Category Archives: Security

NIST Cloud Roadmap SP 500-293

The RSA Beijing Conference has had many sessions on compliance and cloud. NIST guidelines have come up repeatedly along with FISMA and other regulation references. The American civilian organization is clearly a global leader in this field and followed closely in China; however, I have not seen any mention yet or discussion of yesterday’s announcement on 500-293:

PCI DSS 2.0 open for review

The PCI SSC has invited QSAs to send input after November 1, 2011 on DSS 2.0. They want to hear about areas that need to be “clarified, updated or changed to enhance the protections for cardholder data.”

An online tool as well as a spreadsheet are available but each QSA organization is allowed only 5 feedback items in this phase of the next three year period.

December 31, 2011 marks the sunset of version 1.2.1 for both the DSS and PA-DSS

Dell Launches Cloud

Dell now offers a cloud service based on VMware vCloud Datacenter. Note the word chosen to lead the desription is “secure”:

The Dell Cloud provides a secure, flexible option for customers looking for additional capacity to handle spikes in demand or cost savings by not building additional data centers. Leveraging VMware technology, the Dell Cloud provides a seamless extension of existing enterprise infrastructure running on the industry leading VMware platform.

US Federal CIO calls for Security and Innovation

Steven VanRoekel, the former Microsoft executive and newly appointed Federal Chief Information Officer, has presented his first keynote.

He seems to say the choice between innovation and security is a false dichotomy — you can have both.

Now there are some who say we shouldn’t invest in government information technology in this fiscal environment, or use concerns about cyber security as a blanket excuse to preserve the status quo.

But if anyone doubts that now is the time to invest, consider the fact that more than half of the Fortune 500 companies were founded during an economic downturn. When forced to do more with less – when there is no alternative but to create a better way to get things done – that is when the real breakthroughs occur. In tough times, visionaries and risk-takers can tap into underutilized human capital, technology, information and other resources, picking up the pieces to reassemble them into something completely new.

Excellent point. Innovation is a great by-product of security (e.g. can’t innovate where/how you want if you have to spend your time/money fighting attacks) not to mention security innovation itself is a growth area.

His presentation was at the Palo Alto Research Center (PARC) and he made reference to its important role in American history.

When I was growing up in the 80s, I remember hearing people say that America was “destined” to be a service economy. We didn’t make anything anymore – our best days were behind us. But then ideas like those that came out of PARC helped spark a technology revolution that reestablished America’s leadership and launched the innovation economy.

Nicely said, but I call that a false dichotomy. American companies do not have to innovate in order to make things. Just look at Microsoft.