|By Gilad Parann-Nissany||
|April 2, 2014 12:00 PM EDT||
Last week, at the Amazon Web Services Summit in San Francisco’s Moscone Center, we met many companies who have deployed (or will migrate) their sensitive projects to the Amazon cloud. These companies expressed real concerns about the security of their information, and the status of continued compliance with regulations like HIPAA and PCI DSS. Below, a summary of the questions we were asked at the show.
Q. Does Amazon Web Services completely cover cloud security?
Amazon Web Services offers impressive built-in security features like firewalls, identity and access management, and private subnets. Yet as Amazon’s own Security Center will explain: there is a shared responsibility for cloud security and “AWS has secured the underlying infrastructure and you must secure anything you put on the infrastructure.”
You are responsible to secure your own sensitive data, to encrypt data at rest and in transit and, importantly, to ensure that only you (not even AWS) control your encryption keys. This is both security common sense and also important from a regulatory point of view.
Q. How is the Porticor cloud encryption solution different?
Porticor did not re-invent the data encryption wheel. We use industry standards for data encryption like AES. Our system is unique, however, in how it handles the keys to your encrypted data. Porticor is the only system that keeps control of encryption keys in the hands of the end customer while providing a pure cloud model – without any hardware requirements.
With Porticor, once your sensitive data is encrypted, our system takes the encryption key and splits it into two parts (here’s how in 90 seconds). One part stays within our system and one part, the “master key” stays with you at all times. Both parts are required to access your data. With this split-key encryption approach, Porticor ensures that only you control access to your data. AWS cannot access it, Porticor cannot access it, and hackers cannot access it. Only you control your data. This is what makes the system PCI and HIPAA compliant while maintaining the “pure cloud” approach. You can read more about it here.
Q. Does this kind of cloud security slow down performance?
No. We’ve gone to some length to keep performance top notch, by introducing efficient streaming. We also make sure that encryption happens inside your AWS account, in the same zone as your own AWS project, so there are no latency issues around network hops. You have a choice between a “Virtual Appliance” that you can bring up inside your own AWS account, and an “agent” that you can install on your own AWS instances.
As a result in some use cases we actually speed you up a bit! Detailed benchmarks are available here.
Q. Amazon Web Services offers CloudHSM. How does that compare?
It really depends on your requirements. CloudHSM is a hardware solution and is therefore highly secure. But it also brings hardware “challenges” to a cloud deployment. For example, it does not automatically scale, it is limited in regional support, and it is expensive.
Porticor is a software-defined solution, meaning it can scale (up or down) easily, as no hardware is involved. On top of that, Porticor delivers a holistic approach. We believe that encryption keys should be secure both on the key management side, as well as while in use. This is where our patented homomorphic split-key management kicks in.
Q. What does homomorphic encryption mean?
Homomorphic encryption is a technique that enables encrypting data, and keeping it encrypted even if it is used in calculations. As it relates to our system, Porticor homomorphically encrypts your master key before it enters the cloud, and it stays encrypted – never decrypted – when it is used in the cloud. This means your entire project works without anyone knowing your master key – not Porticor, not AWS, no computing element at all. This way, you retain control of your key at all times. Your key is safe even when it is in use in the cloud.
Q. Which companies need Porticor’s cloud security for AWS?
If your company or its clients face regulations like HIPAA, PCI DSS, or many others – you need Porticor.
If your company is committed to the security of the data or apps you store in the AWS cloud – you need Porticor.
If you want total cloud security that is flexible, scalable, easy to implement, and cost effective – you need Porticor.
Q. Are you an official partner of Amazon Web Services?
Yes. You can find us here.
Q. Is your solution only for Amazon Web Services?
No. You can use Porticor in any cloud scenario: public clouds (AWS, VMware, IBM, etc.), private clouds (VMware again), or hybrid scenarios.
Q. How is Porticor implemented inside my Amazon Web Services account?
Porticor is available as an AMI (Amazon Machine Image), so you can bring up a Porticor “Virtual Appliance” in your AWS account by the native AWS methods. Porticor is also available as an agent you can install on your AWS server instance.
Q. How do I get started?
The post Cloud Security for AWS: Your Cloud Encryption Questions Answered appeared first on Porticor Cloud Security.
Samsung VP Jacopo Lenzi, who headed the company's recent SmartThings acquisition under the auspices of Samsung's Open Innovaction Center (OIC), answered a few questions we had about the deal. This interview was in conjunction with our interview with SmartThings CEO Alex Hawkinson. IoT Journal: SmartThings was developed in an open, standards-agnostic platform, and will now be part of Samsung's Open Innovation Center. Can you elaborate on your commitment to keep the platform open? Jacopo Lenzi: Samsung recognizes that true, accelerated innovation cannot be driven from one source, but requires a...
Oct. 23, 2014 11:45 PM EDT Reads: 2,471
Oct. 23, 2014 11:30 PM EDT Reads: 1,562
P2P RTC will impact the landscape of communications, shifting from traditional telephony style communications models to OTT (Over-The-Top) cloud assisted & PaaS (Platform as a Service) communication services. The P2P shift will impact many areas of our lives, from mobile communication, human interactive web services, RTC and telephony infrastructure, user federation, security and privacy implications, business costs, and scalability. In his session at Internet of @ThingsExpo, Robin Raymond, Chief Architect at Hookflash Inc., will walk through the shifting landscape of traditional telephone a...
Oct. 23, 2014 08:15 PM EDT Reads: 1,452
Oct. 23, 2014 08:00 PM EDT Reads: 1,564
BSQUARE is a global leader of embedded software solutions. We enable smart connected systems at the device level and beyond that millions use every day and provide actionable data solutions for the growing Internet of Things (IoT) market. We empower our world-class customers with our products, services and solutions to achieve innovation and success. For more information, visit www.bsquare.com.
Oct. 23, 2014 08:00 PM EDT Reads: 1,519
How do APIs and IoT relate? The answer is not as simple as merely adding an API on top of a dumb device, but rather about understanding the architectural patterns for implementing an IoT fabric. There are typically two or three trends: Exposing the device to a management framework Exposing that management framework to a business centric logic • Exposing that business layer and data to end users. This last trend is the IoT stack, which involves a new shift in the separation of what stuff happens, where data lives and where the interface lies. For instance, it’s a mix of architectural style...
Oct. 23, 2014 07:45 PM EDT Reads: 1,518
SYS-CON Events announced today that SOA Software, an API management leader, will exhibit at SYS-CON's 15th International Cloud Expo®, which will take place on November 4–6, 2014, at the Santa Clara Convention Center in Santa Clara, CA. SOA Software is a leading provider of API Management and SOA Governance products that equip business to deliver APIs and SOA together to drive their company to meet its business strategy quickly and effectively. SOA Software’s technology helps businesses to accelerate their digital channels with APIs, drive partner adoption, monetize their assets, and achieve a...
Oct. 23, 2014 06:15 PM EDT Reads: 1,528
From a software development perspective IoT is about programming "things," about connecting them with each other or integrating them with existing applications. In his session at @ThingsExpo, Yakov Fain, co-founder of Farata Systems and SuranceBay, will show you how small IoT-enabled devices from multiple manufacturers can be integrated into the workflow of an enterprise application. This is a practical demo of building a framework and components in HTML/Java/Mobile technologies to serve as a platform that can integrate new devices as they become available on the market.
Oct. 23, 2014 06:15 PM EDT Reads: 1,517
SYS-CON Events announced today that Utimaco will exhibit at SYS-CON's 15th International Cloud Expo®, which will take place on November 4–6, 2014, at the Santa Clara Convention Center in Santa Clara, CA. Utimaco is a leading manufacturer of hardware based security solutions that provide the root of trust to keep cryptographic keys safe, secure critical digital infrastructures and protect high value data assets. Only Utimaco delivers a general-purpose hardware security module (HSM) as a customizable platform to easily integrate into existing software solutions, embed business logic and build s...
Oct. 23, 2014 05:45 PM EDT Reads: 1,462
Connected devices are changing the way we go about our everyday life, from wearables to driverless cars, to smart grids and entire industries revolutionizing business opportunities through smart objects, capable of two-way communication. But what happens when objects are given an IP-address, and we rely on that connection, sometimes with our lives? How do we secure those vast data infrastructures and safe-keep the privacy of sensitive information? This session will outline how each and every connected device can uphold a core root of trust via a unique cryptographic signature – a “bir...
Oct. 23, 2014 05:00 PM EDT Reads: 1,364
Internet of @ThingsExpo Silicon Valley announced on Thursday its first 12 all-star speakers and sessions for its upcoming event, which will take place November 4-6, 2014, at the Santa Clara Convention Center in California. @ThingsExpo, the first and largest IoT event in the world, debuted at the Javits Center in New York City in June 10-12, 2014 with over 6,000 delegates attending the conference. Among the first 12 announced world class speakers, IBM will present two highly popular IoT sessions, which will take place November 4-6, 2014 at the Santa Clara Convention Center in Santa Clara, Calif...
Oct. 23, 2014 01:00 PM EDT Reads: 1,529
Almost everyone sees the potential of Internet of Things but how can businesses truly unlock that potential. The key will be in the ability to discover business insight in the midst of an ocean of Big Data generated from billions of embedded devices via Systems of Discover. Businesses will also need to ensure that they can sustain that insight by leveraging the cloud for global reach, scale and elasticity.
Oct. 22, 2014 09:00 PM EDT Reads: 1,355
WebRTC defines no default signaling protocol, causing fragmentation between WebRTC silos. SIP and XMPP provide possibilities, but come with considerable complexity and are not designed for use in a web environment. In his session at Internet of @ThingsExpo, Matthew Hodgson, technical co-founder of the Matrix.org, will discuss how Matrix is a new non-profit Open Source Project that defines both a new HTTP-based standard for VoIP & IM signaling and provides reference implementations.
Oct. 22, 2014 01:15 PM EDT Reads: 1,520
SUNNYVALE, Calif., Oct. 20, 2014 /PRNewswire/ -- Spansion Inc. (NYSE: CODE), a global leader in embedded systems, today added 96 new products to the Spansion® FM4 Family of flexible microcontrollers (MCUs). Based on the ARM® Cortex®-M4F core, the new MCUs boast a 200 MHz operating frequency and support a diverse set of on-chip peripherals for enhanced human machine interfaces (HMIs) and machine-to-machine (M2M) communications. The rich set of periphera...
Oct. 21, 2014 08:30 PM EDT Reads: 1,582
SYS-CON Events announced today that Aria Systems, the recurring revenue expert, has been named "Bronze Sponsor" of SYS-CON's 15th International Cloud Expo®, which will take place on November 4-6, 2014, at the Santa Clara Convention Center in Santa Clara, CA. Aria Systems helps leading businesses connect their customers with the products and services they love. Industry leaders like Pitney Bowes, Experian, AAA NCNU, VMware, HootSuite and many others choose Aria to power their recurring revenue business and deliver exceptional experiences to their customers.
Oct. 21, 2014 06:00 PM EDT Reads: 1,457
The Internet of Things (IoT) is going to require a new way of thinking and of developing software for speed, security and innovation. This requires IT leaders to balance business as usual while anticipating for the next market and technology trends. Cloud provides the right IT asset portfolio to help today’s IT leaders manage the old and prepare for the new. Today the cloud conversation is evolving from private and public to hybrid. This session will provide use cases and insights to reinforce the value of the network in helping organizations to maximize their company’s cloud experience.
Oct. 21, 2014 05:15 PM EDT Reads: 1,545
The Internet of Things (IoT) is making everything it touches smarter – smart devices, smart cars and smart cities. And lucky us, we’re just beginning to reap the benefits as we work toward a networked society. However, this technology-driven innovation is impacting more than just individuals. The IoT has an environmental impact as well, which brings us to the theme of this month’s #IoTuesday Twitter chat. The ability to remove inefficiencies through connected objects is driving change throughout every sector, including waste management. BigBelly Solar, located just outside of Boston, is trans...
Oct. 21, 2014 09:00 AM EDT Reads: 1,720
Oct. 20, 2014 11:45 PM EDT Reads: 1,429
Predicted by Gartner to add $1.9 trillion to the global economy by 2020, the Internet of Everything (IoE) is based on the idea that devices, systems and services will connect in simple, transparent ways, enabling seamless interactions among devices across brands and sectors. As this vision unfolds, it is clear that no single company can accomplish the level of interoperability required to support the horizontal aspects of the IoE. The AllSeen Alliance, announced in December 2013, was formed with the goal to advance IoE adoption and innovation in the connected home, healthcare, education, aut...
Oct. 20, 2014 11:15 PM EDT Reads: 1,830
Oct. 20, 2014 09:45 PM EDT Reads: 1,402