<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0" xmlns:content="http://purl.org/rss/1.0/modules/content/"
    xmlns:wfw="http://wellformedweb.org/CommentAPI/"
    xmlns:dc="http://purl.org/dc/elements/1.1/"
    xmlns:atom="http://www.w3.org/2005/Atom"
    xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
    xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
    >
<channel>
    <title>Comments for Cloud</title>
    <atom:link href="http://www.sans.org/cloud/comments/feed" rel="self" type="application/rss+xml" />
    <link>http://www.sans.org/cloud</link>
    <description>Cloud Security</description>
    <lastBuildDate>Wed, 02 Oct 2013 1:45:47 +0000</lastBuildDate>
    <language>en</language><item><title>Comment on Cloud Security for Auditors by Chris</title><link>http://www.sans.org/blog/2013/03/27/cloud-security-for-auditors/comment-page-1/#comment-78</link><dc:creator>Chris</dc:creator><pubDate>Tue, 02 Apr 2013 15:51:22 +0000</pubDate><description><![CDATA[Dooh! Snagged me doing a copy/paste. ;-)

Monty, you are absolutely correct. In Figure 2, all the connections between the load balancers and the Web App servers should be labeled as &quot;HTTPS&quot;.

Good catch!
Chris]]></description><content:encoded><![CDATA[Dooh! Snagged me doing a copy/paste. ;-)

Monty, you are absolutely correct. In Figure 2, all the connections between the load balancers and the Web App servers should be labeled as &quot;HTTPS&quot;.

Good catch!
Chris]]></content:encoded></item><item><title>Comment on Cloud Security for Auditors by Chris</title><link>http://www.sans.org/blog/2013/03/27/cloud-security-for-auditors/comment-page-1/#comment-78</link><dc:creator>Chris</dc:creator><pubDate>Tue, 02 Apr 2013 15:51:22 +0000</pubDate><description><![CDATA[Dooh! Snagged me doing a copy/paste. ;-)

Monty, you are absolutely correct. In Figure 2, all the connections between the load balancers and the Web App servers should be labeled as &quot;HTTPS&quot;.

Good catch!
Chris]]></description><content:encoded><![CDATA[Dooh! Snagged me doing a copy/paste. ;-)

Monty, you are absolutely correct. In Figure 2, all the connections between the load balancers and the Web App servers should be labeled as &quot;HTTPS&quot;.

Good catch!
Chris]]></content:encoded></item><item><title>Comment on Cloud Security for Auditors by Monty</title><link>http://www.sans.org/blog/2013/03/27/cloud-security-for-auditors/comment-page-1/#comment-73</link><dc:creator>Monty</dc:creator><pubDate>Mon, 01 Apr 2013 22:17:00 +0000</pubDate><description><![CDATA[Great article - thought I'd point out one of the connecting lines in diag. 2 is incorrectly labeled.]]></description><content:encoded><![CDATA[Great article - thought I'd point out one of the connecting lines in diag. 2 is incorrectly labeled.]]></content:encoded></item><item><title>Comment on Cloud Security for Auditors by Monty</title><link>http://www.sans.org/blog/2013/03/27/cloud-security-for-auditors/comment-page-1/#comment-73</link><dc:creator>Monty</dc:creator><pubDate>Mon, 01 Apr 2013 22:17:00 +0000</pubDate><description><![CDATA[Great article - thought I'd point out one of the connecting lines in diag. 2 is incorrectly labeled.]]></description><content:encoded><![CDATA[Great article - thought I'd point out one of the connecting lines in diag. 2 is incorrectly labeled.]]></content:encoded></item><item><title>Comment on Can Cloud Computing Force Us to be Less Sloppy About Security? by Cloud Computing Training</title><link>http://www.sans.org/blog/2012/09/25/can-cloud-computing-force-us-to-be-less-sloppy-about-security/comment-page-1/#comment-68</link><dc:creator>Cloud Computing Training</dc:creator><pubDate>Thu, 03 Jan 2013 10:25:07 +0000</pubDate><description><![CDATA[Hi, Thanks for the tutorial. Please let me know if there is? any tutorial for AD and exchange server.]]></description><content:encoded><![CDATA[Hi, Thanks for the tutorial. Please let me know if there is? any tutorial for AD and exchange server.]]></content:encoded></item><item><title>Comment on Shout out to my 524 Students by Chris Brenton</title><link>http://www.sans.org/blog/2012/08/08/shout-out-to-my-524-students/comment-page-1/#comment-66</link><dc:creator>Chris Brenton</dc:creator><pubDate>Fri, 10 Aug 2012 16:09:52 +0000</pubDate><description><![CDATA[Hello again Kevin!

I'll pass along the request!

Chris]]></description><content:encoded><![CDATA[Hello again Kevin!

I'll pass along the request!

Chris]]></content:encoded></item><item><title>Comment on Shout out to my 524 Students by Kevin Kuehl</title><link>http://www.sans.org/blog/2012/08/08/shout-out-to-my-524-students/comment-page-1/#comment-61</link><dc:creator>Kevin Kuehl</dc:creator><pubDate>Fri, 10 Aug 2012 12:22:06 +0000</pubDate><description><![CDATA[I hope to see this class offered via SANS OnDemand early in 2013...]]></description><content:encoded><![CDATA[I hope to see this class offered via SANS OnDemand early in 2013...]]></content:encoded></item><item><title>Comment on 10 Things My Mom Didnt Warn Me about the Cloud by Chris Brenton</title><link>http://www.sans.org/blog/2012/08/07/10-things-my-mom-didnt-warn-me-about-the-cloud/comment-page-1/#comment-56</link><dc:creator>Chris Brenton</dc:creator><pubDate>Thu, 09 Aug 2012 16:16:07 +0000</pubDate><description><![CDATA[Hey Kevin,

First, thanks much for the commentary. I appreciate you keeping the conversation going as soooo much of that is needed. :-)

I agree with you to some extent, although I would argue that Web app servers in a data center would be stationary. This means that network security solutions could still be deployed between the data center and the Internet at large. With hybrid cloud, VMs are mobile entities. I may execute a workload in private space during development, move it to a major provider during production, and occasionally move it to a broadband or cellphone company's cloud to better serve bursts in traffic from their client base. So its that mobile component of the virtualized workload that really requires us to rethink how security is applied.

There is also some interesting audit capabilities with cloning that can permit us to achieve a higher level of security if we appropriately modify our auditing process. Check out today's blog post for more details.

HTH,
Chris]]></description><content:encoded><![CDATA[Hey Kevin,

First, thanks much for the commentary. I appreciate you keeping the conversation going as soooo much of that is needed. :-)

I agree with you to some extent, although I would argue that Web app servers in a data center would be stationary. This means that network security solutions could still be deployed between the data center and the Internet at large. With hybrid cloud, VMs are mobile entities. I may execute a workload in private space during development, move it to a major provider during production, and occasionally move it to a broadband or cellphone company's cloud to better serve bursts in traffic from their client base. So its that mobile component of the virtualized workload that really requires us to rethink how security is applied.

There is also some interesting audit capabilities with cloning that can permit us to achieve a higher level of security if we appropriately modify our auditing process. Check out today's blog post for more details.

HTH,
Chris]]></content:encoded></item><item><title>Comment on 10 Things My Mom Didnt Warn Me about the Cloud by Kevin Kuehl</title><link>http://www.sans.org/blog/2012/08/07/10-things-my-mom-didnt-warn-me-about-the-cloud/comment-page-1/#comment-51</link><dc:creator>Kevin Kuehl</dc:creator><pubDate>Wed, 08 Aug 2012 01:31:15 +0000</pubDate><description><![CDATA[This is an excellent post.  Spinning up unpatched OS images is something I've bumped against repeatedly.

I do slightly disagree with your examples of why cloud requires a rethink of security.  Newish Web apps are already tunneling all sorts of communication over HTTPS.  If you have a hundred Web app servers in a data center all meshed together with a service bus inside HTTPS, you already pretty much need host-based firewalls and intrusion detection/prevention.

I think clouds (public and private) are just forcing us to adapt to the new realities caused by today's Web apps faster than we may have wanted. :-)

Keep up the good work on the blog...]]></description><content:encoded><![CDATA[This is an excellent post.  Spinning up unpatched OS images is something I've bumped against repeatedly.

I do slightly disagree with your examples of why cloud requires a rethink of security.  Newish Web apps are already tunneling all sorts of communication over HTTPS.  If you have a hundred Web app servers in a data center all meshed together with a service bus inside HTTPS, you already pretty much need host-based firewalls and intrusion detection/prevention.

I think clouds (public and private) are just forcing us to adapt to the new realities caused by today's Web apps faster than we may have wanted. :-)

Keep up the good work on the blog...]]></content:encoded></item><item><title>Comment on Can I Outsource My Security to The Cloud? by Chris Brenton</title><link>http://www.sans.org/blog/2012/07/19/can-i-outsource-my-security-to-the-cloud/comment-page-1/#comment-46</link><dc:creator>Chris Brenton</dc:creator><pubDate>Tue, 31 Jul 2012 14:03:44 +0000</pubDate><description><![CDATA[Hi Geri,

You make an excellent point regarding the limitations on being able to test your own security in a public cloud. If you would like some additional reading, you can check out a post I made on the pen testing blog:
http://pen-testing.sans.org/blog/2012/07/05/pen-testing-in-the-cloud

 I also seem to remember than Amazon places restrictions on being able to test your own security. This is (yet another) reason I think the key to cloud security is with host-based deployment options.
However this problem becomes even more acute when you move from IaaS to PaaS. This is because you are writing your own applications, but to the best of my knowledge *none* of the public PaaS clouds will let you do security testing, or provide an option to do the testing for you. So this limits you to code review or deploying a test environment where the apps can be validated prior to production. IMHO this should be best practice anyway, but it stinks to have your options limited.]]></description><content:encoded><![CDATA[Hi Geri,

You make an excellent point regarding the limitations on being able to test your own security in a public cloud. If you would like some additional reading, you can check out a post I made on the pen testing blog:
http://pen-testing.sans.org/blog/2012/07/05/pen-testing-in-the-cloud

 I also seem to remember than Amazon places restrictions on being able to test your own security. This is (yet another) reason I think the key to cloud security is with host-based deployment options.
However this problem becomes even more acute when you move from IaaS to PaaS. This is because you are writing your own applications, but to the best of my knowledge *none* of the public PaaS clouds will let you do security testing, or provide an option to do the testing for you. So this limits you to code review or deploying a test environment where the apps can be validated prior to production. IMHO this should be best practice anyway, but it stinks to have your options limited.]]></content:encoded></item></channel></rss