Protecting truckloads of data on the information superhighway

SSL Journal

Subscribe to SSL Journal: eMailAlertsEmail Alerts newslettersWeekly Newsletters
Get SSL Journal: homepageHomepage mobileMobile rssRSS facebookFacebook twitterTwitter linkedinLinkedIn


Top Stories

Jersey City, NJ, November 18, 2009 - Buying or borrowing software on the Internet carries risks, both for the developer and for the person who plans to use it. End users who install malicious software in their computers may lose their purchase price. Worse, they may risk damaging their computers. Developers risk that someone may intercept their software file and alter it, adding deleterious code. Such alterations could damage their professional reputations. Developers who sell or exchange software can protect their code and their reputations by using code-signing certificates. Code-signing certificates create X.509 data files called “signatures” that developers can attach to their software files. The signature disappears from the software if anyone (including the developer) alters the code. The digital signature functions as tamper-proof packaging for intangible f... (more)

Making Android SSL Work Correctly

Connecting via SSL in Android. Correctly and securely. Mimic browser functionality with untrusted certs and hostname mismatches Okay, for those of you who’ve been waiting, this is the blog. For those who haven’t, welcome, we’re going to talk about https connections (specifically) on Android (TM) from within a native app and connecting to sites that Android views as possible security risks. Easy like learning to drive if your face was in your navel. But I’ve tried to make the issues and the code as clean and clear as possible for you. Hope it is of some assistance. I’m going to take it slow and address all of the issues, even the seemingly unrelated ones. My goal with this blog is to help those who are just getting started on Android too, so I’ll use a lot of headings, giving you the chance to skip sections you are already familiar with. Otherwise, grab a cup of co... (more)

The HIPAA Final Rule and Staying Compliant in the Cloud

The HIPAA Omnibus Final Rule went into effect on March 26, 2013.  In order to stay compliant, the date for fulfilling the new rules is September 23, 2013, except for companies operating under existing “business associate agreements (BAA),” may be allowed an extension until September 23, 2014. As healthcare and patient data move to the cloud, HIPAA compliance issues follow.  With many vendors, consultants, internal and external IT departments at work, the question of who is responsible for compliance comes up quite often.  Not all organizations are equipped or experienced to meet the HIPAA compliance rules by themselves.  Due to the nature of the data and the privacy rules of patients, it is important to secure the data correctly the first time. HIPAA and the Cloud Do you have to build your own cloud HIPAA compliance solutions from scratch?  The short answer is no. ... (more)

Comodo Code Signing Certificate Supports Mozilla Standards

Comodo code-signing certificates enable developers to sign Mozilla extensions or "Add-ons" for a wide variety of different operating systems such as Microsoft Windows, Mac OS X and Linux. Mozilla applications recognize XPIs as "trusted" when they are signed with a Comodo Code-Signing certificate. XPI (pronounced "Zippy") is short for "Cross Platform Install." XPI enables Developers to create installer modules for their programs meant to enhance Mozilla applications such as Firefox, Thunderbird, Sea Monkey and Sunbird. Comodo Code-Signing certificates verify and authenticate the entity that has created the XPI file, allowing end users to trust their execution. Most browsers will not accept action commands from downloaded code unless the code is signed by a trusted Certificate Authority. An example of a trusted code-signing certificate, this one has been issued by Como... (more)

Comodo Innovations at SC World Congress October 13 and 14

Jersey City, NJ, September 29, 2009 - Comodo Group will exhibit its landscape of products at the SC World Congress, a trade show for information technology professionals in New York City, October 13 and 14, 2009. Comodo products being demonstrated include Comodo Endpoint Security Manager, which now includes Disk Encryption at no extra charge. Comodo Endpoint Security Manager offers centralized administration of the award-winning Comodo antivirus, firewall and disk encryption software. Endpoint Security Manager also offers a new Offline Updater, permitting administrators to schedule security updates for an entire network. Other Comodo products being demonstrated include Discovery Scanning, an automated inventory of all SSL certificates on a corporate network, and the hardware-free Two-factor Authentication used for regulatory compliance. Comodo Two Factor now has a f... (more)

EMC VFCache Respinning SSD and Intelligent Caching (Part 2)

This is the second of a two part series pertaining to EMC VFCache. In this part of the series, lets look at some common questions along with comments and perspectives. Common questions, answers, comments and perspectives: Why would EMC not just go into the same market space and mode as FusionIO, a model that many other vendors seam eager to follow? IMHO many vendors are following or chasing FusionIO thus most are selling in the same way perhaps to the same customers. Some of those vendors can very easily if they were not already also make a quick change to their playbook adding some new moves to reach broader audience. Another smart move here is that by taking a companion or complimentary approach is that EMC can continue selling existing storage systems to customers, keep those investments while also supporting competitors products. In addition, for those customers w... (more)

The Operational Consistency Proxy

Cloud makes more urgent the need to consistently manage infrastructure and its policies regardless of where that infrastructure might reside While the potential for operational policy (performance, security, reliability, access, etc..) diaspora is often mentioned in conjunction with cloud, it remains a very real issue within the traditional data center as well. Introducing cloud-deployed resources and applications only serves to exacerbate the problem. F5 has long offered a single-pane of glass management solution for F5 systems with Enterprise Manager (EM) and recently introduced significant updates that increase its scope into the cloud and broaden its capabilities to simplify the increasingly complex operational tasks associated with managing security, performance, and reliability in a virtual world. AUTOMATE COMMON TASKS The latest release of F5 EM includes enhan... (more)

Wireless Security on Context (disponible en español)

Why Security? It all started with an email account you accessed through your laptop, and now sometimes it is really hard to track all the digital profiles you own, plus we tend to pay little attention about accessing our digital assets in secure “wireless domains”, these factors combined form a scenario where security breaches can really hurt your digital self as it exists. It is clear that wireless communications has allowed us to adopt technology in a new way; we can use digital tools without being tied to a location, but the fact is that when you use technology everywhere you are exposing yourself to that “everywhere”. Popularity of wireless technology has shifted the usage of digital tools, your mobile device is amazingly powerful and networks are growing in complexity to cope with better services. All this power makes it difficult on the user to k... (more)

Securing Cloud Data from Cybercrime, Intrusion and Surveillance

By John Sotiropoulos - In my previous post  (Cloud Data, Security, Privacy & Confidentiality/ The ISV Perspective) I talked about the increasing exposure of data, the changing landscape of data confidentiality and the need to shield data rather than retreat into – largely mythical  -“safe heavens” of on premise.  When storing data in the cloud, key management becomes a critical aspect of data confidentiality and a new crop of vendors are beginning to emerge simplifying encryption and key management. Having looked at most of the new crop of cloud encryption vendors, we liked Porticor for its innovative application of homomorphic algorithm to split key encryption and its use of a customer-owned security appliance.   The combination of two eliminates the need to expose the encryption key and minimizes the risks offering a unique approach to comply with EU data protect... (more)

10 Bold Predictions for Cloud Storage in 2014

2013 was a breakthrough year for cloud storage. A recent survey showed that 60 percent of businesses decided to store their data in the cloud, and the benefits they've begun to realize range from cost and time savings to maintenance-free storage infrastructure. But the year also brought with it some controversy intertwined along with the successes. Whether it was high-profile cloud outages, the scramble around the Nirvanix shutdown or the daily drumbeat of data privacy stories resulting from the Snowden breach, the public was reminded constantly to remain cautious. So now, as the year nears a close, it's a good time for collective reflection about what all this means for the industry and the technology. With all of this as context, here are the 10 fearless predictions we at TwinStrata believe are sound bets for 2014 The air is getting thinfor smaller cloud providers... (more)

Load balancing is key to successful cloud-based (dynamic) architectures

Much of the dialogue today surrounding cloud computing and virtualization is still taking the 50,000 foot view. It's all conceptual; it's all about business value, justification, interoperability, and use cases. These are all good conversations that need to happen in order for cloud computing and virtualization-based architectures to mature, but as is often the case that leaves the folks tasked with building something right now a bit on their own. So let's ignore the high-level view for just a bit and talk reality. Many folks are being tasked, now, with designing or even implementing some form of a cloud computing architecture - usually based around virtualization technology like VMWare (a March 2008 Gartner Research report predicted VMWare would likely hold 85% of the virtualization market by the end of 2008). But architecting a cloud-based environment requires more ... (more)