This Burton Group slide floated by on Twitter this morning. Nice illustration of who controls security. Note how the organization always participates in control of the data.
Click on Picture to enlarge.
Jake Sorofman, rPath, James Duncan, Joyent and Chet Kapoor, Sonoa Systems chat with Alistair Croll on the futures of cloud. These companies offer software, products that are adjacent to, or run on, the cloud. They are not cloud operators.
This evening, we are at Cloud Camp. For background, check out this interview with Cloud Camp co-founder Dave Nielsen. Dave is also our host today.
The lightening rounds are done. For insights, search on twitter with either of these tags: #cloudcamp #cloudcampinterop
Now, Dave is building an un-panel session. He started with 5 empty chairs and no questions. Filled the chairs with folks who raised hands to “Folks that know a lot about cloud computing”. No one admitted expertise. Now, he’s asking the audience to build a list of 10 questions.
Session abstract:
“You are on cloud 9. You are ready to go lights-on in your new virtual data center. But wait: virtualization changes everything when it comes to security. Some gaps are obvious, such as the elimination of separation of duties, or the lack of visibility into the virtual network. Some issues are more subtle, such as temporal attacks against crypto. This talk will describe what gaps are introduced in the move from physical to virtual specifically where security is concerned, and prescribe specific steps to ensure security and compliance for production deployments.
Specific topics to be covered include:
• Recommend strategies for updating in-house security and compliance best-practices guides to incorporate and protect virtual infrastructure.
• An analysis of the new virtualization threat surface and what new policies should be introduced to prevent, detect and control risks and violations.
• Configuration of the virtual network for security and visibility, even over Vmotion and over VMware port groups.
• Enforcement of separation of duties, least privilege and change management in the virtual data center (currently not part of most virtualization platforms).
• Examination of the risks of VM Sprawl and establishment of programs and policies for managing this risk.
• How you can guarantee your cloud implementation is even more secure than your pre-cloud analogue.”
Michael Berman is CTO of Catbird Networks, a provider of security virtualization solutions to cloud computing operators.
