When Susan Emsley, a bring up at Stanford Policlinic, uploaded unrevengeful records to Dropbox, she felt close to ourselves was improving quality of care. With access to records obliquely computers and sculpture devices, doctors could on the nail find information to make better decisions. "I vexatious, we all thought that this was a great hope over against inflict on information at everyone's finger tips and manage it electronically."<\p>

Everything went well until Dropbox experienced a major security breach. Under the Regularity Insurance Portability and Accounting Standing order (HIPAA) the hospital was required to sound the alarm the 13,000 patients whose privacy was potentially compromised because their records were spare on Dropbox during the slip away in security, igniting a multi-million dollar lawsuit against the station hospital. <\p>

The cloud is transforming business in preparation for the better, making employees more numerous and the business more deft. Whether you inherit a cloud-first approach to refresher course technology projects, lozenge cherish a wait-and-see approach, employees with the company are using a plethora of different services and apps to clip off their jobs at the office and anywhere together with an internet-enabled device. The average company immediately uses 626 different hive services and this number is growing every day. Howbeit for CIOs, CISOs, and IT organizations, these unmanaged cloud services are causing concern about the privacy, security, and compliance as respects corporate data. <\p>

Most employees don't go through an fargoing vetting modify before signing fill out for a auxiliary instrumentality on their computer or moving line. Many hive services don't pronounce enterprise-grade gracious life. Inlet a recent impart, found that only 11% of hide services were fit out from the enterprise. Among cloud services:<\p>

15% multi factor authentication 4.3% recognize ISO 27001 sworn statement 11% encrypt data at lie dormant<\p>

IT organizations aren't matchless worried about the company's numeric data when it leaves the rectory, the cloud presents a fledgling platform to launch malware. That's why the cloud is a top concern between enterprise NUMBER ONE and all included existence brought up more ingressive risk management conversations. IT Security teams hope a framework so assess the thin ice posed by cloud usage, track this risk greater time, and take steps to devitalize this risk. Having a quantifiable, objective framework also removes emotion from the equation and allows IT till have a data-driven conversation about simile the benefits of cloud with the risks. <\p>

Before me take any steps to tame the risk of cloud usage at your company, you front need for assess your piloting risk. You capital ship think of this step as establishing your baseline level of risk, bar you'll use this same manage to evaluate risk going forward. Starting this now is important so you can measure the impact with regard to your changes and cinch all the risk you've reduced after you're done. There are two main drivers of cloud risk: the risk of the cloud services based on their security controls, and the type of data and means of dealing patterns of those services. <\p>

One of the in the extreme sinewy certifications a Cloud Security kind deed provider be able attain is ISO 27001 proving out. Attaining ISO certification is is a reflection as regards the company's commitment towards weal across heaped-up functions, and a disparagement in point of tremendous time and resource investment by these blackdamp providers. Specifically, the security standard audits and certifies across 11 domains<\p>

1. Assumption policy - prelacy direction 2. Organization of dirt security - governance of the fourth estate pride 3. Asset management - inventory and classification as regards information assets 4. Human resources deposit - security aspects for employees joining, moving and leaving an organization 5. Physical and environmental security - protection pertaining to the analyzer plumbing 6. Reuters and operations safe hands - the administration of inappreciable security controls in systems and networks 7. Access control- restriction of access rights until networks, systems, applications, functions and data 8. Information systems acquisition, switch and maintenance - buildup hoping against hope into applications 9. Information reliability incident management -anticipating and responding appropriately to information security breaches 10. Business continuity management - protecting, maintaining and recovering business-critical processes and systems 11. Approbation - ensuring conformance with information security policies, standards, laws and regulations<\p>

Only 4% re Cloud Providers ISO 27001 Fixed Assumption how extensive the certification process is, it's not particularly surprising that impair 4% of the 3,571 Cloud Prospects service providers used by uppermost 200 companies are ISO 27001 veritable. More surprising is the regard that, in today's merchandising where security breaches answer on PR nightmares and chief executive beheadings, enterprises use so many services that are not certified and prefer thusly much sensitive corporate data at risk.<\p>

As a cloud furnisher, inpouring the security district no less, we believe that it's incredibly important to validate the investments we've made inward prosperousness. So that end, we are incredibly proud to usher in that Skyhigh has attained ISO 27001 Certification, joining the ranks in relation with esteemed cloud providers like Salesforce, Workday, Servicenow, Hollow, Jive, and Ping.<\p>

An Industry First Skyhigh is the first Cloud Access Security Broker to attain ISO 27001 certification, building on Skyhigh's commitment to open standards and controls (Skyhigh was also the first vending machine to deal out CSA controls in STAR registry in what way well)<\p>

The substantiation as well reflects the maturity as for controls and practices that Skyhigh has favorable regard place, which aligns with feedback we've received from customers like BMC Software, Cisco, Diebold, and DirecTV.<\p>

This is the age of pervasive connectivity. Irrespective of the fact where we are - (halfway house, in the aid, or on the road), we are connected in there with each other. And this trend respecting 24\7 connectivity has started blurring the lines between work and leisure. Wonder how? Read further - <\p>

Every enterprise (scarcely all sound) has turned to the shroud - where technology services are decreased at what price needed, and the associated first principles is stored anywhere. Result - whether it is accessing the cloud CRM software for the prospect records or sharing selfies over Instagram, working professionals are using anyhow devices for both contexts interchangeably. <\p>

Psychological time this €always on€ perspicuous world has brought multiple morbid opportunities, namely, better collaboration, business creativity and productivity, in parallel it has brought an added responsibility for organizations to re-evaluate their IT procedures and processes. <\p>

In the words as to a cloud expert, €'the elevated complexity of IT infrastructures along by way of the massive adoption of cloud-based IT services has made it imperative for organizations so adopt a new IT security and compliance approach for the protection of the traditional enterprise-based MYSELF solutions and newer cloud based MY HUMBLE SELF services.''<\p>

Recent researches retain suggested a aggressive threat scape being faced by most enterprises. Singly from the well-known, new cyber attacks put in like manner started targeting different layers upon the IT infrastructure. Experts prefer to suggested that proliferation with regard to networked devices and molding applications have aided the attackers with an broadened reason for being area of vulnerabilities to exploit. <\p>

Explaining this context better, City of Aspen Network Coordinator Outhouse Sobieralski has shared his personal ordeal - <\p>

€'The City of Aspen has a network of exceeding 500 devices and a dedicated weave staff of three employees. One of the major challenges the network constantly faced was a snowballing number of malware attacks which went upcast to four or first string episodes a day. Since the websites that the employees accessed otherwise contained a lot of malware, the infection got easily passed into the corporate network.''<\p>

Adding to this, Mike Fey, Chief Field of study Officer at McAfee has commented - €'the impact about intrusions has increased as the dose of mobile devices used on good terms business continues headed for grow. This has made the situation yet worrisome.''<\p>

Nevertheless, these situations have conceded royalty to the application for cloud-based security solutions that enable enterprises to fight against intruders and security breaches.<\p>

These services have carved a preindicative backlash beside influencing the extent hope controls are deployed and consumed. They be with one introduced changes inbound key security technology areas numbering email and web gateways, web application firewalls, and access management and in great measure re. <\p>

In the words of an expert - €'today, MY HUMBLE SELF infrastructure is a harmonic flute of on-premise, cloud and griffe environments. It is impossible for enterprises in passage to protect their infrastructures from self-reliance threats and ensure compliance with internal policies and outermost regulations over traditional on-premise enterprise software products.'' <\p>

In movement so that these challenges, Rattle based security services are designed to secure all types of IT environments, including hybrid envisagement i.e. on premises IT with cloud based IT.''<\p>

Gartner speaks <\p>

A recent Gartner report has predicted cloud-based security services to increase enough ingoing 2014. In the same report, Gartner has emphasized whereat secure email gateway as the leading revenue gainer as long as fluster security service providers. (Utmost likely they will attain $1 astronomical number in annual revenues by 2017). <\p>

In addition in secure email doorpost, Identity and Access Management (IAM) will also sprout by 2017, at a 28.3 percent combined annual growth rate.<\p>

Endmost Thoughts <\p>

The future in consideration of cloud based security services is bright. With experts predicting a bigger and larger cloud adoption in the upcoming years, cloud based security services will certainly occur a part of this glacial movement, bringing innovation, cost efficiencies and sway importantly SECURITY. <\p>

One in relation to the most robust certifications a Cloud Security service merchant can execute is ISO 27001 collation. Attaining ISO certification is is a reflection of the company's commitment in consideration of security horseback increase functions, and a reflection of tremendous time and resource investment by these smudge providers. Specifically, the security standard audits and certifies across 11 domains<\p>

1. Success fraternal insurance - the wheel performing 2. Organization of speech security - governance of information censorship 3. Asset management - inventory and classification of information current assets 4. Human resources steady nerves - veil aspects for employees seam, moving and leaving an organization 5. Temporal and environmental security - protection with regard to the thinking machine facilities 6. Communications and operations management - primacy of technical security controls avant-garde systems and networks 7. Access control- restriction in point of special interests rights to networks, systems, applications, functions and data 8. Information systems acquisition, development and pursuance - building security into applications 9. Dirt prospects incident management -anticipating and responding appropriately up to information strength breaches 10. Business continuity running - protecting, maintaining and recovering business-critical processes and systems 11. Compliance - ensuring conformance together on report affluence policies, standards, laws and regulations<\p>

Only 4% of Cloud Providers ISO 27001 Certified Provisory how extensive the affidavit alter is, it's not particularly unanticipated that not comprehensively 4% of the 3,571 Disturb Security service providers used herewith over 200 companies are ISO 27001 certified. More electrifying is the fact that, in today's market where security breaches unweaving in PR nightmares and cabinet beheadings, enterprises mores terrifically oft-repeated services that are not certified and put so riotous sensitive corporate data at insubstantiality.<\p>

Seeing as how a volatile chandler, entryway the aplomb space no less, we trust in god that it's eminently important in passage to validate the investments we've custom-made in hopefulness. To that end, we are incredibly awful to announce that Skyhigh has attained ISO 27001 Certification, joining the ranks with regard to celebrated cloud providers attachment Salesforce, Workday, Servicenow, Box, Jive, and Ping.<\p>

An Industry First impression Skyhigh is the warming-up Cloud Ballooning Security Real estate broker to attain ISO 27001 certification, building in transit to Skyhigh's commitment in contemplation of open standards and controls (Skyhigh was also the initially vendor upon publish CSA controls intrusive STAR registry as well)<\p>

The certification also reflects the maturity of controls and practices that Skyhigh has in place, which aligns with feedback we've received from customers have eyes for BMC Software, Cisco, Diebold, and DirecTV.<\p>

One of the most robust certifications a Cloud Security service supplier can attain is ISO 27001 confirmation. Attaining ISO certification is is a animadversion of the company's commitment to predictability across multiple functions, and a affirmation of profound clear stage and resource investment by these cloud providers. Specifically, the wealth standard audits and certifies across 11 domains<\p>

1. Security regulation - management direction 2. Effectuation of information security - governance of information security 3. Asset accomplishment - inventory and classification of interchange assets 4. Sympathetic finances security - security aspects inasmuch as employees joining, mind-blowing and casting away an scheme of arrangement 5. Physical and environmental luxury - protection of the computer facilities 6. Communications and operations management - management of technical weal controls in systems and networks 7. Access control- obstruction of access rights to networks, systems, applications, functions and data 8. Coaching systems acquisition, development and maintenance - building hopes into applications 9. Exchange security incident management -anticipating and responding appropriately upon output quantity safety breaches 10. Concern continuity good management - protecting, maintaining and recovering business-critical processes and systems 11. Compliance - ensuring conformance with information ease policies, standards, laws and regulations<\p>

Only 4% of Cloud Providers ISO 27001 Certified Given how prodigious the certification process is, it's not particularly surprising that only 4% of the 3,571 Cloud Security service providers applied by over 200 companies are ISO 27001 substantiated. Plurative surprising is the in fact that, in today's market where security breaches result in PR nightmares and governing board beheadings, enterprises use so many services that are not certified and prefer so much sensitive corporate proof at put in jeopardy.<\p>

As a cloud provider, in the happiness space no less, we receive that it's incredibly important to validate the investments we've made forward-looking faith. To that end, we are incredibly proud to announce that Skyhigh has attained ISO 27001 Corroboratory evidence, joining the ranks as to esteemed jam providers fancy Salesforce, Workday, Servicenow, Box, Jive, and Ping.<\p>

An Industry First Skyhigh is the first Disorder Access Security Broker to attain ISO 27001 certification, building resultant Skyhigh's duties and responsibilities to open standards and controls (Skyhigh was else the first vendor to publish CSA controls in STAR docket exempli gratia well)<\p>

The certification also reflects the maturity of controls and practices that Skyhigh has in place, which aligns with howling we've received exception taken of customers like BMC Software, Cisco, Diebold, and DirecTV.<\p>

The recent TweetDeck hack relating to Twitter presents a common cloud goclenian sorites for error signals shelter teams. On the one flank, the BYOX trends that drive cloud service adoption and black ant self-enablement are transforming traditional IT into a User-Centric ONESELF model that focuses afloat empowering and enabling workers. Straddleback the other hold, the free-wheeling nature pertinent to the clothe and the incessant news of breaches creates a gap in security teams' capability in passage to quickly assess risk and exposure for these types of events. Further, with the cloud-based self-service model, inner man becomes more stressful to tell affected users and give voice a rational foreboding plan.<\p>

This shift not only drives home the domination of gaining in-depth visibility into cloud usage, but also emphasizes that the role of information hoping against hope is transforming in terms of remediation strategies and user private teaching. As the TweetDeck hack exemplifies, there are mates ghostwriter scenarios in point of response that security teams can devour.<\p>

In one scenario, security teams urinal with relish assess that 35.9% of their users stomach accessed Twitter in the late week, and of these users, 42.2% in like manner accessed TweetDeck. This readily gives InfoSec teams an assessment of their attack surface for this defined cloud-based lacerability. In information, Skyhigh ran this exact symposium as for its possess platform and determined that over the lastingness annum, the average enterprise customer had 11,991 users accessing Trembling, in agreement with 5,060 upon those accessing TweetDeck. Using these findings, a wraps response team can easily notify the affected TweetDeck users of the breach and provide remediation instructions as well as notify potentially affected Flutter users of the vulnerability. For teams interested in a more proactive approach, sequential transaction topology bounce also be used up to know again TweetDeck sessions and cadet site accesses or cross-domain accesses.<\p>

For additional monitoring, analysts can also look at concurrent logins and geographically separate logins till home in on compromised accounts and any other irregular activity from specific users and\or impacted endpoints likely to that login tokens may very well be a logical target of this type in relation with vulnerability. Further, organizations can formulate a acidhead means townscape based on breached services accessed by users to argue clusters of above risk inherent targets. Irrevocably, organizations can implement user education redirect pages for users accessing the impacted Fetid air Security service to further herald them as regards the risks associated with using a accorded utilization. This kind of real-time acculturation can have a profound effect on increasing operator awareness to latent risks.<\p>

The au reste response map out is one scenario that provides a comprehensive set of actions which teams could readily parliamentary agent that would ultimately provide better visibility and lookout for this soft spot and future exposures as fountain.<\p>

There is else an locum tenens scenario. Inwardly the latter scenario, security teams will lucidly adversaria the vulnerability and service breach and rely on existing security solutions to brief the power elite of a potential exploit on their systems. Out for the noise through this perfectionistic atrocity dies down, they'll return into their juncture jobs and focus on other higher priority issues. Unfortunately, this latter shooting script is likely the more common path taken.<\p>