Equifax Is an Enron Moment, But Not the Way You May Think Enron changed how U.S. public companies audit and report their financial data. There is also an opportunity to use the Equifax data breach to create a framework for better protection of our data in future. The credit reporting agency reported one of the largest data breaches in the history. Hackers were able to steal sensitive information from its internal servers. The stolen data include name, Social Security Number (SSN), date of birth, and also credit card numbers and driver license numbers in some cases. A massive breach like this can haunt the victims for years to come. What makes this specific breach even more damaging is the type of the stolen data. If someone steals your credit card number, you call your bank and get a new card hopefully before the hacker is able to make use of the stolen card. But, if... (more)

Keeping Digital Health Organizations Safe from Cyber Attack | @CloudExpo #DX #Cloud #Security

For health organizations, breaches are a constant threat, due to the high value of healthcare data - Social Security Numbers, treatment records, credit information, and other sensitive personally identifiable information (PII). And the cost of a breach to a health system or hospital can be devastating. And the health care industry has seen its share of breaches in the past quarter alone. For example, the National Health Service in England and Scotland was hit by a Wanna Decryptor ransomware attack affecting at least 16 of its organizations. Within two days 150 countries were affected. Also last quarter, up to millions of patient records at Bronx-Lebanon Hospital Center in New York stored on a backup system managed by iHealth Innovations were exposed to a data breach. Despite all the focus on preventing protected health information (PHI) theft and thwarting the next ... (more)

No Passwords | @CloudExpo #Cloud #API #AI #ML #DL #DX #Cybersecurity

Every time there’s a notable cybersecurity breach, someone (even me) writes a comprehensive primer on the proper way to create “secure” passwords. Lather, rinse, repeat. Until a few years ago, everyone (including me) based their password advice on a 2003 paper from the National Institute of Standards and Technology (NIST), with the catchy title “NIST Special Publication 800-63.” The paper recommended that passwords be cryptic, contain special characters, and be as close to nonsense as possible. I was in a camp I called “How to Make a Cryptic Password You Can Easily Remember.” The short version was this: take a phrase you know, such as a favorite quote from a movie, and use the first letter of each word. For example, Sheriff Brody’s famous line from Jaws, “I think we’re gonna need a bigger boat,” becomes 1twgn@bb. The trick was using Leet (a technique where letters ... (more)

Is 2017 Half Empty or Half Full? | @ThingsExpo #AI #ML #DX #IoT #SmartCities

With 2017 crossing the half way point, let’s look at some technology trends thus far. Breaches: Many personal records are half empty due to the continued rash of intrusions while the crooks are half full of our personal information along with some ransom payments. According to the Identity Theft Resource Center (ITRC), there have been 7,689 breaches since 2005 (when they started tracking) compromising – get this – 900,315,392 records. Almost 3 times the U.S. population. In 2016, 56% of all Data Breaches began with a user clicking on a phishing email. The big story for 2017 I think, is the rise of ransomware. Kaspersky reports a 250% increase in ransomware for the first few months of 2017. From WannaCry to Petya to Fusob, criminals are holding systems hostage until a ransom is paid…or not. Ransomware seems to be this year’s big trend with backups saving some from to... (more)

API Security: OWASP 2017 RC1 Gets It Right | @CloudExpo #API #SOA #Microservices

API Security has finally entered our security zeitgeist. OWASP Top 10 2017 - RC1 recognized API Security as a first class citizen by adding it as number 10, or A-10 on its list of web application vulnerabilities. We believe this is just the start. The attack surface area offered by API is orders or magnitude larger than any other attack surface area. Consider the fact the APIs expose cloud services, internal databases, application and even legacy mainframes over the internet. What could go wrong? API Security has been added to OWASP Top 10 2017 - RC1. This is a commendable step taken by the web application security thought leaders and is a clear indication of where the industry is heading. Security professionals have all the tools and awareness to fence in applications, databases and legacy systems through firewalls. OWASP has served the security professionals well... (more)

Crisis Response Using Cloud Computing | @CloudExpo #ML #IoT #AI #DX #DevOps #FedRAMP

Cloud computing is more than servers and storage. In a crisis situation it can actually be a lifesaver. BlackBerry, in fact, has just become the first cloud-based crisis communication service to receive a Federal Risk and Authorization Management Program (FedRAMP) authorization from the United States Government for its AtHoc Alert and AtHoc Connect services. If you're not familiar with FedRAMP, it is a US government-wide program that provides a standardized approach to security assessment, authorization, and continuous monitoring for cloud products and services. The Blackberry certification was sponsored by the US Federal Aviation Administration. While you may not need a US Government certified solution in an emergency, your organization may really want to consider the benefits of cloud computing for crisis response. From a communications point of view, companies can... (more)

[slides] #IoT and Medical Device Safety | @ThingsExpo #AI #DX #SmartCities

Download Slide Deck: ▸ Here Download Slide Deck: ▸ Here Medical Device Safety in a Connected World Consumers increasingly expect their electronic "things" to be connected to smart phones, tablets and the Internet. When that thing happens to be a medical device, the risks and benefits of connectivity must be carefully weighed. Once the decision is made that connecting the device is beneficial, medical device manufacturers must design their products to maintain patient safety and prevent compromised personal health information in the face of cybersecurity threats. Download Slide Deck: ▸ Here In his session at @ThingsExpo, Clark Fortney, Software Engineer at Battelle, discussed how designing safe connected medical devices begins with systematically analyzing cyber threats against desired functionality and making smart hardware/software architectural choices accordi... (more)

[slides] #FinTech for Success | @CloudExpo @CloudRaxak #Blockchain #AI #ML #DL #DX

Speaker Bio Sesh Murthy is the Co-Founder and CTO of Cloud Raxak. Before Cloud Raxak, he was the Vice President of Cloud Innovation at IBM Global Services. He has 29 years of experience in creating value for customers in cloud and technology services. His expertise includes cloud architecture and security, management service automation, strategic outsourcing, software, sales, and distribution. Download Slide Deck: ▸ Here Download Slide Deck: ▸ Here Enabling FinTechs for Success through Business-Driven Cloud Security FinTechs use the cloud to operate at the speed and scale of digital financial activity, but are often hindered by the complexity of managing security and compliance in the cloud. Download Slide Deck: ▸ Here In his session at 20th Cloud Expo, Sesh Murthy, co-founder and CTO of Cloud Raxak, showed how proactive and automated cloud security enables FinTec... (more)

[video] @Cloudistics Public Cloud | @CloudExpo #CloudNative #AI #DataCenter

"As we've gone out into the public cloud we've seen that over time we may have lost a few things - we've lost control, we've given up cost to a certain extent, and then security, flexibility," explained Steve Conner, VP of Sales at Cloudistics,in this SYS-CON.tv interview at 20th Cloud Expo, held June 6-8, 2017, at the Javits Center in New York City, NY. With major technology companies and startups seriously embracing Cloud strategies, now is the perfect time to attend 21st Cloud Expo, October 31 - November 2, 2017, at the Santa Clara Convention Center, CA, and June 12-14, 2018, at the Javits Center in New York City, NY, and learn what is going on, contribute to the discussions, and ensure that your enterprise is on the right path to Digital Transformation. Track 1. Enterprise Cloud | Cloud-Native Track 2. Big Data | Analytics Track 3. Internet of Things | IIoT | S... (more)

[session] #SecDevOps for Cloud Building | @CloudExpo #CloudNative #DevOps

A SecDevOps Approach to Cloud Building As more and more companies are making the shift from on-premises to public cloud, the standard approach to DevOps is evolving. From encryption, compliance and regulations like GDPR, security in the cloud has become a hot topic. Many DevOps-focused companies have hired dedicated staff to fulfill these requirements, often creating further siloes, complexity and cost. This session aims to highlight existing DevOps cultural approaches, tooling and how security can be wrapped in every facet of the build and release cycle and how to get sales and customer facing resources wrapped in. In his session at 21st Cloud Expo, Scott Moore, Global Black Belt TSP at Microsoft, will share real-life experiences working with customers and explain how focusing on ‘security first' transformed their business from product ideation to creation. Spea... (more)

[session] Risk Tree API | @CloudExpo @TwistlockTeam #DevOps #AI #DX #API

Risk Tree API: Expose Your Vulnerabilities Vulnerability management is vital for large companies that need to secure containers across thousands of hosts, but many struggle to understand how exposed they are when they discover a new high security vulnerability. In his session at 21st Cloud Expo, John Morello, CTO of Twistlock, will address this pressing concern by introducing the concept of the "Vulnerability Risk Tree API," which brings all the data together in a simple REST endpoint, allowing companies to easily grasp the severity of the vulnerability. He will provide attendees with actionable advice related to understanding and acting on exposure due to new high severity vulnerabilities. Speaker Bio John Morello is the CTO of Twistlock, leading the work with strategic customers and partners and driving the product roadmap. Prior to Twistlock, John was the CISO ... (more)