Best security questions to ask about SaaS

Security issues have to be clearly examined before diving into software as a service (SaaS), warns Burton Group analyst Eric Maiwald, who shed some light on the subject at this week's Infosec conference.
SaaS, offered via a cloud computing platform, can offer cost savings and speed in platform deployment in many instances, compared to a business trying to acquire and install software internally. Businesses eager to race into the cloud typically say "they can measure the cost savings the first couple of years," said Maiwald. "But I think they're leaving something out."
What's often missing is inclusion of the costs to conduct a suitable level of verification on the vendor, including security and legal reviews, data-center site visits and other practices necessary to ensure compliance obligations are met.
Beyond the hard cost considerations, there are myriad security questions any business should be asking, Maiwald said. These include:
- Which of the SaaS employees has root and database access, and will anything prevent them from getting access to your corporate data? What controls are in place?
- Is data held encrypted? How?
- Is the held data separated between clients or is it all stored on one huge database out there? How is data separated? How will the legal question of e-discovery be addressed should it arise as a business concern?
- Is the data flowing between the business and the vendor's cloud-computing infrastructure secured in some way?
- What controls would prevent vendor insiders from downloading your data onto a USB stick and walking out the door?
- In terms of service availability, can you get your vendor to sign a service-level agreement?
- Is their data center in a location prone to hurricanes or earthquakes? What are their back-up plans?
- What information is captured in audit logs?
- Are there ways to limit where SaaS vendors go within the corporate network?
Despite his critical remarks, Maiwald acknowledged in some instances SaaS and cloud computing vendors may offer better availability than their business clientele could achieve due to the investments vendors can make to scale up their services.
"Google, Microsoft, Amazon are doing amazing stuff with what they're putting into their data centers," he said.
He noted that a few years ago SaaS-styled vendors would be vague in discussing their security controls, but just recently at a forum with Salesforce.com, Qualys, IBM and others, he found vendors much more forthcoming than previously.
One aspect of SaaS to be mindful about is that vendors prefer to provide a common set of services in order to take advantage of scale, Maiwald pointed out. So that means "vendors may not be willing to change internal policies as their economies of scale will suffer," he said.
Maiwald added that technical controls, such as for content or rights management, typically don't work as well in an outsourced environment. When you entrust your data to SaaS, "audit replaces your day-to-day management controls and technical controls," he asserts, adding contracts have to carefully crafted, something IT people will need a lot of help in from legal staff.
Many businesses may want to ask if the SaaS vendor they're considering has passed a so-called "SAS 70" audit, Maiwald said. There are two types of SAS-70 audits, he points out, and Type 2 is much more stringent.
The larger question of how SaaS may impact the business in general can't be ignored since companies may be sacrificing IT skills and competence when they choose SaaS. Maiwald said his basic recommendation would be to limit the number of SaaS vendors to a few strategic partners.

Source : computerworld

Nintendo Ships 100 Millionth DS

Nintendo declared in a press release that it shipped its 100 millionth Nintendo DS as of March 6, 2009. The 100 million figure includes the combined sales of all versions of the Nintendo DS that have been sold including, the original Nintendo DS, the Nintendo DS Lite, and the Nintendo DSi.
According to Nintendo of America President Reggie Fils-Aime, "Consumers have shown their love for Nintendo DS - 100 million times over.” He also expressed his gratitude to Nintendo’s customers and reaffirmed Nintendo’s commitment to provide new experiences stating, "We are grateful that people of all ages continue to respond to our products, and we will continue to look for ways to please current gamers and create new ones."

One of the new experiences offered by Nintendo is the third iteration of the DS, the Nintendo DSi. Nintendo devoted a full paragraph for promoting the new DS in their press release. The Nintendo DSi launches in the United States on April 5 and includes two cameras and the ability to record, manipulate and play sound files.
According to the press release, 83 Nintendo DS titles have exceeded 1 million copies shipped as of December 31, 2008. Seven of these titles have topped 10 million. Nintendo proudly declared games like Nintendogs and the Brain Age series began a paradigm shift for the industry. Nintendo was able to grow the traditional audience for video games beyond young men to include girls, adult men, women and even seniors.
On top of the success enjoyed by their more innovative games, traditional game franchises like New Super Mario Bros. and Mario Kart continue to see success. In Nintendo’s own words Nintendo DS games demonstrate an "evergreen" quality. They frequently remain in the top-selling lists, months or even years after their launch.

(Source.)

World Wide Web Returning to Year 20

Date 13 March 2009 is the anniversary of the World Wide Web to-20. On the day that Sir Tim Berners-Lee found a world of technology modifier internet in 1989. Not denied that this simple technology has brought great changes to human civilization and to this day still growing.

Not extracted success world wide web, Berners-Lee has some brilliant ideas about the direction of the evolution of web technology. Berners-Lee's vision is that new progress could be a foundation for innovation that we can not even imagine today.

One year ago, Berners-Lee said that all the components needed to build the new semantic web has been completed. Months ago he was giving a speech at the TED conference about a new concept called the "Linked Data," the idea that he express first time in 2006.

To see your own vision of Berners-Lee on the web, below I have a speech tanamkan video Berners-Lee at TED months ago. (via RWW ) (via RWW)

U.S. $ 250,000 To You

Wow ,,,,,
Gifts have the U.S. $ 250,000 from Microsoft to anyone who has found a worm Conficker. worm Conficker move so quickly through the slit of the slit Microsoft Windows. Conficker also able to turn off anti-malware protection, and will block the infected computer that can’t access the virus protection.
Just imagine, conficker has even spread to france military machine, in which combat aircraft navigation france participate exposed dampaknya.Symantec reported more than 2.2 million IP addresses that are only within 5 days have been infected conficker.
Now the Microsoft has been working with Verisign, NeuStar, Public Internet Registry, Global Domains International, AOL, and F-Secure, George Tech and several other organizations to capture the conficker.

Source.