VMware has created a public cloud survey with a $5 coffee gift card incentive.
Our survey asks why you chose your provider, the type of workloads you’re running, if you use intermediaries with your cloud solution, and what you perceive as the biggest benefits or concerns when it comes to cloud.
Now is your chance to let the providers know that compliance and security are (or aren’t) your top concern.
The National Institute of Standards and Technology (NIST) today has re-released their Special Publication 800-53.
The document I just saw says it is Revision 1, with a June 2010 stamp on the cover.
This is confusing because the current version made available to the general public is listed as Revision 3. Here is the official copy on their website with all the changes clearly marked:
800-53-rev3_markup-final-public-draft-to-final-updated_may-01-2010.pdf
Note that NIST also posted an errata document that lists just the changes to 800-53. FISMAPEDIA gives a granular comparison between Revision 3 and Revision 2.
One big change that has happened seems to be related to FIPS 199 security categories — organizations now can use their own impact assessment formula or something like NIST SP 800-60 instead.
Another big change is the addition of the phrase “Existing organizational policies and procedures may make the need for additional specific policies and procedures unnecessary.”
A vast majority of the edits in the document are cosmetic (i.e. changing the term one-time to replay-resistant) but here are some I found interesting:
Still awake?
The Microsoft announcement that it is moving the cloud service into an appliance and semi-private service comes at the same time that the Amazon CTO calls private clouds “false clouds”.
Stepping aside from all the marketing about what is real and what is false, I think this move by Microsoft raises some great security and compliance questions.
First, I seem to remember Salesforce rumbling about this public-private service model as far back as 2005, around the time of the Google search appliance. The idea then was to take a web service and package it so it can receive updates but that’s it. This allows an entrance into a market that has a natural fear of getting into a service like cloud. It also helps reduce the expense of Salesforce trying to establish a meaningful cloud compliance or confidence message.
Microsoft is taking steps in this direction now. ComputerWorld reports that Muglia offers details on Microsoft Azure Appliance
Once settled in the data center, the appliance will be connected to Microsoft’s own instance of Azure. “We will maintain a flow of new software down to all of the appliances so they will be kept up to date,” he said, adding that the customer will retain control over factors such as when to apply updates and which services to deploy.
That sounds a lot like having another Microsoft product in a private environment that gets new software through the update service. Cloud? Ooops, nevermind I started to get into the definition again.
I am more interested to know what kind of logging, monitoring and access controls are in place. Naturally it is completely absent from the ComputerWorld article. The word “security” and the word “compliance” are not used a single time! Here is a good example question: does Microsoft, or Salesforce for that matter, maintain their own accounts with access to data in these appliances? That would make “change vendor defaults” for regulations and compliance very difficult to achieve.
A comment on Bruce’s blog today pointed me to a law in North Carolina that says a sawed-off shotgun is a weapon of mass destruction.
It looks like an afterthought in the text of the actual law, G.S. 14-288.8:
(c) The term “weapon of mass death and destruction” includes:
(1) Any explosive or incendiary:
a. Bomb; or
b. Grenade; or
c. Rocket having a propellant charge of more than four ounces; or
d. Missile having an explosive or incendiary charge of more than
one-quarter ounce; or
e. Mine; or
f. Device similar to any of the devices described above; or
(2) Any type of weapon (other than a shotgun or a shotgun shell of a type particularly suitable for sporting purposes) which will, or which may be readily converted to, expel a projectile by the action of an explosive or other propellant, and which has any barrel with a bore of more than one-half inch in diameter; or
(3) Any firearm capable of fully automatic fire, any shotgun with a barrel or barrels of less than 18 inches in length or an overall length of less than 26 inches, any rifle with a barrel or barrels of less than 16 inches in length
One-quarter ounce charge? That seems amazingly low to me, given that the definition is for mass death and destruction. Is it really necessary to define a quantity for heavy or mass casualties, or do these terms reflect instead the intent of an attacker?
It reminds me of one particular controversy over casualty counts: the Nazi aerial bombing of a Spanish town in 1937 as immortalized in the Clash song Spanish Bombs.
This tragic attack is thought to be the origin of the term WMD due to the direct assault on civilians with three hours of bombing waves using newly developed “firebombs”.
…The only things left standing were a church, a sacred Tree, symbol of the Basque people, and, just outside the town, a small munitions factory. There hadn’t been a single anti-aircraft gun in the town. It had been mainly a fire raid.
…A sight that haunted me for weeks was the charred bodies of several women and children huddled together in what had been the cellar of a house. It had been a refugio.”
Eye witnesses estimated that aside from a series of bombs of 1,000 pounds a series of 3,000 two-pound aluminum incendiary projectiles were used.
In the form of its execution and the scale of the destruction it wrought, no less than in the selection of its objective, the raid on Guernica is unparalleled in military history. Guernica was not a military objective. A factory producing war material lay outside the town and was untouched. So were two barracks some distance from the town. The town lay far behind the lines. The object of the bombardment was seemingly the demoralization of the civil population and the destruction of the cradle of the Basque race. Every fact bears out this appreciation, beginning with the day when the deed was done.
Monday was the customary market day in Guernica for the country round.
Wikipedia claims the ratio was likely to be forty tons of bombs dropped as many as 1,700 dead, or 43 dead per ton of explosives. The town only had about 7,000 inhabitants. It then compares this number to bombing raids in WWII that averaged a ratio of about 10 dead per bomb.
The vast difference in ratios between Guernica and other bombing raids has led James Corum of the Army War College (mixed motives?) to argue that high casualty counts from bombs are propaganda:
From the 1930s to the present, the effect of airpower to produce casualties has been overestimated out of the ignorance of the press and the common perceptions of airpower. In some cases, the civilian casualties caused by air attack have been deliberately overstated in order to make a propaganda point. Recent conflicts such as the Gulf War demonstrate that the perceptions of heavy civilian casualties remain even if great care is taken to limit collateral damage in an air campaign. The recent wars show us that the deliberate falsification of civilian casualties from air bombardment is likely to remain as a major propaganda theme.
The propaganda theme?
Perhaps estimates are increased with the idea to show weapons with potential for mass destruction actually cause mass destruction.
It is not always so simple, however, as I have mentioned before. Looking at Guernica versus other bombing runs I am curious about the effect of defenses like balloons, better civilian preparedness, and other significant target differences. That takes me back to the core definition of WMD. Furthermore, propaganda seems to run both ways. Here is another angle, completely the opposite from the “propaganda point” argued above:
It is impossible to state yet the number of victims. In the Bilbao Press this morning they were reported as “fortunately small,” but it is feared that this was an understatement in order not to alarm the large refugee population of Bilbao.
Add that perspective to the fact that Nazis claimed the town was really damaged by retreating civilians and not the bombing raid.
In other words, history shows it is more revealing to investigate motives and means when trying to regulate WMDs. This is likely to be more on target than searching for an accepted measure of the causes for severe and mass destruction. The question then does become what is the intended use of an incendiary bomb, or a shotgun that has a barrel less than 18 inches?