Hugh Garber

As companies continue to include the cloud in their overall IT initiatives – taking advantage of elasticity, scalability, interoperability and mobility – concerns around management, governance and control of data are preventing some organizations from fully embracing cloud services. In fact, according to the recent Ponemon cloud survey, over 30% of IT and compliance respondents claim that concerns about data security have kept their organization from adopting cloud services…. And approximately half place a high priority on security when evaluating cloud providers. For many, the benefits and the desire to migrate to the cloud in organizations seem to outweigh the security concerns. That being said, every company’s risk tolerance is different.  Some of the variables in play that impact risk tolerance certainly include the type of information being moved and stored in t... (more)

The challenge of visibility

Information flows into, within and out of organizations faster and in greater volumes than ever before.  Complicating matters is the growing number of vendor systems, applications and platforms that make up your company’s business infrastructure and touch even your most sensitive and mission-critical information. If you don’t have visibility into the data and files that are flowing between systems, applications and people — both inside and beyond the company firewall — things can go haywire very quickly. Lost files, security breaches and compliance violations Broken SLAs and othe... (more)

Encryption: Transport versus File

This morning I was asked if I recommended using transport encryption or file encryption to protect company files and data. My answer:  “Use both of them, together!” For starters, here’s a real quick summary of both encryption types: Transport encryption (“data-in-transit”) protects the file as it travels over protocols such as FTPS (SSL), SFTP (SSH) and HTTPS.  Leading solutions use encryption strengths up to 256-bit. File encryption (“data-at-rest”) encrypts an individual file so that if it ever ended up in someone else’s possession, they couldn’t open it or see the contents.  PG... (more)

Moving beyond FTP: Where to begin?

“My company still relies heavily on FTP.  I know we should be using something more secure, but I don’t know where to begin.” Sound familiar? The easy answer is that you should migrate away from antiquated FTP software because it could be putting your company’s data at risk – Unsecured data is obviously an enormous liability.  Not only does FTP pose a real security threat, but it also lacks many of the management and enforcement capabilities that modern Managed File Transfer solutions offer. No, it won’t be as daunting of a task as you think.  Here’s a few steps to help you get s... (more)

Hackers break browser SSL/TLS Encryption

Word has quickly spread that a serious weakness has been discovered in the Secure Sockets Layer (SSL) protocol that allows attackers to silently decrypt data that’s passing between a web server and an end-user browser. All reports indicate that this vulnerability affects the SSL protocol itself and is not specific to any operating system, browser or software/hardware product.  This is an information disclosure vulnerability that allows the decryption of encrypted SSL 3.0 and TLS 1.0 traffic.  It primarily impacts HTTPS web traffic, since the browser is the primary attack method. ... (more)