Key Management in the Cloud

In my previous cloud security blogs, I mentioned the need to use key-based encryption for protecting data. Whether the data is in flight (i.e., being transmitted) or at rest (i.e., stored), it must be encrypted to ensure confidentiality, integrity and availability. Managing encryption keys can be challenging. There are different key types (symmetric vs. asymmetric), key strengths (128-bit through 2048-bit and greater), key usage (privacy, key exchange, authentication and digital signature) and key encryption algorithms (AES, 3DES, SHA-1, SHA-2, MD5, etc). Furthermore, each data end point, like storage or server, requires an integration point that also needs to be managed. For example, for storage we need an encryption integration point for each storage medium (disk, SAN, NAS or tape).

Read more

­So You Want to Buy a Cloud

Your application developers have been saying they can increase performance by moving your application to the cloud. Your boss is saying, “We should be doing some of this cloud thing I keep hearing about.” Your peers have moved at least one critical piece of information processing to a cloud services provider. Sound familiar? Today it seems everyone at every level begins or ends every conversation with the word “cloud.” So you think it might be time to buy a cloud, but where do you begin?

Read more

­Multi-Factor Authentication: When Usernames and Passwords Just Aren’t Enough

Using a username and password combination is a common, modern everyday activity. We use it to log into a desktop or laptop at work, we log into various application systems to perform business tasks or we log into Software-as-a-Service (SaaS) applications remotely. For personal endeavors we use username/password combinations for Facebook, Flickr or other social media websites. The username and password authentication is generally “good enough” for these scenarios.

Read more

Logfile Management’s Important Role in Cloud Security

How do you know if your cloud security controls are adequate? How would you know if you have a security breach in progress right now? You may have diligently planned and implemented strict security policies and mechanisms to prevent an intruder from accessing your servers and data in your cloud environment — but how can you be sure that these are sufficient, and that no security breach has occurred?

Read more

Cisco Live! Industry Trends and the Impact on the IT Professional

Wow. This year’s Cisco Live! was packed full of informative sessions, inspiring keynotes and tons of opportunities to network and collaborate with other attendees in San Diego. Settling back into reality, I’ve finally had a chance to regain feeling in my feet and reflect on what made the greatest professional impact on me. The industry keynote “IoE and the IT Mindset Shift – The Evolution of the IT Career” strongly resonated with my career in the training industry, my passion for professional development and the technology trends on the horizon.

Read more