About Me

Raj Samani

Raj Samani
VP, CTO for McAfee EMEA Raj is currently working as the VP, Chief Technical Officer for McAfee EMEA, having ...

Read More

Enterprise Blogs

Feeds & Podcasts

Meet the Bloggers

Archive

Tags

#McAfeeFOCUS, #MFETrivia, #SecChat, #SecurityLegos, 12 Scams of Christmas, 2012, 2012 Security Predictions, Acquisition, Advanced Persistent Threat, Android, android antivirus, Android Malware, Android security, android security app, anti-phishing, anti-theft, anti-virus, antivirus, APIs, App Alert, Apple, application blacklisting, application developers, application security, app protection, apps, app safety, ATM scams, attacks, authentication, automotive, Bad Apps, balanced scorecard, best practices, Big Data, Big Security Data, BlackBerry, Blackhat, Black Hat, black hat hackers, botnet, Brazil, breach, Business IT, car hacking, certification, Change Control, China, CISO Executive Summit, Citrix, class action lawsuit, cloud, Cloud city, Cloud computing, Cloud Expo, cloud security, Cofer Black, collaboration, Compliance, Conficker, consolidation, Consumer, consumerization, consumerization of IT, Content Protection, counter identity theft, credit card fraud and protection, credit card skimming, critical infrastructure, CSP, cyber attack, Cybercrime, cyberespionage, Cyber Insurance, Cyber Intelligence Sharing and Protection Act of 2011, cybersecurity, cyber security, cyber security awareness, Cyber Security Mom, cyber threat, cyberthreats, data, database activity monitoring, database security, data breach, data center, Datacenter, data center security, Data Classification, data loss, Data Protection, Dave DeWalt, Dave Marcus, dedicated security appliances, Deep Command, Deep Defender, DeepSAFE, DefCon, DefCon Kids, Department of Commerce, device, Device Control, devices, dewalt, DLP, Dmitri Alperovitch, easter, Eelectric Vehicle, Email & Web Security, Email & Web Security, embedded, embedded devices, Embedded Security, Emerging Markets, Emerging Market Security, EMM, encryption, Endpoint Protection, Endpoint Security, energy, enterprise, enterprise mobility, enterprise resource planning, enterprise scurity, enterprise security, epayment, epo, ePO Deep Command, ePolicy Orchestrator, ERP, ESM, espionage, EV, exploit, exploits, facebook, Facial recongnition, Family Safety, FDCC, file sharing, Financial Security, firewall, FISMA, Fixed Function Devices, Focus, Focus11, FOCUS 2011, forrester, Foundstone, Friday Security Highlights, Garter, Gartner, Gartner Security and Risk Management Summit, George Kurtz, Global Cybersecurity, Global SecurityAlliance Partner Summit, global threat intelligence, google, government, GTI, Hackers, hacking, Hacking Exposed, Hacktivism, HB1140, Healthcare, Heuristics, HIPAA, host intrusion prevention, Host IPS, HV, Hybrid Vehicle, ICS, IDC, identify potential cyber-threats, identity protection, identity theft, IDF 2011, Incident Response, Information leak, Information Protection, Information Security, Information Warfare, Insider Threats, Integrity, intel, intellectual property, Internet Explorer, internet security, Interop, IntruShield, In vehicle Infotainment, IP, iphone, IPS, IT, IT Security, japan earthquake safe donation, japan earthquake scams, kurtz, labs, laptops, Larry Ponemon, law, legal, legal risk, linkedin, live-tweeting, lizamoon, Lockheed Martin, mac, Mac OS X, malware, Malware research, managed security services, Management, Mariposa, mass sql injection, mastercard, Maturity Model, McAfee, McAfee Application Control, McAfee Cloud Security Platform, McAfee Data Loss Prevention, Mcafee DLP, McAfee Email Gateway 7.0, McAfee Enterprise Mobility Management, McAfee ePO, McAfee ePolicy Orchestrator, McAfee Firewall Enterprise, McAfee FOCUS, McAfee FOCUS 2011, McAfee Identity Protection, McAfee Labs, McAfee Mobile Security, McAfee MOVE AV, McAfee Network Security Platform, McAfee NSP, McAfee Policy Auditor, McAfee Risk Advisor, McAfee Security Journal, McAfee Security Management, McAfee Security Webinars, McAfee SiteAdvisor, McAfee Vulnerability Manager, McAfee Vulnerability Manager for Databases, mcafee wavesecure, Microsoft, Microsoft Security Bulletin, Mid-Market, Mobile, mobile antivirus, mobile app, mobile data communications, mobile device, mobile devices, mobile devices and security threats, mobile malware, mobile phone spyware, mobile security, mobile security app, mobile smartphone security, mobiles security, mom, MS12-020, MySQL, NACACS, near field communication, Network Perimeter Security, Network Security, Network Security; Email & Web Security; Security-as-a-Service, network security server security, new year resolution, next-gen IPS, Next Generation IPS, NFC, Night Dragon, NIST, NitroSecurity, OMB, online banking, Open Source, operational risk, Operation Aurora, Optimized, outages, OWASP, passwords, password security, patch, Patch Tuesday, Patmos, PCI, PCI Compliance, PCI DSS, Peer to Peer file sharing, perception, personal information over mobile phones, phishing, PII, Ponemon Institute, PostScript, Potentially unwanted program, power grid, power loss, Pre-detection, Printers, privacy, protection, Public-Private partnerships, Public Sector, pup, QR codes, reference architecture, regulations, reporting, reputational risk, retail, risk, Risk Advisor, Risk and Compliance, Risk Management, ROI, Rookits, Rootkits, RSA, RSA 2012, SaaS, SaaS security solutions, safe searching, Saviynt Access Manager, SCADA, scam, SCAP, SEC Guidance, SecTor, secure cloud computing, secure container, security, Security-as-a-Service, Security and Defense Agenda, security attacks, security awareness, security breach, security conferences, Security Connected, Security Connected Reference Architecture, Security Influence, security management, security metrics, security optimization, security policy, security threats, Sentrigo acquisition, Shady RAT, SharePoint, shortened URLs, SIA Partners, SIEM, SiteAdvisor, Situational Awareness, Small Business, smartphones, smartphone security, SMB, social business, social media, social networking, social networks, Software-as-a-Service, spam, Spearphishing, sql attacks, SQL Injection, State of Security, stealth attack, stealth crimeware, stealth detection, Steve Jobs, storage, Stuxnet, substation, Support, Symbian, T-Mobile, Tablet, tablets, tablet security, targeted attacks, TCO, technology development, Telecommunications, threat reduction, TJX, TPM, Trusted Computing Module, trustedsource, twitter, Twitter online security, U.S. Cyber Challenge Camps, urchin.js, Vericept DLP, ViaForensics, Virtualization, VIrtual Machines, visa, Vontu DLP, vPro, vulnerability, Vulnerability Manager, vulnerability manager for databases, Web 2.0, web protection, web security, Websense DSS, Web services, white hat hackers, Whitelisting, wikileaks, Windows 7, Windows Mobile, Wind River, Xerox, youtube, Zero-Day, zeus
Enterprise : Cloud Security :

Choosing a CSP: Confidence in Risk

Monday, May 23, 2011 at 10:59am by Raj Samani
Raj Samani

Maybe it’s just me, but I had this assumption that Cloud computing would be one of the most popular online search terms. When I found the list of top ten most searched items, I was slightly surprised to find celebrities that a) I had never heard of and b) turned out to have no involvement with the phenomenon that is cloud computing made the top of the list.

Okay, so perhaps I need a wider circle of friends and need to watch more television. However, within the technology industry, there is no doubt that the Cloud is the number one buzzword. The fundamental question though is whether the benefits will indeed be realized or whether like many of the previously heralded technologies it falls by the wayside.

A 2010 survey by Information Systems Audit and Control Association (ISACA) found that half of U.S. IT professionals who responded to the survey stated that the risks of cloud computing outweigh the benefits. Moreover, a bigger concern for many organizations will be the physical location of their data which of course may well be regulated.

Although such concerns are entirely valid, I would probably add that these concerns should be no different to hosting internal services, indeed such risks could even be managed easier with a third party such as a CSP. By ensuring that all requirements are clearly defined, and included within contracts the customer should be a in a position to ensure that risks are mitigated. Even new threats which may have not been initially considered should be fairly straightforward to mitigate, and this will invariably require an increase in the cost of the service. Compare this with the challenge of recruiting specialists, and getting them to go through the ‘Plan, Do, Check and Act’ cycle for the mitigating controls could not only prove time consuming but very costly.

So where to from here? Well, there are many concerns that are completely valid, such as the question of where data will be physically stored. Likewise, although we ASSUME that the CSP will implement the controls they are contractually obliged to, will they actually do it? The fundamental point to remember is that although you can transfer the work, you can never transfer the risk (certainly not in your customers eyes, if not in the eyes of the law). Whether your data is with a CSP or internally hosted, a data breach will still impact you and your business.

This is probably the biggest concern, whereby you are placing your customer confidence into the hands of a third party. The Cloud Security Alliance put forward their ‘quick method for evaluating your tolerance for moving an asset to various cloud computing models’, with the fourth point critical; Evaluate potential cloud service models and providers.

Here the role of certifications play a major part. Whilst cost becomes a crucial factor, it should not remain the sole requirement for determining the CSP. Indeed for the evaluation of potential providers cost should not even be in the equation. If you are unable to find a CSP that can satisfy your risk appetite for the budget you have allocated, then either increase your budget, or host internally. Both options are more attractive than using your media skills to answer difficult questions about why your customer details were made public.

-Raj Samani

Bookmark and Share

Tags: , ,

Comments are temporarily suspended due to blog maintenance, comments will be available again from Monday 21st May.