloud sea toward reality has been a challenge for business and IT folks alike.  Buffeted by gales of white papers, webinars and  sales-speak we cling grimly to the wheel of our organization as we attempt to find a gleaming beacon of true direction in the tempest-tossed marketplace.  It doesn’t help that the captain had to be tied to the mast after listening to too many slick marketing campaigns.

In an attempt to cut through the hype and educate myself outside the vendor sales pitches, I attended the latest AITP meeting on Cloud Computing.  Local companies, with an international presence, were gathered to discuss their usage of the cloud as well as their rationale for choosing that solution.  Also, two vendors were on hand to give their perspective on current and future use of cloud computing.

The panel consisted of Chris Burroughs,VP IT Infrastructure Services at Mondial Assistance. Ms. Burroughs has worked with the cloud model since the Application Service Provider (ASP) days. Another panelist was Mark A. Eichenberger, Office 365 Specialist from Microsoft Corporation. Mr. Eichenberger provides a variety of cloud solutions (Private, Hybrid, Public) to his customers. The next panelist was Chet Loveland, Chief Information Security Officer for MeadWestvaco. Mr. Loveland’s organization currently has near 18,000 users using Corporate Gmail.  Chuck McBride, Sr. Global Infrastructure Manager of Tredegar Film Products was on hand to discuss his firm’s early cloud adoption strategy.  The final panelist was Jason Karnes, Cloud Architect at VMware. Mr. Karnes works within the vCloud Datacenter. [Read more…]

Share!

ContactUs.com