Security: Risk and Reward

Can you keep users from importing their own applications?

Andreas M. Antonopoulos — 2008-09-30T00:00:00Z

Shadow IT is all the IT that was neither planned nor approved by anyone but gets chosen, deployed and used by end users. Some see this as grass-roots deployment of cool technologies; some see it as weeds growing from any crack in the IT plan. If you don't build it, they will go find it elsewhere. And even if you build it, if it isn't adequate, comprehensive, flexible and easy to use, they will go find it elsewhere.

Privacy, security issues darken cloud computing plans

Andreas M. Antonopoulos — 2008-09-16T00:00:00Z

Enterprises are increasingly interested in cloud computing as a potential solution to capacity challenges. The idea is that if you have a virtualized data center, the cloud could potentially be an “overflow” data center where you expand capacity during periods of high demand. If the cloud can extend your data center, then you don’t need to build another one or increase the capacity of the one you have just to handle intermitted spikes in computing demand.

The challenge of securing virtualization operations

Andreas M. Antonopoulos — 2008-09-02T00:00:00Z

I have been very interested in virtualization security since early 2004 and it now seems like it has become a mainstream topic. Most of the focus however is on securing the technology of virtualization (the hypervisor) and providing virtualized security (usually as virtual appliances). My focus nowadays is more on the operational impact of virtualized infrastructure and by extension the impact on security operations. After all, security controls (technology) are essential but without operational controls (people) they are not sufficient. So what is the operational impact of virtualization?

Georgia cyberwar overblown

Andreas M. Antonopoulos — 2008-08-19T00:00:00Z

Last week Russian tanks rolled into South Ossetia while Russian bombers were taking out critical communications infrastructure. But even before the first tank rolled across the disputed borders, another war was brewing in cyberspace.

What you don't know about security can hurt you

Andreas M. Antonopoulos — 2008-08-05T00:00:00Z

In reading an early release of an information-security survey conducted by the RSA Conference, two findings caught my attention.

No excuses -- encrypt all laptops

Andreas M. Antonopoulos — 2008-07-22T00:00:00Z

No more excuses: If you're not encrypting laptops, you are not applying due diligence.

Security tribulations breed guilt by association

Andreas M. Antonopoulos — 2008-07-08T00:00:00Z

The headline read “Google loses employee data.” It caught my attention as I thought of all the implications this has for all the other data Google stores. A headline like that hits a nerve, I take it personally, because like most of us I immediately think of my search history from the last 10 years.

Communal security?

Andreas M. Antonopoulos — 2008-06-24T00:00:00Z

I’ve visited quite a few countries in Asia over the last two years. In the various airports I passed through I often saw people wearing surgical masks. I also saw “fever checkpoints” in most major airports. These checkpoints have infrared cameras that show a thermal false color picture of passengers as they are funneled through immigration. The signs surrounding the checkpoints indicated that the purpose was to identify people with a fever so as to screen for various types of flu (avian or other). This is classic perimeter control, network access control even, applied in the real world.

A question of trust and identity

Andreas M. Antonopoulos — 2008-06-10T00:00:00Z

What is the right balance between security and privacy? This is a common starting point in many policy discussions, especially in government. It’s a trick question because it presets the conversation as a balancing act between two values as if they are antithetical – they are not. In practical terms, privacy is security.

Less is more (secure)

Andreas M. Antonopoulos — 2008-05-27T00:00:00Z

Complexity is the enemy of security. Simple systems are inherently more secure than complex solutions.