Determining if the Cloud is a Better Solution Given Your Environment
At the 2015 RSA Conference, security evangelist Bruce Scheier challenged his audience: “Don’t ask if you should be in the cloud. Ask if the cloud is more secure [than] what you’re doing right now.”
Later during the conference, I posed that same question to Ben Rothke (@benrothke), Principal eGRC consultant with The Nettitude Group as to how you should determine which environment is more appropriate and secure for your data.
Rothke suggests you simply look at what you have. Do you have the people who can manage your network? Are they available 24/7? Can they manage encryption keys and the details that go along with encryption?
“If you don’t have someone you can turn to when the patches are breaking your system at 3am Wednesday after patch Tuesday, then it might be an imperative to look at the cloud,” said Rothke. “If you’re an organization that has all of that and you’re doing it well, then the imperative for the cloud may go away.”
“It’s very easy to get your data into the cloud, but the question is: how do you get it out?” asked Rothke, who highly recommends that you have an exit strategy with any cloud provider you choose. There may be a situation where the contract will end and you’ll need to know how to extract the data.
Ask where your cloud providers are storing their data. What’s behind their cloud? It could be with a major provider, or it could be with Vinny’s Cloud Services, warned Rothke.
Related Articles
How A CNAPP Can Take You From Cloud Security Novice To Native In 10 Steps
May 23, 2024Context is critical in cloud security. In a recent RSA presentation, Tenable's Shai Morag offered ten tips for end-to-end cloud infrastructure security.
Logs of Our Fathers
September 22, 2009<p>At USENIX in Anaheim, back in 2005, George Dyson treated us to a fantastic keynote speech about the early history of computing. You can catch a videotaped reprise of it <a href="http://www.ted.com/talks/lang/eng/george_dyson_at_the_birth_of_the_computer.html" target="_blank">here, on the TED site</a>. I highly recommend it - there's lots of interesting and quirky stuff. I managed to talk him into giving me a copy of his powerpoint file, and subsequently tracked him down and am re-posting this material with his permission.</p> <h3>November, 1951 </h3> <p style="TEXT-ALIGN: center"><a href="http://www.ranum.com/security/computer_security/papers/ur-syslogs/first_syslog.jpg" target="_blank"><img border="0" height="375" src="http://www.ranum.com/security/computer_security/papers/ur-syslogs/t/first_syslog.jpg" width="500" /></a> <br /><strong>Machine Log #1</strong></p>
ShmooCon 2009 - Playing Poker for Charity
February 12, 2009Tenable sponsored a booth at this year's ShmooCon and ran a Texas Hold'em table to help raise money for the Hackers for Charity organization. We raised close to $400 from conference attendees ...
CVE-2024-7593: Ivanti Virtual Traffic Manager Authentication Bypass Vulnerability
August 14, 2024Ivanti released a patch for a critical severity authentication bypass vulnerability and a warning that exploit code is publicly available
Microsoft’s August 2024 Patch Tuesday Addresses 88 CVEs
August 13, 2024Microsoft addresses 88 CVEs with seven critical vulnerabilities and 10 zero-day vulnerabilities, six of which were exploited in the wild.
Compromising Microsoft's AI Healthcare Chatbot Service
August 13, 2024Tenable Research discovered multiple privilege-escalation issues in the Azure Health Bot Service via a server-side request forgery (SSRF), which allowed researchers access to cross-tenant resources.
- Conferences