#ciphercloud

Partners with Oris4 and mxHero to help extend new use cases for Box in the enterprise

SAN JOSE, Calif., Sept. 2, 2014 – Today, CipherCloud, the leader in cloud information protection, extends the reach of its CipherCloud for Box solution by enabling enterprises to centralize their sensitive content inside Box through technology partnerships with Oris4 and mxHero. Oris4 and CipherCloud are also partnering to enable customers to connect into all cloud and in-house storage services to track, analyze and centrally manage their files.

CipherCloud enables users to access powerful cloud discovery and data loss prevention (DLP) tools that help enterprises align data controls with industry and government specific privacy requirements. CipherCloud for Cloud Discovery provides the first step to mitigating shadow IT by identifying and analyzing cloud applications and usage. The solution enables companies to identify applications that pose security risks to sensitive data and through Oris4 or mxHero send data to more secure environments, such as Box. Then, CipherCloud for Box provides enterprises a cloud DLP engine to set granular policies around data access. Users can enforce a range of actions including alert, block, restrict sharing, or quarantine sensitive files to ensure compliance while preserving functionality within Box.

In partnership with Oris4, CipherCloud provides the ability for companies to connect into all online and in-house storage services to track, analyze and manage its vast array of files and documents. “We give you the power to find any digital information in your business and work with it immediately,” said Reza Kazemipour, CEO, Oris4. “With CipherCloud and its DLP capabilities, organizations can classify their content and leverage Box as their central repository and collaboration platform.”

“Our mail2Cloud solution combines email tracking and cloud storage with any email system,” said Alex Panagides, CEO of mxHero. “Together with CipherCloud, we enable employees to be even more productive by storing their emails and e-mail attachments in Box that can then be closely monitored and secured.” Combined with mxHero, CipherCloud’s powerful tools can scan Box repository for e-mails and attachments based on DLP rules to determine proper handling in Box. With mxHero, employees can then securely send files as Box links instead of email attachments.

 “Increasingly, enterprises are relying on enterprise cloud collaboration solutions such as Box to connect with internal and external constituents,” said Dev Ghoshal, SVP of Global Alliances, CipherCloud. “Today’s announcement reflects the need we see in the market for extending compliance and privacy policy settings for various cloud collaboration scenarios. Technology partners such as Oris4 and mxHero enable us to go broader across applications with greater depth of controls and use cases.”

CipherCloud will be at booth #18 at BoxWorks 2014 (Moscone North Hall) in San Francisco, CA.

In many industries, cloud computing is now vital to remaining competitive. The cloud typically offers superior flexibility, scalability, accessibility, and high availability, enabling businesses to grow more agile and responsive. Regulatory compliance concerns often make banks and other financial service providers slower to adopt the cloud, but even in the financial services industry, the cloud will soon become a necessity.

Banks are already seeing attractive use cases for cloud computing, as Bank Systems & Technology's Bryan Yurcan and Jonathan Camhi pointed out late last year. Cloud-based payment processing is one hot topic. Cloud-based document management is another. Analytics for business insight and fraud detection are also growing popular. However, all of these applications will require a thorough understanding of the regulatory restrictions and how to comply with them.  One of the most essential tools to make sure your cloud adoption meets regulatory requirements is cloud data encryption.

What to Protect PCI DSS mandates the protection of customer account data, which you'll need in order to process payments in the cloud. Per PCI DSS 3.0, that data includes:

Primary Account Number (PAN)

Cardholder name

Expiration date

Service code

Full track data from cards' magnetic stripes or chips

CAV2/CVC2/CVV2/CID

PINs or PIN blocks

PCI DSS requires organizations to "use strong cryptography and security protocols" for the transmission of sensitive cardholder information. Some of these fields are more sensitive than others, however. PANs are more sensitive than expiration dates, for example, while verification codes and PINs are so sensitive that PCI DSS outright forbids the storage of them after the transaction is completed. Your cloud data encryption strategy should include the ability to apply varying strengths of encryption at a granular, policy-based level so that you can apply the appropriate amount of protection to each data type.

Here are some best practices that can help you use cloud data encryption to safely make the most of the cloud.

Cloud Data Encryption Best Practices

Identify every piece of sensitive data you're sending to your cloud applications and develop policies to apply appropriate levels of encryption to them. You'll need to work with all lines of business using the cloud to determine their exact uses for it and their cloud encryption needs.

Encrypt or otherwise protect all sensitive data you handle before it leaves your premises.

Encrypt and do not store the most sensitive cardholder and authentication data: full track data, card verification codes, and PINs and PIN blocks.

FierceCIO makes a regular point of examining hot and emerging job roles in the IT ranks, but every now and then an especially unique job title crosses our path. One of these is the chief trust officer, a role that may find itself gaining favor at IT vendor organizations--especially those in the cloud computing space.

We spoke with Bob West, chief trust officer at CipherCloud, about this position, what it's all about, and what the career implications are for those who succeed in the role.

FierceCIO: How long have you been in the role of chief trust officer and are you the first in that role at your company?  West: I joined CipherCloud in February and am the first person in this role at CipherCloud.

FierceCIO: What exactly are the responsibilities of that role?

West: The chief trust officer is an advocate for the customer. It's my job to make sure there is proper support and alignment between the customer and CipherCloud.

FierceCIO: What was behind the initial creation of the role? West: The idea was to extend CipherCloud's commitment to delivering trust in the cloud by bringing in someone with a strong track record in a customer industry--in my case, the financial sector. That person would understand the security, privacy and compliance challenges our customers face and be able to advise these organizations on how to mitigate these risks.

FierceCIO: What background did you have that played a role in you getting the position? West: I worked in technology and security at major banks for about 20 years and consulted for almost 10 years. During this time, I was the CISO at Fifth Third Bank and Bank One.

FierceCIO: What are the mandates or marching orders being given to you in this role?  West: My mandate is to spend the majority of my time with customers so I can listen to their needs and counsel them on how to best adopt the cloud. 

FierceCIO: How common is this position, and who does someone with this title traditionally report to?  West: The position typically reports to the CEO. It's a relatively new role that we're predominantly seeing at cloud service provider companies, like Salesforce and Box. In our case, we are a software provider, but we partner deeply and broadly across many cloud applications, so it makes perfect sense for us to have this "other" CTO role.

FierceCIO: What current and pending trends in business and technology or with your customers and partners are likely to impact or change your role in the near future?  West: The vast majority of businesses are moving to the cloud aggressively, and we don't see that trend changing in the foreseeable future. 

FierceCIO: What would the ideal chief trust officer candidate look like to a recruiter? West: Key is someone with a background that can build trust inside the company as well as with its external ecosystem of customers and partners. 

FierceCIO: Assuming that ideal candidate isn't available, what Plan B should a recruiter have? West: Like for any other c-suite role, don't settle.

FierceCIO: What are the career opportunities for individuals that are successful in this role?  West: Given the chief trust officer's work with the rest of the executive team, other leadership roles--such as CEO or head of corporate strategy--could make sense as a next step.

CipherCloud announced the availability of Cloud Discovery, a product that gives enterprises insight into the set of cloud applications used by their employees. In addition to enumerating the cloud applications that employees use, Cloud Discovery provides customers with a risk score associated with each of the cloud applications used by its employees. Based on over 10 variables, the risk score identifies the degree of security associated with each cloud platform toward the end of identifying cloud applications that pose a security threat to the company’s IT infrastructure and data. The screenshot below illustrates a sample Cloud Discovery dashboard as follows:

Conceived as an expansion of its Discover, Protect and Monitor platform, Cloud Discovery constitutes a free product offering from CipherCloud that extends the ability of the “Discover, Protect and Monitor” platform to identify potential security threats before they morph into more significant security breaches. The Discover, Protect and Monitor platform provides customers with analytics that alert them to uses of their platform that may suggest security threats such as aberrant usage patterns as represented by application usage, unusually high data flows or suspicious alterations to existing security protocols and permissions. Cloud Discovery empowers IT administrators to perform early stage analysis of the range of cloud applications used by employees by detecting usage of any applications by means of the analysis of log and machine data in collaboration with Splunk, the machine data analytics company that went public in April 2012. Overall, Cloud Discovery constitutes yet another enhancement and key differentiator for the CipherCloud platform that, as part of its Discover, Protect and Monitor product offering, delivers cloud analytics alongside CipherCloud’s core encryption product. With the release of Cloud Discovery, CipherCloud continues to sharpen its branding and value proposition as an integrated cloud security platform as opposed to a pure encryption play, which renders the company even more appealing for customers and investors, particularly given the intensity of contemporary concerns about potential security breaches associated with using cloud-based service providers and applications.