RSAC

I can't drop the cloud in a gutter...

@dgourlay Or leave it at a TSA checkpoint

Convenience and centralized management/authority are big selling points of the cloud. The challenge is balancing that with convenience of local device security and performance - I can't do Excel in a browser.

Mobile security session looks interesting @barracuda we should get BJ Jenkins on @beege15 the chat https://www.rsaconfe...

but I can also control who has my USB key and I have to trust a 3rd party with no real audit optics I can see when I trust the cloud...

@leonnyan Local is preferable in the current model, but vendors like MS, Google, IBM would increasingly prefer users to do so. Excel in the cloud is the way that MS is going.

sure but if you are on an airplane, access to the cloud is not an option or slow (even though you are in the cloud)

@dgourlay you can control who is using it and manage their USB key with IronKey.

There are a set of services that will be highly unlikely to make it into the cloud though and will always be on-prem or at least privately hosted..

@Marina__Donovan Oh I know - and that is awesome. My only point is I can drop it and lose it. It is much harder to lose my cloud :)

@dgourlay Which services do you think will be most unlikely to go to the cloud?

@mosterman The preference today for hub-and-spoke clouds today I agree - very on-trend. But, what happens when I have 1TB of local storage on my portable device? Why would I use a centralized storage hub from a 3rd party vendor?

@mosterman I'll probably differentiate unlikely to from never will - but ones I would want to keep control over - DNS, Single-Sign On/AD, etc. Biz apps depend more on the nature of the regulatory environment and the skillset of your team...

I once found a USB drive in an airport lounge that had was loaded with account numbers and personal financial info. Secure USB requires that people actually implement the security mechanisms.

and back up an encrypted image of your device is you are worried about losing it. that is safe in the cloud

@pgillin great point Paul. The human error component is huge how does that get managed. Iphones have biometrics now is there a way to do this?

@pgillin @furrier Users will continue to be the weak link in the security chain no matter what vendors or IT do to enhance security. And, since it takes only one user to make a mistake, the problem will continue.

If organizations deploy secure USB like #IronKey, that can be managed. Your bases are covered. We manage the device and can remotely disable.

@Marina__Donovan @furrier That points to the critical nature of keeping IT in the loop and in charge of security even in an era of BYOD/A/C

John, think about two-man rules as well to address human error, human compromise. For fun Google Cisco's former SE: Terry Childs

@Marina__Donovan You can disable the USB drive when it is not plugged into something?

@dgourlay @Marina__Donovan crypto keys have the same idea

You need to plug in device and try connect to Internet. If it's been reported as lost or stolen, IT can remotely disable.

@mosterman security in the user workflow and ease of use play a key part in giving the end user a secure foundation. IT always plays catch up in todays world. Security imbedded (and transparent) in the user workflow is key.

Biometric offer speed of use for end users ensuring security is used on the device, BUT, biometrics have targeted applications.

@leonnyan > Only a matter of time. Google Docs work pretty well in a browser

@rolfwagnerjr I wonder the new biometrics with integrated sw - again i'm not an expert in biometrics but it's awesome on iphone

I'm tweeting from Palo Alto, CA

Excited to be here and get the conversation going

I just landed in Washington DC, Dulles actually - greetings from Reston, VA

Greetings from sunny Seattle

I figure you cannot have a security chat without someone near DC listening - or speaking...

hi from Campbell, CA

Thanks

good to be here

So John, what is the hottest topic/technology going to be this year?

Use @ to reply

a long standing issue is the concern about insider threats

a la snowden

IMO, a key issue will be well-intentioned insider threats: employees using file sync and share tools, leaks from geolocation data, BYOD, etc.

@Marina__Donovan no single user or user credential should be empowered to destroy an enterprise or compromise too much data

@mosterman I wonder why we trust users at all... ;) We users do really stupid things - IT would be so much easier without them...

Another key issue will be phishing - an increasingly top of mind issue, particularly given the recent White House data leak that started with a successful State Dept. phishing incursion

@dgourlay Good point!

@mosterman Why don't we just treat all users on campuses, branches, etc just like they were at Starbucks or Home - require hardened policy enforcement point/proxies to get in/out...

Would users balk at that and be driven even more to personally owned devices, apps, etc.?

@dgourlay Would users balk at that and be driven even more to personally owned devices, apps, etc.?

@mosterman Some senior government officials seem to use BYOD or BYO Server exclusively... Most Silicon Valley corp types do now too :)

@dgourlay @furrier I believe that IT has more or less acquiesced to BYOD/A/C and are increasingly becoming strategic advisors, not system managers in their attempt to maintain security

@mosterman They may balk at it, or they may embrace it... Are users using their own phones/iPads/Macbooks a bad thing or a good thing? Jury may still be out...

@dgourlay @furrier Probably good and bad in most organizations: users can be more efficient, but it puts the onus on IT to become more proactive from a security perspective. They need to take on more of an advisory and leadership role.

@mosterman IT needs to define the sandbox for employees to work in. Totally agree. But the sandbox becomes mixed with BYOD.

@rolfwagnerjr what's the implications of this mixing with BYOD? is it a config or versioning issue

@dgourlay > Makes perfect since, since they usually are.
.@starbucks

config, yes. versioning, yes. Privacy mix becomes an issue, work privacy and personal privacy.. becomes complicated.