IBM Takes Action to Improve Cloud Security

IBM unveiled a new security initiative focused on making cloud computing safer. IBM aims to help both users and providers of cloud computing more easily navigate security challenges through new cloud security planning and assessment services, managed services to help clients secure their clouds, and the introduction of several technology innovations from its global research labs.

According to IBM's Institute for Business Value 2010 Global IT Risk Study, cloud computing raised serious concerns among respondents about the use, access and control of data: 77 percent of respondents believe that adopting cloud computing makes protecting privacy more difficult; 50 percent are concerned about a data breach or loss; and 23 percent indicate that weakening of corporate network security is a concern. As the study illustrates, businesses see the promise of the cloud model, but security remains an inhibitor to adoption.

While an information technology foundation pertains to all cloud computing, providers and users do not generally rely on one generic model for data security. Both cloud providers and users should consider a variety of factors, including the kind of work a client wants to do in the cloud and the mechanisms and controls used. For example, clients who have collaboration tools and email work in the cloud should think about access and policy controls, while clients focused on healthcare in the cloud should be concerned with data isolation and encryption.

To help meet these specific needs, IBM's cloud security experts work closely with clients to address their individual concerns and provide the appropriate services and offerings. This process includes evaluations of the security positioning of planned or existing cloud implementations as well as recommendations for various security strategies.

"IBM understands the 'one size fits all' cloud security strategy will not work for most businesses," said Steve Robinson, general manager, IBM Security Solutions. "Our enterprise clients are looking for a trusted advisor to provide the right mix of security consulting services and offerings to match. By offering these new services and innovations, we aim to help clients create tailored solutions that will allow them to get the most out of their cloud environments."

Additionally, IBM has a team of security professionals around the world and holds a number of security and risk management patents, which can be used to help clients solve their toughest cloud problems. As the cloud computing model evolves with the changing needs of a client's business, IBM researchers are designing new technologies to ensure the integrity of data in the cloud regardless of the business or industry scenario.

New IBM Cloud Security Infrastructure and Services

IBM is using its expertise to outline a two-pronged approach for clients seeking to dramatically improve cloud security:

1. Plan and Assess the Security Strategy for the Cloud 

    * IBM Cloud Security Strategy Roadmap – For clients who are embarking on a cloud strategy as either a provider or subscriber, the new roadmap is designed to help organizations understand, establish and outline the steps for realizing their security goals in relation to their cloud computing strategy. IBM security experts conduct an onsite working session with clients to help define the cloud computing initiative and goals, identify associated security and privacy concerns, determine appropriate vulnerability mitigation strategies and develop a high-level security strategy roadmap designed to achieve their cloud security objectives.
    * IBM Cloud Security Assessment – For clients with cloud infrastructure in place or planning their cloud environment, the new assessment is designed to help provide an in-depth understanding of the current state of a current or planned cloud solution's security controls, mechanisms and architecture. IBM assessment professionals help compare the cloud solution's security program against industry best practices and the client's own cloud security objectives, then identifies steps to help improve the overall security environment.
    * IBM Application Security Services for Cloud – The new offering allows CIOs to have a clear picture of how and where sensitive data will circulate in a cloud environment. It assesses current or proposed cloud application environments to help ensure that the appropriate information, security, and privacy controls are in place for a client's specific business requirements. By identifying and prioritizing cloud-specific security vulnerabilities, internally and within their service providers, the offering can help clients determine the right balance of internal control and service provider autonomy required to maintain efficiency and service level requirements before implementing the solution.

2. Obtain Security Services from the Cloud

    * IBM Managed Security Services Hosted Security Event and Log Management – This enhanced offering is a cloud-based solution for security incident and event management  that consolidates the security event and log data of operating systems, applications and infrastructure equipment, providing a seamless platform from which to assess and respond to real-time and historical traffic. It dramatically improves the speed of security investigations and compliance initiatives, offering the full life cycle of security information and event management, and provides options to outsource these tasks to security experts located in IBM's worldwide Security Operation Centers.
    * IBM Managed Security Services Hosted Vulnerability Management – This enhanced cloud-based scanning service helps companies to identify vulnerabilities across network devices, servers, web applications and databases to help manage concerns and reduce the cost of security operations. This service is available to companies of all sizes who want to quickly and more easily address compliance mandates.

"We needed a remote scanning solution that can help us identify critical vulnerabilities throughout our infrastructure and assist us in meeting external audit requirements," said Henrique Matiole, IT supervisor, ArcelorMittal Sistemas S.A. of Brazil. "The enhanced hosted vulnerability management scanning solution carries advanced scanning capabilities for complicated security challenges and provides strong reporting capabilities through a web-based portal that helps us easily satisfy our audit requirements."

Top Security Experts Develop Next Generation of Solutions to Secure Cloud

Researchers at the IBM Watson and Zurich research labs are working on a variety of projects that examine new ways to bolster cloud security by enabling enhanced data integrity, recovery, privacy, and customer isolation in a public cloud environment.

For example, IBM researchers have developed mechanisms that enhance cloud security by providing "infrastructure hardening," or stronger isolation between different workloads. These mechanisms verify the integrity and correct configuration of infrastructure components such as hypervisors to help prevent low-level attacks such as spoofing, or deceiving computer systems or other computer users by hiding or imitating an Internet identity. IBM recently added some of these security capabilities to the IBM Smart Business Test and Development cloud. Some of these security mechanisms are also currently offered in the IBM Systems Director VMControl™.

Another example of IBM's ability to rapidly take advantage of new cloud security techniques pioneered by its researchers is the integration of "introspection monitoring" into the IBM Security Virtual Server Protection for VMware offering. This capability enables a kind of "virtual doorman," in the cloud environment, which detects potential malware attacks from outside the virtual machine and scans the operating systems inside to confirm they are running properly. The capability will then determine whether or not they contain malicious code, such as root-kits, which are software programs designed to provide a user with administrator access to a computer without being detected. This level of security isn't available from conventional introspection solutions that can only communicate and check inside the virtual machine.

IBM's Institute for Business Value 2010 Global IT Risk Study

IBM's Institute for Business Value 2010 Global IT Risk Study was commissioned to understand how information technology (IT) managers are working to mitigate risk.  Core objectives of the study included evaluating the manner in which innovations like cloud and mobile computing are influencing overall IT risk strategies and exploring how the role of the IT Manager is changing in relation to these innovations.  The survey included 556 respondents from all geographies, representing companies with revenues of less than $500M to more than $10B.  Respondents worked across a diverse set of industries and sectors including finance, healthcare, biotechnology, manufacturing, government and information technology services.

For more information on the IBM 2010 Global IT Risk Study please see:  www.ibm.com/services/riskstudy.

Featured

  • 12 Commercial Crime Sites to Do Your Research

    12 Commercial Crime Sites to Do Your Research

    Understanding crime statistics in your industry and area is crucial for making important decisions about your security budget. With so much information out there, how can you know which statistics to trust? Read Now

  • Boosting Safety and Efficiency

    Boosting Safety and Efficiency

    In alignment with the state of Mississippi’s mission of “Empowering Mississippi citizens to stay connected and engaged with their government,” Salient's CompleteView VMS is being installed throughout more than 150 state boards, commissions and agencies in order to ensure safety for thousands of constituents who access state services daily. Read Now

  • Live From GSX: Post-Show Review

    Live From GSX: Post-Show Review

    This year’s Live From GSX program was a rousing success! Again, we’d like to thank our partners, and IPVideo, for working with us and letting us broadcast their solutions to the industry. You can follow our Live From GSX 2023 page to keep up with post-show developments and announcements. And if you’re interested in working with us in 2024, please don’t hesitate to ask about our Live From programs for ISC West in March or next year’s GSX. Read Now

    • Industry Events
    • GSX
  • People Say the Funniest Things

    People Say the Funniest Things

    By all accounts, GSX version 2023 was completely successful. Apparently, there were plenty of mix-ups with the airlines and getting aircraft from the East Coast into Big D. I am all ears when I am in a gathering of people. You never know when a nugget of information might flip out. Read Now

    • Industry Events
    • GSX

Featured Cybersecurity

Webinars

New Products

  • XS4 Original+

    XS4 Original+

    The SALTO XS4 Original+ design is based on the same proven housing and mechanical mechanisms of the XS4 Original. The XS4 Original+, however, is embedded with SALTO’s BLUEnet real-time functionality and SVN-Flex capability that enables SALTO stand-alone smart XS4 Original+ locks to update user credentials directly at the door. Compatible with the array of SALTO platform solutions including SALTO Space data-on-card, SALTO KS Keys as a Service cloud-based access solution, and SALTO’s JustIn Mobile technology for digital keys. The XS4 Original+ also includes RFID Mifare DESFire, Bluetooth LE and NFC technology functionality. 3

  • Camden CV-7600 High Security Card Readers

    Camden CV-7600 High Security Card Readers

    Camden Door Controls has relaunched its CV-7600 card readers in response to growing market demand for a more secure alternative to standard proximity credentials that can be easily cloned. CV-7600 readers support MIFARE DESFire EV1 & EV2 encryption technology credentials, making them virtually clone-proof and highly secure. 3

  • HD2055 Modular Barricade

    Delta Scientific’s electric HD2055 modular shallow foundation barricade is tested to ASTM M50/P1 with negative penetration from the vehicle upon impact. With a shallow foundation of only 24 inches, the HD2055 can be installed without worrying about buried power lines and other below grade obstructions. The modular make-up of the barrier also allows you to cover wider roadways by adding additional modules to the system. The HD2055 boasts an Emergency Fast Operation of 1.5 seconds giving the guard ample time to deploy under a high threat situation. 3