#IBMSaaSAssist - CrowdChat

SaaS & Security

Using SaaS security software to gain an advantage

#ibmsaasassist @bob_suter @guyclapperton @mikespradbery @the_saassist @peterjopling

LeaderBoard

Stream Ended

Establishing a secure connection

Guy Clapperton11

What can an ISV do to reassure prospects of the security of their code? (ISVs welcome to comment!)

[+] Show Hidden Comments

look a secure deops, designer malware is platform specific

finding bugs as you write code saves time and money at the preproduction phase

you also need to secure the app binary against advanced malware

Useful thoughts. Are these specific to the cloud or were they issues before, with on-premise?

designer malware targets mobile devices primarily

Developing an app with security in mind applies to both

Guy Clapperton7

What are your concerns regarding EU General Data Protection Regulation and the Cloud?

[+] Show Hidden Comments

Mike Spradbery @ IBM

isn't this a case for UK to stay in EU??

cross border and sovereignty need to be accommodated

@MikeSpradbery (GETS POPCORN, PULLS UP CHAIR)

make sure you have a Data Controller in place as they're accountable for your data

@MikeSpradbery Please expand...

Mike Spradbery @ IBM

@The_SaaSsist regulation more simple across borders? businesses say stay http://www.itv.com/n... @itv

@MikeSpradbery So does the President of the USA - there are certain controversies about this, so I understand.

Mike Spradbery @ IBM

yes... just a thought, not necessarily my position! but will impact Cloud & regulation I think

Guy Clapperton3

What are the security considerations of using Public Cloud Platforms?

[+] Show Hidden Comments

Mike Spradbery @ IBM

who owns data, where is it stored, how backed-up, who can access, who can audit...

makes sure the service is legitimate and not a bogus site

Mike Spradbery @ IBM

are mobile apps secure, is data in transit secure, privileges, data retention...

look at the T&Cs regarding the data, you may loose control

Also the SLAs and exit agreements seem important to me. Remember 2E2 going belly-up a few years back?

...you do need to know what happens when a company ceases to exist - that's true of private and hybrid, too.

where's the site hosted. There maybe local legal issues to data retention /access by 3rd parties

@PeterJopling Yes. The US Patriot Act is well known but are there other examples?

ensure the site complies with the regulations for your business

PCI compliance for retail

Here's a perspective http://ibm.biz/CldSe...

Guy Clapperton3

The Internet of Things will have its effect on security as objects can be hacked. Has anyone come up against this yet?

[+] Show Hidden Comments

Mike Spradbery @ IBM

yes; interesting, esp where safety is more important than security

Mike Spradbery @ IBM

also, some #IOT devices have very long life, 10+ yrs. Makes future-proofing hard

@MikeSpradbery Cars seem an immediate concern http://fortune.com/2...

@The_SaaSsist Imagine being able to hack the emergency services' vehicles. But is there substance to this or is it panic?

Guy Clapperton2

What are your concerns regarding the Cloud threats from malware/Zeroday attacks?

[+] Show Hidden Comments

detecting zero day needs advanced heuristics and analystics

threat actors are constantly changing the malware to evade signature based detection

Mike Spradbery @ IBM

who is likely to have better protection, your org or the cloud provider?

ensure the service utilises horizon based detection and real time update service

Most legacy IOT devices, ie process control, were never designed to be IP enabled/secured

[+] Show Hidden Comments

Look at the 3rd party compliance to Security and what's the DR plan

[+] Show Hidden Comments

DR meaning disaster recovery - a good point.

Guy Clapperton1

The crowd has been relatively quiet but I hope the insights on offer have been valuable. The entire chat will be available online afterwards.

[+] Show Hidden Comments

Mike Spradbery @ IBM1

MEAP - mobile enterprise application platform, provides security and much more

[+] Show Hidden Comments

Thanks.

Guy Clapperton1

What can third parties do to reassure people about the security of their mobile solutions?

[+] Show Hidden Comments

Mike Spradbery @ IBM

use a MEAP to detect hacked apps, block jailbroken devices, provide encryption...

Let's pretend I don't know stuff...what's a MEAP?

You'll need measures at app, data and device level

BYOD adds greater flexibility to the organisation, beware of Jailbroken and older OS on devices

@PeterJopling I know very few tech support people who really welcome BYOD all that enthusiastically.

@MikeSpradbery MDM is critical for BYoD

@PeterJopling Mobile Device Management

Mike Spradbery @ IBM

https://en.wikipedia... ;-)

@PeterJopling What can you do with MDM to protect yourself?

thats because they may not understand that technology can reduce the risk considerably

Mike Spradbery @ IBM

@PeterJopling yes, but often not welcome. Has to be low-touch & low-impact to users

@MikeSpradbery Even if something's high impact, they'll accept it if someone has explained it properly. It's the "unexplained complex upgrade" that causes most of the friction, I find.

@The_SaaSsist make sure the OS is uptodate , and be aware of free wifi hotspots!