Throughout you’ll learn about some cutting edge security research about the risks around deploying cloud services.

Cloud services such as Amazon’s EC2 and IBM SmartCloud allow users to create and share virtual images (AMIs) with other users. In addition to these user-shared images, the cloud providers also provide AMIs that have been preconfigured with popular software such as open source databases and web servers.

This talk explores both the privacy and the security risks associated with renting and using public AMIs from cloud computing providers. We will present SatanCloud, our automated system that we used to analyze and test over 5,000 server images provided by Amazon in its four data centers of US, Europe and Asia. From our analysis, we discovered that both the users and the providers of public AMIs are vulnerable to security risks such as data leakage, unauthorized access, malware infections, and loss of sensitive information. All our findings have been acknowledged by the Amazon’s Web Services Security Team that has already taken steps to properly address them.

To watch the webinar click here.

Marco Balduzzi’s slides are available here.

Mykonos Software’s slides are available here.

We are excited to join the Juniper Networks family and believe that the cultures and mission of both organizations are strongly aligned. Both of us share the vision of transforming the security industry and changing the ROI of hacking by making it costly, time consuming and tedious for attackers. Juniper’s strong history of technology execution combined with Mykonos Software’s innovative Web security product ideally positions us to deliver an end-to-end security portfolio that provides an always protected environment across devices, applications, the network and the cloud.

Our CEO, David Koretz said it best: “We believe the combination of Mykonos’ groundbreaking technology and Juniper’s proven expertise in developing and productizing some of the industry’s most disruptive innovations, will deliver clear advantages for customers that reduce security risk and lower total cost of ownership. We are excited about the opportunity to leverage Juniper’s world-class organization and market-leading product portfolio to deliver tightly integrated, proactive web application security to customers.

Since our company was founded in 2009, we have been acknowledged as an industry innovator bringing to market our intrusion deception product – the Mykonos Web Security – to help solve the problem of hackers on website and web applications.

This acquisition will help bring this solution to a wider market and Mykonos Software customers and partners will benefit from Juniper’s scale, expanded product portfolio, strong services capabilities, enhanced go-to-market approach and commitment to customers.

This is an exciting time at Mykonos Software. The RSA Conference is going to be very different next week as we launch as a Juniper Networks Company.

View Press Release

Also an interesting quote from anonymous in this article from the SFGate.

BART “stored their members’ information with virtually no security,” the hackers wrote. “Any 8-year-old with an Internet connection could have done what we did to find it. On top of that, none of the info, including the passwords, was encrypted.”

http://www.cnn.com/2011/BUSINESS/06/06/cybercrime.cost/index.html?&hpt=hp_c2

http://www.guardian.co.uk/society/2011/jun/09/nhs-computers-hacked-lulzsec

http://news.yahoo.com/s/nm/20110603/tc_nm/us_sony

It would seem that the success of the initial attacks might have encouraged others to try their luck on other Sony web properties. The impetus for this might be that if Sony’s Playstation Network can be that susceptible to an attack, some hackers might wonder what else might be up for grabs. It could very well be that Sony utilized the same approach to application development and thus suffer from the same Achilles’ heel elsewhere, or that they may not have a sufficient security practice in place to thwart attacks. Beyond this, another possible weakness that many organization suffer as a consequence of doing business is that new improvements are often times stacked on top of pre-existing older code, which can be like stacking new bricks on an old house over time, the other portion then to fail under stress and weight of the newer layers. This is further complicated by the fact that employees (i.e., developers) do flow in and out of an organization; so when developers leave, others that fill their place and assume responsibility for their code might not necessarily be aware of existing underlying issues or write code in a consistent or secure manner, which leaves room for weaknesses.

The scary truth is that at the end of the day, Sony is not unique in the issues they face. The challenge is there for almost every company out there for the same reasons above.