Cloud providers must address threats against their own infrastructure and remain vigilant over cybercriminals who are fraudulently using their platform to conduct malicious activities, according to a cloud computing expert who is overseeing Dimension Data’s global cloud operations.

Account fraud, account hijacking and configuration weaknesses combine to create myriad problems that cloud providers have to address, said John Rowell, formerly chief technology officer at cloud provider OpSource, who now leads global research and development, and service operations in Dimension Data’s Cloud Solutions Business Unit. The threats pose a serious impact to the cloud provider and also contribute to attacks conducted globally, Rowell said.

In this video interview, Rowell explains that attackers use stolen credit cards to set up fraudulent accounts and launch attacks using the cloud infrastructure. Attackers can set up a command and control server to send orders to a botnet or use the cloud platform’s computing power to conduct distributed Denial-of-Service attacks, he said. Cybercriminals also can leverage existing configuration weaknesses to steal data from legitimate users of the cloud platform.

PUBLISHED MAY 23, 2013

Article source: http://www.pheedcontent.com/click.phdo?i=fab9baac5b9cee8f0a250ba359f1494b

FedRAMP is a U.S. government-wide program providing a standardized approach for the assessment of security, authorization and continuous monitoring of cloud products and services. Although the newly awarded AWS “Authority to Operate” comes from the Department of Health and Human Services, the designation is expected to have far-reaching effects for the company’s government contracts, in general, and particularly those that involve the storage and processing of sensitive government data.

“Amazon has been working with various government agencies, including the GSA [General Services Administration], for a long time,” said Max Peterson, director of partners, capture and contracts at AWS. “The Department of Health and Human Services, working with GSA and the FedRAMP program, has certified that AWS is compliant with all of FedRAMP controls, which helps HHS and other agencies move to the cloud in a fast and secure fashion.”

[Related: Cloud Gaining Traction In Government, Education Markets]

Peterson went on to explain that the standard adds additional parameters to the NIST 800.53 standard, which is a basic foundation for most cloud security standards. Applicants need to go through extensive testing in order to ensure they meet those standards and demonstrate a plan for continuously monitoring and ongoing data security.

“This can now be leveraged by other agencies that want to do move to the cloud,” he added. “All the basic security information for Amazon has now been tested, validated and filed with the government. A lot of our partners are working with federal agencies to migrate applications to the cloud, and they’ll be able to leverage the same compliance and package to be able to help agencies speed up their adoption of the cloud.”

AWS claims a substantial federal client list with more than 300 agencies, including the U.S. Navy, the U.S. Department of the Treasury and NASA, as well as the HHS.

“This certainly gives AWS a stronger opportunity to do managed services for the government, particularly in situations where there is sensitive data involved,” said Dave Gilden senior vice president at Tampa, Fla.-based Fishnet Security. “It’s a pretty intense process to get the third-party validation, so they have overcome a major hurdle to doing business with federal agencies.”

PUBLISHED MAY 22, 2013

Article source: http://www.pheedcontent.com/click.phdo?i=a11c21ffb302a820b2c03fbe86428d44

Claiming that governments have not kept pace with the mobile revolution, the company’s four new solutions are intended to tighten integration with partners, accelerate projects and generally improve the level of connection between the government and its citizens, using virtually any mobile device.

“Governments are typically saddled with legacy software that is not mobile, so there is a chasm between the mobile solutions that citizens insist upon and the mobile solutions that government can offer,” said Dan Burton, senior vice president of government transformation at Salesforce. “We will work with our partners to deploy the solution. We work with some large integrators, but we also work with a lot of smaller government partners who are hungry, lean, social, agile and quick to respond.”

[Related: Cloud Gaining Traction In Government, Education Markets]

The firs service, “Rapid Response 311,” which is based on the Salesforce Service Cloud Offering, allows agencies to access data over the phone, email, Web and social media. The system can also run a query through a knowledge base that helps determine the appropriate response as well as function as a mechanism for collaboration with other agencies.

“Mobile Communities for Government” helps agencies create their own social communities to connect with other governmental organizations and business partners. Like most social networking tools, the platform supports the development of profiles, news feeds and trending topics.

The “Government Social Command Center” is based on the Salesforce Marketing Cloud and intended to deliver monitoring capabilities that can connect with citizens via social networks, websites or mobile devices.

“Platform Mobile Services for Government” is designed to help IT professionals and channel partners develop and deploy various applications that can be delivered across mobile devices.

“This is really an epic transformation for government, providing the opportunity to become a connected agency that connects with citizens, employees [and] partners in a whole new way, leveraging cloud and mobile devices,” added Burton. “It’s across social media, it’s across one-on-one service requests, it’s across communities with security, and it’s across platforms that enable government to build custom mobile apps to create a whole new generation of services for their citizens.”

Salesforce.com claims a governmental customer list of more than 500 agencies at the federal, state and local levels, including the U.S. Census Bureau, the Food and Drug Administration, and the City and County of San Francisco.

“I think the most important piece is the access to information,” said Bob Capuano, director of federal customer solutions for Deloitte Consulting of Rosslyn, Va. “These types of capabilities are already present in the private sector, and we need to equip our government agencies with the same kinds of technologies. We’re seeing the demand for this across the federal space, and there has been a lot of movement in this direction.”

Deloitte on Wednesday also announced that its Federal Innovation Center, also located in Rosslyn, Va., will now demonstrate a variety of Salesforce offerings for the government sector.

“It’s a highly visual and interactive lab that enables us to bring in our clients and show them prototypes and demos of the types of solutions that can help them transform their business,” said Capuano. “So we’re making an investment to expand that capability and to showcase Salesforce capabilities to our government customers.”

PUBLISHED MAY 22, 2013

Article source: http://www.pheedcontent.com/click.phdo?i=36005d088be6e28532caa9c92c94cc7a

The new offering is an infrastructure-as-a-service (IaaS) cloud, built on VMware’s vSphere and designed to extend the company’s virtualization software into the public cloud. In other words, customers will be able to use VMware’s virtualization and software-defined data center technologies for both on- and off-premise environments.

“This is a great milestone for VMware,” said VMware CEO Pat Gelsinger. “Our vision is to radically simplify IT again and again and again.”

[Related: VMware's vCloud Hybrid Service: Key Issues For Partners]

Gelsinger said he believes the vCloud Hybrid Service will help bridge line of business with traditional IT operations and give customers the ability to quickly deploy applications and take advantage of flexible cloud services. While VMware executives didn’t name cloud rivals Amazon or Microsoft, they did reference competing cloud offerings during the presentation.

A big selling point for vCloud Hybrid, according to VMware, is the service’s application neutrality. Bill Fathers, senior vice president and general manager of VMware’s Hybrid Cloud Services Business Unit, said vCloud Hybrid will allow customers to deploy applications into the cloud without any testing or alternations, which is where hidden costs often lurk with other competing cloud services.

“This is a great platform for all your existing apps,” Fathers said. “VCloud Hybrid is also an ideal platform for developing new applications.”

In addition, the vCloud Hybrid service will give customers the ability to use virtual networking to securely extend existing Layer 2 or Layer 3 networks from their data center to the cloud. The service also offers automated replication and monitoring for mission-critical applications.

VMware said vCloud Hybrid Service will be delivered by channel partners and be compatible with other VMware-based cloud services. Solution providers will be able to sell the service the same way as on-premise VMware software and manage the billing relationship with customers. VMware also said cloud service providers will be able to deploy additional cloud services to vCloud Hybrid deployments.

“Overall, we see this as the most partner-friendly public cloud,” Fathers said.

Partners cheered the vCloud Hybrid Service announcement. “There is a ton of potential in the VMware Hybrid Cloud,” said Keith Norbie, principal for Norbie Enterprises, a Minneapolis, Minn. technology consulting firm. “It’s all in their ability to execute. The vast majority of the channel doesn’t want to build their own public cloud. What the channel wants to do is build service delivery and leverage cloud economies of scale with a common platform to plug into private and public clouds. Think of how many folks love VMware and are looking for an option that doesn’t trap them into a closed cloud architecture model.”

Ed McNamara, director of marketing at VMware partner SHI International in Somerset, N.J., said vCloud Hybrid’s ability to get existing applications into the cloud without having write new code is a key benefit. “It’s very much aligned with what are customers are telling us they’re looking for,” McNamara said. “Businesses don’t want to have to duplicate efforts to take advantage of the cloud.”

The vCloud Hybrid Service will be offered in two subscription models. The vCloud Hybrid Virtual Private Cloud is a multitenant compute resource model with dedicated allocations for customers and will be sold on a monthly term with pricing starting at 4.5 cents an hour for a 1-GB virtual machine with 1 processor.

The second option is the vCloud Hybrid Service Dedicated Cloud, which will provide physically isolated and reserved compute resources and will be sold on an annual basis starting at 13 cents an hour for a 1-GB virtual machine with one processor.

VMware vCloud Hybrid Service will have an “early access” program for customers starting in June, with general availability in North America in the third quarter. The service is expected to launch in Asia and the EMEA region in 2014.

PUBLISHED MAY 21, 2013

Article source: http://www.pheedcontent.com/click.phdo?i=08bd978c9ef3d87d754f93154483fc8b

Cloudant offers a distributed database as a service and currently partners with Rackspace, which provides part of the hosting service on which Cloudant’s DBaaS runs; the company also partners with Softlayer, Joyent, Microsoft Azure and Amazon Web Services for hosting. Cloudant also competes with Amazon Database Services.

Devonshire Investors and Toba Capital also contributed to the round of funding. Cloudant’s previous investors Avalon Ventures, In-Q-Tel and Samsung Venture Investment Corp. also purchased additional shares of the company.

Cloudant’s NoSQL database service runs on top of cloud hosting services from partners like Rackspace and lets businesses store, access and analyze data in the cloud; Cloudant provisions the clusters and handles the system monitoring and management, freeing up clients to focus on their applications and data.

Tom O’Connell, vice president of sales and field operations at Cloudant, said his company is benefiting from the growth of mobile applications and businesses’ desire to offload management of back-end IT operations.

“Our value proposition is for the client to focus on the front-end development and APIs where they’re an expert, and let us manage the back end where we are an expert,” he said. “We’re in a perfect storm of companies wanting to build mobile apps or move existing applications to mobile devices.”

While Cloudant has other hosting partners, O’Connell said Rackspace has shown the most interest in going to market with Cloudant’s DBaaS. In addition to working with hosting partners and application platform vendors like Heroku and AppHarbor, Cloudant is looking to add more solution provider partners on the application development and mobile solutions side.

“There’s a big opportunity in the channel,” O’Connell said. “We want to work with more systems integrators because a lot of our clients are contracting out the mobile app development and management to them.”

Cloudant, which was launched in 2008 by three M.I.T. physicists, plans to extend its geographic reach outside the U.S. and U.K., where it recently opened a new office. “We’re going to spend some of the funding on expanding outside of North America and into Asia,” O’Connell said. “There’s a huge opportunity in Asia, and plus we have an existing relationship with Samsung on the investment side.”

O’Connell said Cloudant will also use the funding to further develop its DBaaS offering and add more geospatial features.

PUBLISHED MAY 20, 2013

Article source: http://www.pheedcontent.com/click.phdo?i=ffd3d35f7120b41024c73db150eb5c9a

VMware Tuesday will take the wraps off of its long-awaited hybrid cloud strategy in a move that is likely to amp-up competition with Amazon Web Services and a host of other competitors in the market.

Although many of the details remain undisclosed in advance of the formal rollout, comments VMware executives made at an investor conference in March disclosed that the “vCloud Hybrid Service” will include will include the company’s own public cloud infrastructure as a service (IaaS) as part of the overall value proposition.

According to a May 13 blog post by Matthew Lodge, senior director of cloud services at VMware, public cloud tends to “uncompromisingly assume you can make all your application and systems fit their way of working in production.” Lodge therefore claims that VMware intends to pursue “a new approach … that starts inside your data center and extends out to support all applications — both the new ‘born in the cloud’ application and your existing systems. We believe the hybrid cloud should allow you to seamlessly extend your data center to the public cloud leveraging the same infrastructure, same network, same management and skills.”

[Related: Cloud Gaining Traction In Government, Education]

Lodge goes on to explain that both the company’s software-defined data center strategy and the VMware ecosystem including service providers, systems integrators, ISVs and channel partners, are central to the initiative.

As of Monday afternoon, channel partners familiar with the forthcoming strategy signed nondisclosure agreements and were unable to discuss the details. Among them is Bill McCarthy, senior vice president of managed cloud solutions at Insight of Tempe, Ariz., who also consulted on some of the language that is being used in the contracts.

“This is a good fit, and I believe the marketplace needs this offering,” McCarthy told CRN. “Based on our early discussions over the last 90 days, it’s going to complement what VMware is already doing, and it’s going to give customers another opportunity to deal with the publisher directly.”

McCarthy declined to elaborate on his statement due to NDA.

“I personally would not say that it’s a game changer, but I do think that it’s a needed solution,” he said. “If I’m already selling VMware, why wouldn’t I want to sell infrastructure as a service, as well?”

McCarthy added that use cases and test cases have already been operating with a handful of customers, and he suspects that information on those cases may be shared at the launch.

NEXT: More Communication, Please

1

|

2

|

Next

Article source: http://www.pheedcontent.com/click.phdo?i=4e0010f874b044fc5b045f6a6255be9c

The potential for reduced costs is causing cloud computing to gain momentum in the government and education space.

“I’m seeing SaaS offerings growing rapidly, driven by the education software developers seeing an opportunity to gain new customers,” said Jay Kirby, vice president of networking at Lumenate, Inc., a Dallas-based channel partner. “We’re also seeing many of our clients re-architecting their infrastructure to take advantage of SaaS and cloud-type offerings. It’s largely about speed of deployment and flexibility in getting to applications.”

But many of the same issues that inhibit cloud issues in the business community also impact government and education. Most notably, prospects express concerns about security and availability, especially when the infrastructure is carrying sensitive personal information. Therefore, assessing the relative sensitivity of the respective agency is often one of the first steps in the sales cycle.

[Related: 8 Tips For Successful Cloud Migrations]

“What we’re seeing is pockets of departments that are not guided by as many compliance regulations taking advantage of the cloud as fast as they can,” said Kirby. “We are seeing the same thing with managed services in that space. It costs them too much money to continually build out these networks and to operate them, so they are looking for new ways to gain efficiencies. It’s happening in education, and it’s happening in government.”

To that end, most of the major players in the infrastructure-as-a-service (IaaS) space, including Amazon Web Services, Google, HP and Microsoft are actively marketing their government cloud practices. Amazon lists NASA’s Jet Propulsion Laboratory, the Recovery Accountability Transparency Board and the National Renewable Energy Laboratory among its cloud clients.

Channel partners, such as Lumenate, have also extended such strategies.

“This is a monstrous opportunity for the channel, so we created a dedicated sales team,” added Kirby. “We found some talented individuals who are working at the CIO/director level in K-12, as well as some talented account managers who have been in that space for 10 or 15 years, and this has been really effective. The priorities and processes are different, and the sales cycles are typically longer than commercial or enterprise sales. A lot of times, very large projects can take more time to roll out because of the funding mechanisms. The consulting aspect is not only based on cool technology but also on guidance and mentorship in applying that technology in the right way.”

NEXT: Show Me The Money

1

|

2

|

Next

Article source: http://www.pheedcontent.com/click.phdo?i=1ef6e63df79ae034f6e10b0515e78dc5

Attacker access to cloud-computing platforms has become an epidemic and may need a global consortium to better educate cloud providers and help reduce the problem, according to a cloud expert who leads Dimension Data’s global cloud initiatives.

Account fraud, account hijacking and the use of stolen credentials to gain criminal access to cloud-computing resources has been a longstanding issue, which is becoming a serious problem that impacts all cloud providers, said John Rowell, formerly chief technology officer at cloud provider OpSource, who now leads global research and development, and service operations in Dimension Data’s Cloud Solutions Business Unit. Rowell said his firm works constantly to weed out fraudulent accounts and address the issue, but other providers may lack the desire or the wherewithal to deal with the problem.

“It’s something the industry, in general as a group, and especially cloud providers, need to come together and start to talk about,” Rowell told CRN. “We are giving these end users — if you are not careful and not policing your fraudulent accounts and policing who is signing up for your systems — we are giving them the platform to launch their attacks.”

[Related: Dimension Data CEO Lays Out $12 Billion Plan]

The 2013 Verizon Data Breach Investigations Report found configuration weaknesses, software vulnerabilities and stolen account credentials consistently being used by attackers across the board. Financially motivated cybercriminal gangs that conduct smash-and-grab attacks to steal credit cards; hacktivists out to disrupt and embarrass businesses; and nation-state-driven attackers who steal intellectual property use stolen credentials, and often leverage the resources of cloud-hosting providers to direct their attack campaigns and upload and temporarily store stolen data.

“It’s a real problem that is only going to get worse,” Rowell said. “Cloud computing has enabled these guys to launch significant attacks with not much investment.”

In this interview with CRN, Rowell addresses the impact that distributed denial of service attacks are having on the industry; he explains why cybercrime is driving Dimension Data to roll out two-factor authentication support globally and talks about how global expansion into emerging markets has made network availability a constant problem.

CRN: Denial of service attacks have gotten a lot of attention in recent months. Has that had a major impact on cloud providers? Do you consider it a serious threat?
John Rowell: It’s a serious threat. It’s a very common occurrence. It is typically easy for guys that want to launch a DDoS attack just by acquiring a stolen credit card. They can acquire DDoS or services online or acquire it by creating their own servers. There’s a high frequency of attacks. On our platform, we’ve seen attacks that have gone up to 80 to 90 gigabytes, and they are impressive attacks. They are very large attacks that come across the infrastructure. We have a set of tools that we not only consume from third parties, but we have also built ourselves to go out and deal with that. It’s something the industry, in general as a group, and especially cloud providers, need to come together and start to talk about. We are giving these end users — if you are not careful and not policing your fraudulent accounts and policing who is signing up for your systems — we are giving them the platform to launch their attacks. A lot of what we do, and it’s not a customer-facing feature and function, is review and look at and audit our accounts and our systems. When you first sign up, you are a nontrusted user on the system until we have the ability to validate who you say you are. That prevents guys from launching a DDoS attack using our systems.

CRN: These guys also are setting up botnet command and control servers as well.
JR: There’s a combination of things that these guys do. It’s disappointing but some of the other providers just choose not to address it. The thought process might be that the expense is not worth the investment and time or they may not have a very good grasp of the issue. It’s a real problem that is only going to get worse. Cloud computing has enabled these guys to launch significant attacks with not much investment.

NEXT: Dimension Data Plans For The Future

1

|

2

|

Next

Article source: http://www.pheedcontent.com/click.phdo?i=c31259304744ca4c78c950c734fc1bda

Follow @CRN

By

Ken Presti

CRN

<!– why is this here?

–>6:42 PM ET Thu. May. 16, 2013

Article source: http://www.pheedcontent.com/click.phdo?i=2de542dc2f6565de322e2024f5dd9cb9

With about 6,000 people jamming the conference room to capacity, Google executives summarized a far-reaching series of enhancements, new features and capabilities that are intended to increase the value of the company’s services and also pose new opportunities for developers.

“Seven years ago, smartphones led to an explosion of devices,” said Sundar Pichai, senior vice president, Android, Chrome and Applications. “They had a profound effect on day-to-day life. It’s a multiscreened world now, and thousands of third-party apps are being created.”

New developer tools include Android Studio, which is designed for simplified development, with features such as preview panes, plus the ability to see what prospective layouts would look like under differing screen sizes.

[Related: The Top 10 Enterprise Cloud Services Companies]

“I think this was one of their most important announcements,” said Wes Deglise, co-founder of Kilo-App, a Washington, D.C.-based developer. “I’m accustomed to working with Eclipse, which is the predecessor to Studio, but I like the feature set of the new one, so I’ll be willing to adopt it.”

In addition, a number of new features have been added to the Android Developers Console, including optimization tips, a new language translation service, referral tracking, usage metrics, and enhanced beta testing capabilities.

Google Cloud Messaging, which was announced last year, pushes data to all of the user devices. The system now supports persistent connections that dynamically send messages to various devices, upstream message capabilities that augment the ability to send data from devices to servers, and synchronized notifications across multiple devices.

Google Maps APIs will now include a “Fused Location Provider” through which locations are faster and easier to acquire, while at the same time uses less battery power. Activity recognition tracks users’ physical activities, specifically walking, running or driving.

The company also is extending the ability to launch search through voice queries and similar interactions, including the ability for the search engine to try to anticipate the user’s next question.

NEXT: Leveraging Data Toward Context

1

|

2

|

Next

Article source: http://www.pheedcontent.com/click.phdo?i=ba1737f2d6cbedfeeef99d51a600099e