InfoQ Homepage Cloud Security Content on InfoQ
-
Google to remove support for SSL 3.0
Google have announced that they will remove support for the obsolete SSL 3.0 after discovering vulnerabilities that may be exploitable by forcing clients or servers to downgrade. Removing SSL 3.0 may also unlock stalled negotiations with HTTP2. Read on for more details.
-
CloudFlare Universal SSL - Free Web Security for All
CloudFlare have made SSL available to all free subscribers to its content delivery network (CDN) with Universal SSL. The move addresses both cost and complexity issues that have previously confronted web site and application owners wanting to deploy SSL. CloudFlare takes care of issuing a certificate at no cost to the end user, and enabling SSL becomes a selection from a dropdown menu.
-
Refreshed AWS Trusted Advisor Offers Several Free Checks
Amazon Web Services (AWS) has recently integrated the AWS Trusted Advisor into the AWS Management Console and made four security and service limit checks available at no charge. Additional checks from the security, performance, fault tolerance and cost optimization categories remain part of their Business and Enterprise support tiers.
-
AWS Expands Credential Lifecycle Management and Monitoring
AWS Identity and Access Management (IAM) recently expanded available password policy rules to enable self-service password rotation. A new credential report provides visibility into the AWS credentials security status. AWS also added logging of AWS Management Console sign-in events to AWS CloudTrail.
-
AWS CloudTrail Expands Auditing of API Calls
Amazon Web Services (AWS) has considerably increased the number of services supported by AWS CloudTrail to cover the majority of the extensive AWS service portfolio. This now includes most compute and networking and all deployment and management services, thereby providing comprehensive end to end auditing of almost any changes to customer’s infrastructure.
-
Node Security Project Aims at Making Node.js More Secure
Node Security Project has been quietly working at improving Node.js security for a few months now. The project has the goal of auditing Node.js existing module base to help "improve Node landscape and provide confidence to developers and enterprises about the state of security in Node.js land."
-
Heartbleed allows dumping client and server memory remotely
The recently disclosed Heartbleed bug allows a remote client to query the contents of a remote SSL server's memory when using vulnerable versions of OpenSSL, disclosing passwords and other secure credentials to eavesdroppers. Application sites like Yahoo! Mail and Amazon Web Services have been affected. Read on to find out more about what the bug entails,and what you should do.
-
A Few Highlights from QConSF2013- Part 2 of 2
It's one thing having an in-house training program. But there is a certain deeper insight that can be gained from attending a Q-Con conference in person. Which may be one reason why attendance at the globe-hopping event continues to grow.
-
Tune Up Your Online Privacy with Clef
Clef is like a retina scan for your smart phone, which gives a whole new meaning to Retina Display. You can use Clef as an Open ID to log in from your smart phone only once to access many different web sites when online. Rather than typing in your user ID and password for each web site.
-
AWS Summit 2013: Focus on Cost, Security, Big Data and DevOps
Amazon's free, one-day cloud community event took place in Berlin this month. Aimed at developers, technical and business leaders, the topics of the series increasingly focus on cost effectiveness, high availability, big data and security. The summit was complemented with presentations from successful local AWS adopters.
-
Businesses in US Embracing Cloud at Faster Rate than in UK, Survey Shows
While 94% of businesses consider business process automation an important component of their overall productivity, opinions differ on the role of cloud technologies in automation solutions. According to a new survey conducted on behalf of Redwood Software, the use of cloud technologies differs greatly between the United States and United Kingdom, and among industries.
-
Amazon Registers AWS with CSA STAR
CSA security registry continues to gain relevance through the incorporation of Amazon AWS into the registry.
-
Google’s New IaaS Offering Runs Linux VMs in the Cloud
Google today disclosed details of Compute Engine, an IaaS offering that runs Linux VMs on demand utilizing Google’s cloud infrastructure. Google Compute Engine (GCE) supports 1, 2, 4 and 8 virtual core VMs with 3.75GB RAM per virtual core
-
Future of Cloud Security Assessments: Microsoft Leads with Public Registrations on CSA
Microsoft has registered security assessments for Office 365, Windows Azure and Dynamics CRM for public consumption on the cloud security alliance's security registry, STAR. Microsoft is the first major service provider to register their assessments at a time when security concerns in the public cloud space continue to grow.
-
New DMTF WorkGroup To Address Cloud Security Concerns Through Cloud Audit Standards
Security concerns still remain the top inhibitor of cloud adoption and cloud audits will alleviate some of these concerns. DMTF instituted the Cloud Audit Data Federation Work Group (CADFWG) to define specifications which will empower organizations to audit cloud-based IT resources, regardless of their chosen cloud provider.