Cloud Computing & Bad Behaviour

2009-11-11T13:15:56Z

I’ve just booked my hotel room in London so I can stay over after the Jonathan Coulton concert on Friday.

Extreme wheelchairing – immense

2009-10-28T12:55:45Z

This kid is amazing and an inspiration to us all, a real reminder that no matter what barriers are in your way you can push through them.

Dambusters….Star Wars Style

2009-10-23T00:03:36Z

King of understatement Ballmer: SideKick outage “not good”

2009-10-20T17:32:40Z

Microsoft CEO, whose subsidiary SideKick recently decided to update their storage components of their cloud messaging device without proper provision of backup effectively wiping their user’s devices clean, side the incident had been ‘not good’.

The good news is that he was pimping more Microsoft cloud services – wow that is some kahoonies, either that or a severely limited grip on reality.

Mac Mini Server – £799 worth of goodness

2009-10-20T17:14:52Z

I’ve long been a fan of Mac OS Server, the functionality it provides easily matches Windows Server and Exchange Server rolled into one and easily supports both Macs and PCs.

Apple’s announcement today of the Mac Mini Server, a 1 terrabyte server complete with an unlimited client license of Mac OS Leopard Server for £799 provides a very cost efficient way for small organisations to deploy a server supporting both PC and Mac clients with a Web server, mail server, calendar services, directory and much more.

One obvious thing they didn’t do was include two Ethernet ports, preventing the new Mac Mini Server being used as a firewall, which is a shame.

The drunkest man ever

2009-10-20T16:52:33Z

The title says it all…

Microsoft giving cloud computing resilience a bad name

2009-10-14T07:50:30Z

It seems that Microsoft decided to upgrade the Storage Area Network that supports the Danger platform providing the data to the SideKick smartphone…. without having any form of backup.

The architecture of the SideKick keeps all data in the cloud, the content of the phone is lost when it is powered down. When you’re planning an upgrade to a platform where absolutely nothing is stored on the phone – contacts, messages and photos – you’d think you would operate a second data centre?

T-Mobile , who operates the SideKick in the US, has already pulled sales of the SideKick in light of the outage.

Cloud custodians don’t own your data

2009-10-13T11:52:33Z

Cloud service providers need to remember the relationships that they have with their customers, we’re the custodians of our customer’s data – not the owners.

Take the recent case of an employee at the Rocky Mountain Bank sending confidential personal information about 1,800 of its customers in error to a Google Mail account – a case of the wrong attachment sent to the wrong recipient.

A customer requested that his loan statements be sent to his Google Mail account, instead the bank employee attached a document containing the names, addresses, Social Security numbers and loan details of over 1,300 customers…..to the wrong Google Mail account.

After first attempting to recall the email, then contact the recipient, the bank then contacted Google and succeeded in getting them to delete the account. Now this case raises three important questions:

Firstly,why did an employee even consider sending the original documents to the customer that requested them? Email is a clear-text protocol and sending even the loan statements is far from best practice. This is an example of how an ad-hoc procedure can go terribly terribly wrong.

Secondly, why did the bank not have a Data Leak Prevention capability in place to look for Personal Identifiable Information (PII) embedded in emails and enforce a policy preventing its transmission outside of authorised recipients – or at least to encrypt its transmission?

Thirdly, initially Google refused to provide any information on the account without a court order which Rocky Mountain Bank obtained a court order from a California judge to order to temporarily suspend the recipient’s account. This sets a terrible precedent – especially considering Google’s operation of commercial accounts. If you are the recipient of confidential information accidently sent to you – your account can be suspended.

Ride-to-the-Wall tomorrow

2009-10-09T21:48:30Z

Early tomorrow morning I’ll be travelling to Drayton Park and then, along with thousands of other bikers, onto the National Memorial Arboretum in Lichfield for the annual Ride-to-the-Wall (RTTW) to remember those who no-longer can ride by our side.

ISO 27001 in a cloud world

2009-10-06T13:00:04Z

We’re preparing to go through our ISO 27001 certification at the moment and it struck me quite how different it is to certify as a cloud service vendor rather than as a traditional company.

Excuse my over simplification of the ISO 27001 process for those not involved in it, but effectively there are four stages:

Define the organisation’s acceptable risk
Work out what risk the organisation is exposed to
Apply controls to reduce the residual risk to a level at or below the acceptable risk
Rinse, repeat

A common method is to conduct a risk assessment, perhaps using the methodology covered in ISO 27001’s sister publication ISO 27005, and then apply controls to manage the identified risks from another sister publication ISO 27002.

Now an organisation is normally free to choose whatever acceptable level of risk they feel the organisation is able to bear. Often a higher level of acceptable risk is what gives an organisation a competitive advantage, allowing them to be nimble enough to take advantages that other, more risk adverse, organisations cannot.

In a traditional vendor this level of higher risk acceptance won’t normally impact on the customer – short of a leak of customer information, a continuity incident affecting the ability to support customers or too many incidents driving the company out of business.

In a cloud vendor this is very different – the vendor’s security is your security. Rather than using the vendor’s equipment within your own environment, your data is used within the vendor’s environment and vendor’s equipment. The vendor’s approach to security needs to reflect the sensitivity of the data the cloud vendor is processing or storing on your behalf.

The good news is that we are seeing a definite acknowledgement of this in the market. When we receive RFI/RFPs from prospective customers they’ve often had the foresight to ask questions about which specific controls have been implemented rather than just asking a boilerplate question around whether we possess ISO 27001 certification.

Organisation’s such as the Cloud Security Alliance are promoting best practice within the industry, but one of the tenets I repeat again-and-again for those moving to the cloud is caveat emptor (“buyer beware”). Make sure that your due diligence includes questions about the areas of risk you’ve identified within your own business – look for alignment of controls whether your processing and storing on-premise, or outsourcing to a cloud services company.