Nsauditor Network Security Auditor - Advanced All-In-One Network Tools Suite!
  Recommended Product
Network Security Audit Software
Network Security Audit Software and Computer Security Tools
Download Learn More
Nsauditor Screencast
 
 
  Network Security Software
Network Bandwidth Monitor Network Bandwidth Monitor
NBMonitor tracks Internet bandwidth usage (upload and downloads) and shows process names initiated network connections...
Network Hardware Inventory Software Network Hardware Inventory Software
Nsasoft Hardware Software Inventory is a powerful network inventory software for home, office and enterprise networks...
BlueAuditor Monitors Mobile Devices in Wireless Network BlueAuditor Monitors Mobile Devices in Wireless Network
BlueAuditor is a wireless personal area network auditor and easy-to-use program for detecting and monitoring mobile devices in a wireless network...
Network Access Monitoring Network Access Monitoring
ShareAlarmPro allows easily perform network shares and folder monitoring, block unwanted users attempting to access secured shares...
Network Shares Monitoring Network Share Watcher
Monitors network folders permissions and identify shares which are violating company data access policy...
NetworkSleuth Network File Search Utili NetworkSleuth Network File Search Utiliy
NetworkSleuth is a network file searching utility, that allows you to quickly locate files across a network....
Product Key Finder Product Key Finder
Product Key Explorer enables you to quickly recover over 3000 popular software product keys from network computers...
Backup Key Recovery Crashed Drive Keys Recovery Backup Key Recovery Crashed Drive Keys Recovery
Backup Key Recovery retrieves product keys for Windows, MS Office, SQL Server, Adobe products and more than 2500 popular software products...
 
 

Network Security News

Cloud security registry slow to catch on

Mar 21 , 2012 | ITNews.com

Last August the Cloud Security Alliance (CSA) announced at the Black Hat security conference in Las Vegas a registry that it hoped would serve as a place for prospective cloud users to go to easily inspect and compare cloud vendors' security controls. But to date, only three companies have submitted their cloud security data, making the registry of limited use.

The Security, Trust and Assurance Registry (STAR) is designed to index the security features of cloud providers using a 170-point questionnaire that end users are then able to peruse. Soon after the CSA announced STAR, big names such as Google, Intel, McAfee, Verizon and Microsoft all agreed to take part. So far though, Microsoft is the only one of that group to have followed through.

Kyle Hilgendorf, a Gartner analyst who tracks the cloud industry, is disappointed more providers have not signed up for the registry. It has the potential to provide valuable insight for end users, but only if there is a critical mass of companies in the registry, he says.

If you only have three, four or five providers, that doesn't add a whole lot of perspective on the entire market," Hilgendorf says.

CSA Executive Director Jim Reavis remains bullish on the program and says by the end of the year he expects the registry to be more complete. Several providers, he says, are in the late stages of making submissions to the registry. "Everything starts from scratch," he says.

One issue that could be holding back adoption is what information providers are willing and able to disclose. Jon Heimerl is director of security strategies at Solutionary, a managed security services provider, and one of three companies that has submitted to STAR. Mimecast, a cloud-based e-mail optimization and security service, is the third.

When filling out Solutionary's submission Heimerl says there was a fine line that had to be drawn between how much meaningful information can be divulged without creating a security risk.

"We made our best effort to answer the questions as clearly as possible without revealing too much of the secret sauce of our security protocols," he says. One way Solutionary did that is by giving general answers to some questions and encouraged interested customers to contact them if they need additional information.

For example, Heimerl says when answering a question about encryption of information, the company answered that it uses a 256-byte encryption code and device hardening methods. It did not, however, divulge exactly what those device hardening methods are.

STAR organizers say the registry is meant to be a high-level overview of cloud security practices from vendors, not to divulge information that could compromise a provider's network or consumer's data.

"The information we ask for is not to the level of detail that would create a security risk," Reavis says. Still, he admits there is a process providers must go through to balance what security information they make public. Reavis says any cloud provider has the information STAR asks for -- the question is how they choose to publicize it.

Another reason some providers may be holding back from participating in STAR, Hilgendorf says, is because they already release much of this information in different formats. Amazon Web Services, Google and others have sections of their websites dedicated to security controls. Some providers, Hilgendorf says, could be weighing the value of submitting information to the CSA's registry if the information is already made available elsewhere. There are also other security certification standards, such as the International Organization of Standards (ISO) compliance, Payment Card Industry (PCI) compliance and the Federal Information Security Management Act certification (FISMA). If an organization is already FISMA compliant, Hilgendorf wonders if they would also feel a need to register with the CSA.

Reavis says the questionnaire is loosely based on some of those certifications and asks for some of the same type of information.

Hilgendorf says it's useful information for customers. The questionnaire, which can be downloaded from the CSA's website, asks providers to answer 170 yes or no questions, and leaves space for additional comments. Topics range from compliances and certifications the providers have received, to how customer data is stored in the cloud. Other questions pertain to whether customers can access audit information of providers, and what types of audits and vulnerability tests are conducted by the provider. There are questions about how data is segmented to ensure information from multiple customers is not mixed together and there are questions about physical security of the data centers, for example. These are important questions that customers either ask, or should be asking to service providers, Hilgendorf says.

For providers, it's a way for them to prove they are serious about security, says Orlando Scott-Cowley, product marketing manager at Mimecast, one of the three companies that has submitted a STAR entry.

"Anyone can claim they're a cloud provider, but to actually make your controls available and open through this registry was important to us," he says. "We're not giving away anything proprietary about how the data is protected, but it does show to customers that we're open to talking about this."

Hilgendorf expects perhaps the registry may turn into a spot for small and mid-size providers to showcase their security controls as a way to differentiate themselves in the market. But, he says, the registry would gain true value if some of the CSA's other 130 members participate.

View more news...

 
  Most Popular Articles
 
 
  Email Subscriptions
Enter Your Email to be Notified of Software Updates:

 
 
  Popular Searches
network security magazine network security auditor network security news network security software corporate network security network security systems home network security product key finder password recovery software Network Bandwidth Monitor Network Access Monitoring data access policy monitoring remote shutdown Network File Search key recovery Network Monitoring Computer Security Ethical Hacking Network Security Network Inventory Software Information Security
 
 
  Partner Sites
Network Security Auditor
Nsauditor is a complete networking utilities package that includes more than 45 network tools and utilities for network auditing, scanning,network connections monitoring and more. For more information, please visit:
www.nsauditor.com


Password Recovery Software
SpotAuditor is All-in-one password recovery program that offers administrators and users a comprehensive solution for recovering passwords and other critical business information saved in users' computers. For more information, please visit:
www.password-recovery-software.com

Product Key Explorer
Product Key Explorer quickly recovers and displays product key, including Windows 7 keys, Windows Vista key, Windows XP product key, Microsoft Office 7 product key, MS office 2010 key, Adobe Photoshop, Adobe CS5, CS4, CS3, SQL Server, Electronic Arts games and more than 3000 popular software products:
www.product-key-explorer.com/