What do you see when you gaze into the clouds?

When I was young, I would gaze up into the clouds and see white fluffy shapes against brilliant blue sky, floating gently across my sky. When I read and hear the 'cloud' ads these days, they seem to paint this same image in my mind-- just put your stuff in our cloud, and you never have to worry again.

Which is why I like this painting that hangs in my study by Howard Finster, "...a backwoods Baptist preacher inspired by the Gospel, visitations from the dead, and visions of extraterrestrial life."[1] Finster had a different way of looking at everyday things, and often provides more truth than a first glance reveals. While Finster painted this well before internet marketing types renamed their data centers as 'clouds', his view of the same clouds I looked at in the sky bears quite the similarity to what I see when I look at the current state of cloud computing.

While I love the fluffy whites and brilliant blues of today's cloud marketing hype, which include cost savings, elastic capacity, mobile leverage, and customer self-service, I see the technological equivalent of his angels and demons floating around happy and sad clouds, as well as hosts of other risks in and around that are all too real.

I love the benefits the cloud offers us all, and want to ensure we look clearly at what it takes to move our business or personal data into it, so those risks can be addressed and the benefits securely gained. Most board directors I talk with first see the fluffy side, and can't wait to gain all those advantages. Sometimes it's difficult to explain why they should integrate a cloud security plan into their transition, which lowers their costs and risks, when they don't hear or see about these risks in the airport posters. It turns out there are great new products available that can be used to establish manageable risk in the cloud, but it must be architected and planned before you throw everything up there. Advances in encryption and key management, audit-ability, constant vigilance, advanced threat detection, and more are all tools that can be brought to bear in the cloud now.

It's possible, but not automatic, to work more safely in the cloud that in your old data center!

Maybe if we all share the wisdom of Howard Finster that he saw and painted all those years ago, people will think about the true picture of the clouds today, and then take the available steps to paint their own picture.

[1] Howard Finster, Stranger from Another World: Man of Visions Now on This Earth by Howard Finster, Roger Manley (Photographer), Victor Faccinto (Photographer), Tom Patterson {no relation]

Cloud Security -- Making those words work together!

RSA Conference 2012

I'll be at this year's RSA Conference 2012, talking about the ART and SCIENCE of Security. Will you?

When it comes to accessing your information:

--Organized criminals are innovating.

--Foreign Intelligence services are innovating.

--Global terrorists are innovating.

So it's now CRITICAL that the security industry step up it's INNOVATION.

Big ideas often come from small compaines, and the people closest to the problems often come up with the best solutions, so I'm proud to join General Keith Alexander, Commander, U.S. Cyber Command on the steering committee for the:



The Security Innovation Network presents Showcase 2011 at the National Press Club

Apply to be selected as a SINET 16 that will present in front of 400 Buyers, Builders, Researchers & Investors

Call for Papers please click here June 10th deadline

Supported by the Department of Homeland Security Science & Technology Directorate



Keynote: General Keith B. Alexander, Commander, U.S. Cyber Command &Director, National Security Agency/Chief, Central Security Service

Three of the top SINET 16 automatically receive entry into ASC’s second round

October 26th (Workshop) & 27th (Showcase) 2010, Washington DC www.security-innovation.org

Tom Patterson
Tom Patterson Reviews
Cyberwar
Privacy
Security
Critical Infrastructure Protection
Mobile Security
Cloud Security
Cyber
Cloud Computing
financial services
powered by Speaker Wiki

Top-Five 2011 Security Wish List

Having been active in the security world since the 80's -- first as a user in the middle-east, then building products, services, R&D, and several roles in critical infrastructure protection-- I've lived through questionable security implementations and decisions that cost both lives and dollars, but I'm excited about the security opportunities that await us in 2011.

2010 brought us leaky cables, crazy countermeasures, fiery sheep, government-sponsored targeted attacks, organized criminals that compromised hundreds of millions of identities, and zombie armies that effect business bottom lines and Government's policy. All of this came at a great cost to commerce, citizens and civilization alike, so it is incumbent upon the professional security world to utilize the one additional thing these villains brought us-- the greatest cyber security awareness in history.

Think big, think bodacious, think important, and think possible. Move beyond password length discussions, blabbing on Facebook, and x-raying your belly bulges, and focus on what's really important in the new year. To start, I offer five from my 2011 security wish list, and encourage you to suggest your own.

My Top-Five 2011 Security Wish List


1. Public Private Partnerships that really work, which means that 'public' needs to share more, and 'private' needs to focus on the greater good, and not just selling more of their stuff. This is vital to protect critical infrastructure and key resources (CI/KR), and it is vital to protect our juiciest targets from foreign governments, organized criminals, terror groups and wannabes, and home grown bad guys.
2. A Mobile Security ecosystem that unites the vendors, rather than divides. We all now carry and cherish our mobile phones the same as we do with our credit cards (always with us, never shared, losses reported immediately), so it's time to make them work as identity tokens across the board.

3. U.S. Congressional support for comprehensive cybersecurity, rather than trying to address it bill by bill, earmark by earmark, and press release by press release. We have a cyber-czar that wants to put good security over politics, and many good folks that are returning to govern after success in the security private sector, and a strong push from Congress would serve to unite security across the board.

4. Educational shift toward real cyber security education and training. Humans are still our weakest link, and cyber-education is still the most cost-effective countermeasure. Plus, our shortage of skilled cyber security professionals is not even close to being met by our university systems and handful of professional associations. Despite what a few experts will tell you, security is not black magic, but can be trained to a wide range of people from all walks of life. This needs to be a high priority from K-12, through vocational, university, and advanced education offerings that meet the needs of today and tomorrow.

5. Purchasing agents of the world unite, to agree to no longer buy software that has not been developed in a demonstrable and testable security development lifecycle, be it in a shrink wrap box, a gold master, or a 'secure' cloud. Self-regulating sources haven’t worked, so testing in a crystal box for all to see is needed.

And this just skims the surface... There are many more, and now is the time to work together on the biggest stage we’ve ever had, to make a real difference in the safety and security of all we hold dear.

I wish you the happiest of holidays, and I’ll see you again in 2011 !

What if copying was legal?

What if it was legal to make copies of our favorite movies, tv shows, music, games, books and more?

With almost half of the total Internet usage in the U.S. being peer to peer file sharing, it’s clear that users WANT to make copies, but why?

Do they like the ease of use? Do they like ‘having’ the files on their machines? Do they like being able to make a backup copy just in case? Do they like being able to move copies between their computers, phones, and DVRs? Do they like the efficiencies that systems like BitTorrent provide? Do they want what they want when they want it? Are they just sick of the often ridiculous DRM systems they’ve been subjected to in the past?

In my experience, the answer to ALL of these questions is YES.

In fact, they like it so much, otherwise law abiding citizens will even break the law to do it. Some break it blatantly, some rationalize with “I didn’t know” or “everyone’s doing it”, but break the law they do, because they want to be able to copy and share entertainment files.

So what if instead of (lamely) prosecuting these folks that copy and share, we flip the entertainment world on its head, and reward this behavior?

We know that all the users would love it. All the benefits of sharing files, with none of the guilt! But what of the entertainment companies that create all this content?

If no one watched ads or paid, we would be reduced to skateboarding bull-dog videos (http://www.youtube.com/watch?v=hlyhq6ncGWg ) , (I had over 500 to choose from!) ), instead of professionally made movies, tv shows, music, games, books magazines, and more. All of these creative works are paid for with advertising dollars today, and will need to be paid for in the future if we expect them to continue to be produced.

So we need a system that’s as easy to use as a Google search, paid for with ads that are as innocuous as those on a Google search, and that is so inexpensive to distribute (no server farms, no fat bandwidth pipes, and no costs for customer acquisition).

Look, up in the Internet-- It’s a Bird. It’s a Plane. It’s SuperDistribution!

Superdistribution has been talked about since the early 90’s (http://www.wired.com/wired/archive/2.09/superdis.html ) but until now, no one has been able to perfect a system that allows content owners to maintain the controls they need to succeed, while leveraging the low cost, high reach, best of both worlds solution originally envisioned.

All of that changes on Tuesday, the 12th of August, 2008.

Watch this space…