Category Archives: Security

Breach Analysis: Grizzly Bear Edition

The Woodland Park Zoo in Seattle last year hosted a safety demonstration called the Bear Affair and Big Howl for Wolves:

This annual event features a campground set up in our bear exhibit in the zoo’s Northern Trail. Bears are released into the campground to demonstrate the results of poorly planned campsites, plus a demonstration on how to create a bear-safe campsite and promote safe interactions between humans and bears in the wild. Plus learn about another native predator, gray wolves!

First clue that you might be in danger? You just pitched a tent inside the bear exhibit at a zoo.

Example of a “Non-Safe Campsite”:

Bear eats tent

VMware PEX 2012: Security and Compliance

This weekend begins the 2012 Partner Exchange (PEX) conference for VMware (Twitter hashtag #VMwarePEX). The Catalog of all sessions is available online.

VMware PEX 2012

I will be there and hope to see you. Here is a quick list of all the dedicated security and compliance presentations:

  • Ravi Kumar, Eric Horschman – (CIM1250) Selling the VMware Advantage for Business Continuity and Security
  • Rob Randell, Jeff Szastak – (CIM1248) Using vShield and vCenter Configuration Manager to Achieve Better Than Physical Security for Business Critical Applications
  • Jeremiah Cornelius, Scott Sloan – (TEX1517) Security Partner Opportunity and Enablement for Partners in the New Data Center
  • Ana Seijas – (CIM1275) Securing the Virtual Infrastructure – Preparing for the Cloud
  • Wen Yu, Simon Mijolovic – (EUC1478) Tips, tricks and lessons learned in designing a vDaaS (virtual desktop as a service) with end to end secure multi-tenancy
  • Ravi Kumar, Ibrahim Rahmani – (CIM1372) Panel Discussion – Partner’s Best practices in Selling and Delivering Virtual Security
  • George Gerchow, Davi Ottenheimer – (TEX1543) Compliance Audit Validated Industry Specific Architectures
  • Grant Suzuki – (CIM1349) VMware vShield App Security Deep Dive
  • Ben Del Vento – (CIM1409) Compliance and Security: A holistic approach from the bottom up
  • Alka Gupta – (EUC1504) VMware Horizon App Managerâ„¢ – a user-centric management service for securely accessing private and public cloud applications from inside an Enterprise
  • George Gerchow, Davi Ottenheimer – (CIM1526) Achieving a Trusted Cloud – vCM, VIN, vShield Technical Overview

And if you are attending the VMware Customer Council please consider joining our session on Sunday at 10am, where we will discuss the latest progress and development in compliance automation for virtual and cloud environments. I will be there to answer questions about SCAP and the new hardening guide for vSphere5.

VMware and PCI QSAs

Dave Jasso has posted an update on VMware’s efforts to help its customers with virtualization and PCI DSS 2.0

VMware has been working with QSAs such as Coalfire to clarify how to successfully address PCI while still being able to fully leverage virtualization. This link takes you to a whitepaper written by Coalfire that highlights some of the core technologies that VMware offers that can help you address PCI compliance. VMware is actively working to deliver more guidance in this area but this will give you a good overview on how VMware can help companies of any size achieve PCI 2.0 compliance.

FBI Cloud Compliance Challenges

Computerworld has a nice summary of why FBI data compliance requirements are often incompatible with cloud providers:

One of the more challenging requirements requires cloud service providers to identify all system, database, security and network administrators who have access to criminal justice information, [Stephen Fischer Jr., a spokesman for the FBI’s CJIS division] said.

Similarly, cloud vendors will likely find it difficult to require fingerprint criminal background checks on all administrators with access to the criminal justice information. Fischer said.

Analysts have previously noted such rules would be particularly difficult for cloud vendors like Google that maintain staffed data centers outside the U.S.