What to do when your free cloud storage fills up

With the launch of the Surface 2 and Surface Pro 2, Microsoft is joining the promotional cloud-storage craze, giving buyers 200GB of free storage for two years.

Like other tech companies that have offered similar promotions, Microsoft hopes you’ll use cloud storage to ease the burden your device’s somewhat skimpy flash storage drive. In a blog post, the company boasts that 200GB is “enough space to take a photo, every hour, from the moment someone is born, to the day they graduate from college.”

Microsoft and other companies (like Google and Dropbox) don’t like to talk about what you’ll do after the promotion runs out. If you switch to a paid storage plan at that point, they’ll rejoice—but the recurring cost of such plans can be high, and if you’re not prepared to pay, you and your uploaded content could be in an awkward situation when the free ride is over.

So before you start uploading your entire digital life into sky storage, let’s take a closer look at how SkyDrive, Google Drive, and Dropbox deal with your files after their promotional plans expire. The cloud can turn mighty dark indeed when your time is up.

Microsoft says it won’t delete your files when the two-year SkyDrive promotion ends. You can continue to download and share those files, but you won’t be able to add any new files to your collection unless you clear space for them.

Here’s the bigger caveat: When you go over the limit, your files will revert to read-only mode when you access them through SkyDrive. That means you won’t be able to edit your documents in Office Web Apps, or to sync your documents to SkyDrive when editing them in Office. This limitation could cause trouble if document syncing across devices is a major part of your workflow, and a Microsoft spokesperson wouldn’t say whether users will receive any advance warning when their free storage is about to go away.

Should you be unwilling or unable to relocate your files from SkyDrive after the promotional period ends, you’ll have to pay $100 per year to maintain the 200GB of storage. SkyDrive’s cheapest plan, providing 27GB of total storage, costs $10 per year.

Over the past year or so, Google has used the attraction of free Google Drive storage as a hook for its Chromebooks. Most Chromebooks come with 100GB of free storage for two years, and the luxury Chromebook Pixel includes 1TB of storage for three years—on top of the 15GB that all users get for free. In addition, Google recently gave away 10GB of storage for two years to anyone who linked Quickoffice to Google Drive.

Like SkyDrive, Google Drive won’t delete your files after the promotion ends. You’ll still be able to access, share, and download those files, according to Google’s support page, but you won’t be able to add any new files until you either clear space or purchase a plan that covers the amount of space you’re using.

Gmail users need to treat Google’s promotional offerings with caution. Going over your limit means that you won’t be able to send or receive email “after a period of time,” according to Google’s support page. Google will provide warnings in advance of expiration of the free storage period, but a company spokesperson would not specify the length of the grace period users will have before their email gets cut off. Likewise, syncing between your Drive account and the Google Drive folder on your local hard drive “stops completely” when your plan expires.

If you decide to pay for Google Drive storage beyond the free period, you should know that plans start at $5 per month for 100GB, and you’ll have to pay $50 per month to maintain the same 1TB of storage that comes with the Chromebook Pixel.

Image: Dropbox In 30 Minutes/dropbox.in30minutes.com via Flickr

Although Dropbox isn’t in the hardware business, the company has partnered with device makers such as HTC and Samsung to offer free cloud storage with their phones. These promotions may last a couple of years, and some offer as much as 48GB of extra storage.

Dropbox’s support page says that it won’t delete files after you’ve reverted to a regular free account. You can still access those files from your computers, tablets, and phones, and from the Dropbox website. But if you try to add new files to the Dropbox folder on your PC, they won’t sync, meaning that you won’t be able to access them from other machines. Similarly, you won’t be able to upload new files via Dropbox’s apps or website.

Dropbox isn’t tied to vital tools like your email or Office applications, which should help limit the potential fallout from an expired free plan. On the other hand, its paid plans are more expensive than those for Google Drive and SkyDrive. Pricing starts at $10 per month for 100GB of storage.

Having lots of extra cloud storage can be convenient for shuttling large files across your devices. But don’t fall into the habit of considering these promotions truly free.

In all likelihood, your phone or tablet won’t have enough local storage to contain all the files you’ve been putting in the cloud. Consequently, when the promotion ends, you’ll need a PC with ample storage or an external drive for backups, or you’ll have to start paying recurring fees for cloud storage—and you’ll have to make a decision fast if you don’t want to disrupt your work. You know what they say about free lunches.

Speaking of food metaphors, check PCWorld’s handy-dandy guide to supersizing your free cloud storage to 100GB or more. Setting up that much space entails jumping through a few more hoops than does buying a device with a time-limited storage offer, but the storage you end up with also has far fewer strings attached.

View the original article here

Microsoft to analysts: consumers are the gateway to cloud, enterprise usage

For all of its recent emphasis on its Surface tablet and the Xbox, Microsoft remains focused on the enterprise, and especially on the cloud—but its consumer offerings are a gateway, Microsoft executives said.

Microsoft chief operating officer Kevin Turner opened Microsoft’s 2013 financial analyst meeting by disclosing that more than 55 percent of Microsoft’s revenue comes from the enterprise, a number that he said Microsoft rarely discloses. Other key executives, such as chief executive Steve Ballmer, are expected later in the meeting's day, which runs until 5 PM PDT.

Wall Street may have hoped that Microsoft would answer some uncomfortable questions, beginning with Microsoft’s unexpected shakeup. In July, Ballmer announced a sweeping reorganization that flattened the corporate structure and placed the company’s key technologies in the spotlight, rather than making the individual products the focus.

In August, however, Ballmer unexpectedly said that he would retire at the end of 12 months, prompting feverish speculation about who would replace him: including Stephen Elop of Nokia, among others.

Microsoft’s acquisition of Nokia helped boost Elop’s apparent chances. Unfortunately, Amy Hood, Microsoft’s chief financial officer, introduced the conference by saying that the company would be offering no new updates on the succession process.

Kevin Turner, another candidate to succeed Ballmer, first appeared on stage to present Microsoft’s business strategy and where the company has succeeded. So far, that appears to be in the cloud.

More than 55 percent of Microsoft’s business comes from the enterprise, Turner said, with 20 percent from the consumer market, 19 percent directly from OEMs, and 6 percent from small and medium businesses. Turner said that each field employee generates a total of $2.7 million per employee, a new high.

Microsoft’s Turner also pooh-poohed the negative response from OEM competitors to some of Microsoft’s own hardware plays, like the Surface. Turner referred to the consternation in the OEM channel when Microsoft launched Surface, with OEMs complaining about competition from Microsoft itself.  “We don”t want to make all the devices... but we will make some first-party hardware,” Turner said.

”As a result of having those consumer services, we’re able to deliver world-class business services at scale,” Turner said. "When you think about the opportunity between these two worlds, we know the seams of hardware and software integration.”

Turner also claimed that those OEMs now would claim that those products had improved dramatically.

Turner also took pains to emphasize how Microsoft was winning in the cloud.

Microsoft has 460 million MSN customers, 8 million Xbox Live customers, and Bing fields 4.6 billion queries per month. More than 400 million people use Outlook.com, Turner said, after Microsoft made it “more vibrant” and refreshed it, he said.

In the enterprise, Microsoft should move from a $1.5 billion annual revenue rate with Office 365 this quarter, and “blow that away” later this year, Turner said. Microsoft’s enterprise, public-cloud service in China is the only one of its kind in the world, he said.

In the past year, Microsoft increased deployed users of Office 365 by 350 percent, Turner said.

”Some people have asked, what are you doing with Google in the enterprise?” Turner said. “We’re winning them back, one customer at a time,” and Microsoft sees that accelerating, he said—helped by the fact that “[Microsoft] doesn’t snoop their email or listen in on their Wi-Fi.”

”Microsoft has never been considered a critical-enterprise IT provider,” Turner added. “Today we are. That is the new Microsoft.”

Social media in the enterprise represents a $38 billion opportunity today, Turner said. About 85 percent of Fortune 500 companies use Yammer, while 90 out of the Fortune 100 companies use Microsoft’s enterprise collaboration tool, Lync. Lync is a billion-dollar product; Skype has 320 million users.

Together, Lync, Yammer, Skype, and SharePoint in the enterprise make up a “incredibly compelling story” in the enterprise space, Turner said.

Turner also made a pitch for the upcoming Windows 8.1, and its business features: workplace join, as well as the ability to remotely wipe and clean the device of business data if the employee leaves the company. He also pitched Windows Phone as the smartphone platform of the future.

The Haswell or fourth-generation Core processor from Intel gives Microsoft the capability to have a fanless device on a better platform,” Turner said. That will open up new form factors at new price points, he said, and Microsoft is working hard across with partners to make that happen.

Microsoft has also worked to improve its retail store experience, partnering with 200 Best Buy stores to put Microsoft boutiques within each.  “We have to improve the retail buying experience,” Turner said, referring to early customer reticence to buy PCs using the OS. “It hasn’t been what we liked.”

”The one thing we know about Windows Phone: when people use it, they really really like it,” Turner said. Turner acknowledged that Windows Phone was a distant third behind Android and iOS, but with year-over-year gains like 900 percent in India, the company holds out hope that it will close the gap. Turner talked up its its Nokia acquisition, but also highlighted partners such as Samsung and several Asian partners.

Finally, Turner said that its Xbox Live service has attracted 43 million users, about 40 percent of whom are female.

A power outage then interrupted the meeting. When it returned, Microsoft executives detailed their commitment to Windows RT versions of the Surface tablet.

View the original article here

Microsoft's deal with AT&T shows the new path for cloud partnerships

Microsoft's newly announced joint venture with AT&T, in which AT&T customers get VPN access to Microsoft's Azure cloud platform, may be a sign of how the cloud giants are looking in novel places -- like telecom providers -- for partnerships and alliances.

Cloud vendors and telecom outfits have been slowly knitting together partnerships in which the telcos provide high-grade, high-speed data transports for customers looking to move their data into (or out of) the cloud.

AT&T teamed up with IBM late in 2012 for a similar initiative. There, customers could connect to IBM's cloud resources via AT&T's VPN, allowing protected movement of data between private and public clouds. Before that in 2011, VMware partnered with Softbank Telecom in Japan to allow customers to shuttle data between their own private cloud and Softbank's public cloud.

Most recently, enterprise cloud host Savvis -- a subsidiary of Internet provider CenturyLink -- partnered with VMware to provide vCloud-powered colocation, again to provide businesses with a protected channel to and from the cloud.

No discussion of this issue would be complete without some mention of Verizon purchasing cloud-service provider Terremark in 2011 -- with both Verizon and Terremark having been major VMware vCloud users.

Having cloud outfits reach out to carriers and network providers as partners only makes sense. The cloud lives and dies on its network links. Consequently, the more direct a route that can be provided into and out of the cloud, the easier it is for customers to get on board -- especially those with multiterabyte migrations that require a robust and secure network.

The release for the new Microsoft-AT&T joint venture boasts that their VPN solution will provide "as much as 50 percent lower latency than the public Internet." That said, it won't be possible to test claims like that until the first half of 2014, when the partnership finally goes online.

What also remains to be seen is how exclusive these deals could get. Right now, it's in the best interests of both parties to work with as many partners as possible, but it's not unforeseeable that we could see exclusive deals between cloud and network providers, perhaps for major discounts on both the cloud resources and the network access. Such a thing would inspire the ire of many an advocate for Net neutrality, and given how many resources are being moved into the cloud these days, they might not be wholly wrong.

This story, "Microsoft's deal with AT&T shows the new path for cloud partnerships," was originally published at InfoWorld.com. Get the first word on what the important tech news really means with the InfoWorld Tech Watch blog. For the latest developments in business technology news, follow InfoWorld.com on Twitter.

View the original article here

D-Link Day/Night Network Cloud Camera 1150 (DCS-933L)

D-Link knows networking, so the company almost gets it right with the Day/Night Network Cloud Camera 1150. Setup is straightforward, and if your network is built with the latest D-Link products, no setup is required—just plug the camera into an AC outlet and your router and it's ready. Compared with the $200 Y-Cam HomeMonitor Indoor or even the $150 Dropcam HD the $99.99 (list) Cloud Camera 1150 is a good deal. It's a bit under-equipped with a standard-definition sensor, weak night vision mode, and a lack of online DVR service. While there is an online service for viewing the video feed, it doesn't include any cloud-based storage, putting it on par with the $120 Compro Cloud Network Camera (TN50W).

Design and Setup
The plain, white Cloud Camera 1150 has a soap-bar size and shape at 3.6 by 2.3 by 1.2 inches (HWD) without the stand. That stand is one of the few I've seen that's entirely plastic, but it's still wall- or ceiling-mountable with the included screws. It doesn't feel as sturdy as the metal stands that come with the Zmodo 720P HD Wireless Network IP Camera or Dropcam, though.

The camera has far fewer infrared LEDs than other models we've tested, with just four, instead of a nice ring array to nearly invisibly illuminate the area for the camera's IR-sensitive mode when it's dark. D-Link only guarantees night vision to about 15 feet while Y-Cam promises 50 feet. On the other hand, the Compro TN50W we tested has no LEDs at all, so D-Link is ahead of that one.

According to the company, setup is "zero configuration" if you already have a relatively recent D-Link Cloud Router and a mydlink account. My D-Link router is officially ancient at four years old, so I went through the full setup. This involves installing software on a Mac or Windows PC, rather than just a quick scan of a QR code with a mobile app (like that found on the Zmodo) or going to a website to enter a code from the camera (like with the Y-Cam HomeMonitor).

The setup leads you through connecting the camera, via Ethernet, to a router (D-Link includes a ribbon-thin 10baseT cable for this purpose), plugging in the power, then waiting for an LED on the back to turn solid green. The wizard auto-detects the camera's MAC and IP addresses. You can assign a password to the camera at this point, which is highly recommended. Switch the camera to wireless mode using either the simple Wi-Fi Protected Setup (WPS), or by finding an available Wi-Fi network SSID to connect to.

Finally, you have to sign up for the mydlink cloud service, if you don't have an account already. Download the mydlink Lite apps for your phone or tablet, and get ready for some surveiling.

Features and Performance
The D-Link Cloud Camera 1150 appears no-frills on the surface, but there's some power underneath if you bother to access it (more on that in a minute). Many won't, and will feel they've got their money's worth since that surface works just fine for the most part. I ran into some glitches, however.

To view the camera in a browser on mydlink.com, you need to install the Java Runtime Environment (JRE). I was also told by the wizard to perform a firmware upgrade. It's not exactly a fast setup, but it worked despite the constant Java errors I had with my Chrome browser. Thankfully, Java worked in IE 10.

Once in the mydlink.com interface, you can activate and adjust the motion detection and audio detection under the settings tab. Motion detection has a nice screen that lets you define an area of the image for detection (so the ceiling fan or dogs don't set it off, for example). A slider bar lets you increase or decrease the motion sensitivity. You can also schedule motion detection for individual days of the week. No matter how I set the sensitivity, I got far too many email alerts and false positives.

The audio detection settings are unique among the surveillance cameras I've tested. Mydlink displays a decibel level graph of what the camera currently hears up to 90db, so you can make an educated guess on what setting to use. This model supports listening to live audio with the video, but there's no two-way audio—you can't talk to the camera's subjects from a mobile app or remote computer, for instance.

Whenever a motion or audio event is detected, you get a time-stamped email with a still 640-by-480-pixel (VGA) image attached. The camera doesn't just support SMTP email; you can easily input settings for Gmail, Yahoo, and Hotmail, as well. It automatically sends the alerts to the email address you signed up with, so using a different address here can mean double the alerts.

Utterly unique to the Cloud Camera 1150 is a wireless extender mode. This lets you extend the range of your home wireless network, and could come in especially handy if you get multiple D-Link Cloud Cameras. Don't set it too far away, though; that could actually hurt wireless network performance.

Many of the above settings can also be modified from the mydlink Lite app on a phone or tablet. Generally, however, the apps are just for accessing the live camera feed, and perhaps taking a still image here or there.

Where's all this under-the-hood power I mentioned? In the mydlink settings, click the "Advanced Settings" button. You'll need the special password you assigned the camera (it may not be the same as your mydlink account password). This gives you access, via your browser, to the internal settings of the camera itself, everything from changing the password, to changing video quality, setting up dynamic DNS, creating mail accounts for alerts, or altering the extender mode to have its own SSID.

In Advanced Settings, you can set up alerts to email a video clip rather than a still image, and there are also options for sending video or stills to an FTP site. That's as close as the Cloud Camera comes to an online "DVR" service for surveillance footage, though the company claims it will work seamlessly with D-Link network-attached storage devices to store video.

The camera uses the H.264 codec, so the video looks good, but it only records up to 640 by 480 resolution, which just doesn't cut it compared with the 720p images on cameras from Zmodo and Dropcam.

Conclusion
We've yet to see a Wi-Fi surveillance camera that has just the right mix of performance, setup, and features to match the Logitech Alert 750n Indoor Master System. The 750n remains our Editors' Choice even though it's more expensive and isn't wireless (using HomePlug instead). D-Link's home surveillance solution needs to improve quality, remove the Java requirement for browser access, and consider some functional online storage (and not just a live feed or email/FTP uploads) to measure up.

View the original article here

Mobile device management shifts to the cloud

New cloud-based software lets employees register, secure, and manage their personal devices without IT department involvement. And a simplified Web interface automates a lot of management tasks.

The software, dubbed Anyware, is completely new code from MobileIron, which originally created a conventional enterprise server application for managing mobile devices. With Anyware, MobileIron intends to become a cloud service that can adapt to handle the mobile management needs of companies large and small.

[ Stay ahead of advances in mobile technology with InfoWorld's Mobile Edge blog and Mobilize newsletter. ]

[KICKOFF:How technology is transforming the NFL]

In a related announcement, MobileIron will offer Anyware specifically integrated with the mobile apps proliferating on the web-based CRM platform Salesforce.com. Currently, Salesforce administrators in the enterprise "have no access to enterprise mobility management," says Ojas Rege, vice president of strategy for MobileIron. That lack is increasingly urgent as more and more mobile apps for Salesforce appear on the vendor's App Exchange. MobileIron will offer "Anyware for Salesforce," which provides from within the Salesforce web interface a range of administrative views, tools, actions, and reports that support a company's mobile Salesforce users.

The initial release of the Anyware cloud service supports iOS and Android devices. End users surf to anywhere.com to register their devices with a username and password, and a device profile is automatically downloaded to their phone or tablet. That's the only step users need to take, according to Rege.

Once registered, users see two icons on their device, one for Anyware and one for the Anyware app catalog, an enterprise-specific site for mobile apps. The catalog is set up by an Anyware administrator, who lists the approved custom and third-party apps that corporate users can, or should, download. The catalog links seamlessly with both Google Play and Apple App Store. As with those online stores, you click on an app in the Anyware catalog and it downloads and installs on your device. And also as with those online stores, users can rate and review the Anyware-listed apps. "This was a huge request from lots and lots of our enterprise customers," says Rege.

Anyware includes a feature to store and then download to a secure on-board container a selection of enterprise documents, which can be stored in different "content catalogs" in the Anyware cloud. One can be for marketing and sales, another for engineering staff. These work-related documents are secured, manageable and kept separate from the personal content on a personally-owned device. It is not intended to be a full-blown document management system or replace them.

Anyware administrators log in via a browser and see a tabbed interface for the Anyware Console. MobileIron has created an extensive set of wizards to guide administrators through tasks such installing certificates, accessing email, configuring Wi-Fi or VPNs, and creating password policies.

Under the "Add Policy" tab, for example, administrators can select from an extensive selection of  ready-to-use templates, such as "compromised devices" for detecting and dealing with jailbroken mobile phones.  

Whether using the Anyware or Anyware for Salesforce interface, administrators don't have to be IT experts to handle these kinds of management policies and tasks, according to MobileIron.

View the original article here

Mobile device management shifts to the cloud

Network World - New cloud-based software lets employees register, secure, and manage their personal devices without IT department involvement. And a simplified Web interface automates a lot of management tasks.

The software, dubbed Anyware, is completely new code from MobileIron, which originally created a conventional enterprise server application for managing mobile devices. With Anyware, MobileIron intends to become a cloud service that can adapt to handle the mobile management needs of companies large and small.

In a related announcement, MobileIron will offer Anyware specifically integrated with the mobile apps proliferating on the web-based CRM platform Salesforce.com. Currently, Salesforce administrators in the enterprise "have no access to enterprise mobility management," says Ojas Rege, vice president of strategy for MobileIron. That lack is increasingly urgent as more and more mobile apps for Salesforce appear on the vendor's App Exchange. MobileIron will offer "Anyware for Salesforce," which provides from within the Salesforce web interface a range of administrative views, tools, actions, and reports that support a company's mobile Salesforce users.

The initial release of the Anyware cloud service supports iOS and Android devices. End users surf to anywhere.com to register their devices with a username and password, and a device profile is automatically downloaded to their phone or tablet. That's the only step users need to take, according to Rege.

Once registered, users see two icons on their device, one for Anyware and one for the Anyware app catalog, an enterprise-specific site for mobile apps. The catalog is set up by an Anyware administrator, who lists the approved custom and third-party apps that corporate users can, or should, download. The catalog links seamlessly with both Google Play and Apple App Store. As with those online stores, you click on an app in the Anyware catalog and it downloads and installs on your device. And also as with those online stores, users can rate and review the Anyware-listed apps. "This was a huge request from lots and lots of our enterprise customers," says Rege.

Anyware includes a feature to store and then download to a secure on-board container a selection of enterprise documents, which can be stored in different "content catalogs" in the Anyware cloud. One can be for marketing and sales, another for engineering staff. These work-related documents are secured, manageable and kept separate from the personal content on a personally-owned device. It is not intended to be a full-blown document management system or replace them.

Anyware administrators log in via a browser and see a tabbed interface for the Anyware Console. MobileIron has created an extensive set of wizards to guide administrators through tasks such installing certificates, accessing email, configuring Wi-Fi or VPNs, and creating password policies.

Reprinted with permission from NetworkWorld.com. Story copyright 2012 Network World, Inc. All rights reserved.

View the original article here

Red Hat unveils new offerings, cloud certification at VMworld

With VMworld 2013 in full swing in San Francisco, Red Hat wasted no time today showing off its upcoming cloud and virtualization offerings. The open source solutions provider unveiled demos of its forthcoming CloudForms 2.1 cloud management technology, a new product designed to integrate Red Hat Enterprise Virtualization and Red Hat Enterprise Linux Server, and a new training and certification offering for deploying and managing OpenStack.

"We agree that an all-public cloud isn't the answer, as VMware CEO Pat Gelsinger acknowledges," says Bryan Che, general manager of Red Hat's Cloud Business Unit.

[ Learn how to install Apache on Linux in InfoWorld Test Center's step-by-step guide. | Track the latest trends in open source with InfoWorld's Open Sources blog and Technology: Open Source newsletter. ]

"This is a conversation Red Hat has been leading for some time now. However, we do not buy into the premise that a private or a hybrid platform based on one vendor's technologies and products is the answer either, says Che That goes against the compelling industry trends of openness and choice that have increasingly put customers in control of their own destinies and strategic direction. Instead, we are focused on delivering what we believe customers really want: an open hybrid cloud."

For that to happen, Che says, a hybrid cloud can't just run on a homogeneous software stack. It needs to work across the enterprise's entire business and IT, spanning Red Hat, Microsoft, VMware and Amazon. That's where OpenStack comes in.

OpenStack is free open source software-actually a series of interrelated open source projects for controlling pools of processing, storage and networking resources through a datacenter-supported by a wide array of vendors, from Red Hat and IBM to Rackspace and HP.

CloudForms is Red Hat's answer to operating and managing an OpenStack environment. Its capabilities include a comprehensive cloud service catalog, chargeback and metering, service orchestration, policy and governance, reporting and forecasting and more. And, as Che notes, it can provide these capabilities from a diverse array of cloud environments-VMware, Red Hat, Amazon-all from a single pane of glass.

"This means, then, that with CloudForms, you can build and manage a hybrid cloud that spans not just Red hat technologies or VMware technologies but a choice and diversity of providers," he says. "And, you can do this all with a unified and interoperable set of tools and interfaces. In an open hybrid cloud, your cloud is not locked into a single vendor or technology stack; rather you can build and manage a cloud that spans all your important assets in an integrated and seamless way."

Red Hat also introduced a new product offering: Red Hat Enterprise Virtualization Promotional Offering. It integrates Red Hat's enterprise Linux platform with its virtualization management system for servers and desktops. The Enterprise Virtualization Promotional Offering will be made available as a single subscription offering in fall 2013.

The open source solutions provider also announced its Red Hat Certificate of Expertise in Infrastructure as a Service (IaaS), a class and certification intended to ensure that enterprise customers' IT professionals can deploy and manage OpenStack.

Red Hat says the class will cover essential OpenStack skills, including installing and configuring a Red Hat Enterprise Linux OpenStack Platform deployment, configuring and managing images and managing storage using Object Storage (Swift) and Block Storage (Cinder).

"We built the industry's leading Linux certification program by focusing on rigorous, hands-on testing of real-world skills," says Iain Gray, vice president of Global Services at Red Hat.

"Our Red Hat Certified Professionals love this because it is a meaningful test of their skills. IT employers love it because it offers assurance that the certificate holders can apply their skills and knowledge in real-world situations, says Gray. We have applied these same principles to the Red Hat Certificate of Expertise in Infrastructure as a Service. Organizations are seeking capable professionals to help bring OpenStack into their IT environments. As with Linux, we expect to set the benchmark for a technology that is rapidly proving to be a game changer in the industry."

Thor Olavsrud covers IT Security, Big Data, Open Source, Microsoft Tools and Servers for CIO.com. Follow Thor on Twitter @ThorOlavsrud. Follow everything from CIO.com on Twitter @CIOonline, Facebook, Google + and LinkedIn. Email Thor at tolavsrud@cio.com

Read more about certification in CIO's Certification Drilldown.

View the original article here

Amazon's cloud service problems wobble Airbnb, Vine

Sorry, I could not read the content fromt this page.

View the original article here

HP introduces SAP HANA based cloud service

Sorry, I could not read the content fromt this page.

View the original article here

US Postal Service explores entering the cloud business

Can the U.S. Postal Service (USPS) find a new future running a cloud-based authentication service for the government? The USPS intends to try and do just that under a three-year $15.12 million contract awarded to SecureKey Technologies last week for some foundation technology to build a cloud-based authentication exchange.

While in the early stages, the USPS-managed Federal Cloud Credential Exchange (FCCX), as it's being called, is envisioned as a way that people can use their existing online credentials to gain access to U.S. government agency online services in the future.

What third-party credentials would be used as part of FCCX is not yet decided, but ideas in play include credentials that users already have with the likes of Google and PayPal, for example, says Andre Boysen, executive vice president for marketing at SecureKey. It's anticipated these credentials would be of various strengths and types, from simple names and passwords to the government-designed Personal Identity Verification cards.

The request for proposals for the FCCX contract was originally put out for bid last January and the award to Toronto-based SecureKey means that the USPS will be proceeding with its plans to try and operate a cloud-based authentication exchange for the government.USPS spokesperson Darleen Reid-DeMeo said USPS is "implementing a pilot software solution to enable the public to use commercially issued digital credentials to access government services online with greater security, privacy and efficiency."

Many details, however, need to be ironed out as what would be the nation's first-of-its-kind authentication service to federal government in the U.S.  

"Participants have not been finalized at this time," Reid-DeMeo says. "However, some of the agencies that have been assisting in developing the requirements for the pilot are the Veterans Administration, the Department of Education, the Social Security Administration and the Internal Revenue Service." It's anticipated that the FCCX pilot project would begin this fall.

The USPS pilot project for a cloud-based exchange is one of several experimental approaches to online access to government services envisioned under the Obama Administration's  National Strategies for Trusted Identities in Cyberspace (NSTIC) program.

The NSTIC program seeks to find new ways to reduce password use online for security reasons or to facilitate novel ways to facilitate government services in the future. Reid-DeMeo says the FCCX pilot project is being led by the White House Office of the Federal Chief Information Officer.

The FCCX project basically involves the USPS setting up a kind of credential-brokerage service using SecureKey's federated authentication platform. It's hoped that FCCX will work behind the scenes so when users go to a government agency's online service, they can enter a credential they already have that was not necessarily issued by the government to get access rather than having to go ask for a credential from the agency itself.

This all suggests a close level of trust and cooperation between all the participants involved, including the government agency, the USPS, and any third-party credential provider. While this kind of authentication brokering hasn't been done yet in the U.S. for government, something similar has been shown to work in Canada.

A cloud-based authentication brokerage system, with technology provided by SecureKey, has been operated by the Canadian government  for well over a year for use by the Canadian Treasury Board and other Canadian agencies.  

According to SecureKey's Boysen, the Canadian credentials exchange now processes over 1 million transactions per month with users entering banking credentials they already have from the Bank of Montreal and TD Bank, for example. The Canadian system has the government's cloud-based credentials exchange service doing a quick online authentication verification with the participating banks concerning the user's credentials before allowing the user into the government online service.

The idea behind it is that users interact frequently with their banks online but infrequently with government services. Thus, they remember their online banking credentials while they are more likely to forget credentials they only use a few times a year for a government service.

It will be some time before it's clear exactly how the USPS-run FCCX might work, but it could give the country's beleaguered mail-delivery service, a new mission. But it might also prove unworkable and fade away after a year of a FCCX pilot cloud project, too.

Ellen Messmer is a senior editor at Network World. She covers news and technology trends related to information security.
More by Ellen Messmer

View the original article here

Tech firms' responses to latest NSA disclosures cloud the truth, experts say

Technology companies may be hiding behind legal jargon to avoid being more forthcoming in their responses to new documents on government surveillance that were disclosed Friday, some experts say.

Internet and software companies including Microsoft, Yahoo, Google and Facebook “are legally compelled to lie,” said security expert Bruce Schneier, citing national security letters that companies are prohibited from disclosing.

Some similar statements were made in interviews with the IDG News Service following a report published Friday in The Guardian alleging that the National Security Agency paid millions of dollars to companies such as Google and Facebook to cover costs involved in surveillance.

The tech companies incurred these costs in fulfilling tighter certification requirements after a 2011 court ruling said the government’s data collection was unconstitutional, according to documents obtained by The Guardian.

That ruling, which was handed down by the Foreign Intelligence Surveillance Court and was made public on Wednesday, said that the way the NSA collected data violated the Fourth Amendment because the agency did not effectively design its collection efforts to target only foreigners of interest to national security.

The NSA was “misusing its authority” by collecting the digital communications of U.S. citizens for years, the ruling said.

The documents revealed Friday describe the problems that the agency experienced after that ruling and the resulting efforts required to bring companies into compliance, according to The Guardian. The list of involved companies includes Google, Yahoo, Microsoft and Facebook, its report said.

The documents were passed on to The Guardian by former NSA contractor Edward Snowden, the man behind the original leaks of various government surveillance programs such as Prism. The documents provide the first evidence of a financial relationship between technology companies and the NSA, the Guardian report said.

The FISA court is required to sign annual certifications that provide the legal framework for surveillance operations, the report said. After the 2011 ruling, those certifications were only being renewed on a temporary basis as the NSA worked to fix its data collection methods that the court deemed unconstitutional.

This adjustment process entailed huge costs, according to a 2012 NSA newsletter entry, excerpts of which were published by The Guardian. “Last year’s problems resulted in multiple extensions to the certifications’ expiration dates which cost millions of dollars for Prism providers to implement each successive extension,” the newsletter said.

The Guardian did not give an exact figure for the costs.

The latest disclosure raises serious questions around the use of taxpayer money to finance government surveillance, the Guardian said. But another issue is the growing discrepancy between the information contained in leaked government documents and technology companies’ responses to it.

Snowden’s original leaks revealing Prism described a program aimed at the mass collection of data owned by U.S. citizens through direct access to company servers. Google and other tech companies have denied cooperating with the NSA to allow the mass collection of data.

They gave similar denials on Friday in response to questions from the IDG News Service.

“Facebook has never received any compensation in connection with responding to a government data request,” a Facebook spokeswoman said.

“We think the continued misreporting on this matter by The Guardian and others is troubling,” she added in an email.

Google said it has “not joined Prism or any government surveillance programs.”

“We do not provide any government with access to our systems and we provide user data to governments only in accordance with the law,” a spokeswoman said.

Both Yahoo and Microsoft offered more legalistic, complicated responses. Their responses make it clear that the companies’ deals for government compensation are more complicated than something they can simply confirm or deny.

“Microsoft only complies with court orders because it is legally ordered to, not because it is reimbursed for the work,” a spokesman said. “We could have a more informed discussion of these issues if providers could share additional information, including aggregate statistics on the number of any national security orders they may receive,” he said.

Microsoft asked for permission in June to aggregate statistics about the number of requests for data it receives under the U.S. Foreign Intelligence Surveillance Act.

Currently, companies can reveal the number of FISA requests they receive only if they lump them together with all other requests from U.S. law enforcement agencies.

Yahoo said it had nothing to add beyond the statement that the company supplied to The Guardian, which said “federal law requires the U.S. government to reimburse providers for costs incurred to respond to compulsory legal process imposed by the government.”

“We have requested reimbursement consistent with this law,” the company said.

Semantics are at play in companies’ responses, experts said.

Friday’s leaked documents “say that these companies cooperate with bulk NSA data collection,” said Schneier. “The companies deny it, but their denials are precisely worded with a lot of wiggle room,” he said.

Also, if companies are compelled by a National Security Letter to comply, they are prohibited from talking about their compliance, Schneier said.

In its response Friday, Google said it continues to await the government’s decision on the company’s petition to publish more national security request data, “which will show that our compliance with American national security laws falls far short of the wild claims still being made in the press today.”

Roger Kay, an IT analyst and founder at Endpoint Technologies Associates, said he was not surprised by the documents that were revealed Friday. Though the companies don’t say whether they provided information to the government, the legalistic language in some of their responses suggests they did, he said.

Also, companies’ responses to the growing number of leaks, whether they are flat-out denials, chock full of complicated legalese, or just plain vague, are probably damaging some users’ trust in the companies, Kay argued.

But for Internet users with short attention spans, disclosures like the ones revealed Friday may just blow over, he added.

Still, many questions remain about the type of data collection that was paid for in the millions of dollars in compliance costs that companies reportedly incurred.

It’s not clear how the NSA gathers data from companies, Kay said. “Is it like a direct stethoscope into the main artery, or a broader snapshot?”

Getting answers to those kinds of questions may also boil down to semantics. “Perhaps different people mean different things by ‘direct access,’” said Seth Schoen, senior staff technologist at the Electronic Frontier Foundation.

In another new development, The Guardian and The New York Times announced on Friday that they would work as partners to give the U.S. paper access to other documents leaked by Snowden. Both papers will be working together to publish more stories tied to the documents.

View the original article here

Tech firms' responses to latest NSA disclosures cloud the truth, experts say

Technology companies may be hiding behind legal jargon to avoid being more forthcoming in their responses to new documents on government surveillance that were disclosed Friday, some experts say.

Internet and software companies including Microsoft, Yahoo, Google and Facebook “are legally compelled to lie,” said security expert Bruce Schneier, citing national security letters that companies are prohibited from disclosing.

Some similar statements were made in interviews with the IDG News Service following a report published Friday in The Guardian alleging that the National Security Agency paid millions of dollars to companies such as Google and Facebook to cover costs involved in surveillance.

The tech companies incurred these costs in fulfilling tighter certification requirements after a 2011 court ruling said the government’s data collection was unconstitutional, according to documents obtained by The Guardian.

That ruling, which was handed down by the Foreign Intelligence Surveillance Court and was made public on Wednesday, said that the way the NSA collected data violated the Fourth Amendment because the agency did not effectively design its collection efforts to target only foreigners of interest to national security.

The NSA was “misusing its authority” by collecting the digital communications of U.S. citizens for years, the ruling said.

The documents revealed Friday describe the problems that the agency experienced after that ruling and the resulting efforts required to bring companies into compliance, according to The Guardian. The list of involved companies includes Google, Yahoo, Microsoft and Facebook, its report said.

The documents were passed on to The Guardian by former NSA contractor Edward Snowden, the man behind the original leaks of various government surveillance programs such as Prism. The documents provide the first evidence of a financial relationship between technology companies and the NSA, the Guardian report said.

The FISA court is required to sign annual certifications that provide the legal framework for surveillance operations, the report said. After the 2011 ruling, those certifications were only being renewed on a temporary basis as the NSA worked to fix its data collection methods that the court deemed unconstitutional.

This adjustment process entailed huge costs, according to a 2012 NSA newsletter entry, excerpts of which were published by The Guardian. “Last year’s problems resulted in multiple extensions to the certifications’ expiration dates which cost millions of dollars for Prism providers to implement each successive extension,” the newsletter said.

The Guardian did not give an exact figure for the costs.

The latest disclosure raises serious questions around the use of taxpayer money to finance government surveillance, the Guardian said. But another issue is the growing discrepancy between the information contained in leaked government documents and technology companies’ responses to it.

Snowden’s original leaks revealing Prism described a program aimed at the mass collection of data owned by U.S. citizens through direct access to company servers. Google and other tech companies have denied cooperating with the NSA to allow the mass collection of data.

They gave similar denials on Friday in response to questions from the IDG News Service.

“Facebook has never received any compensation in connection with responding to a government data request,” a Facebook spokeswoman said.

“We think the continued misreporting on this matter by The Guardian and others is troubling,” she added in an email.

Google said it has “not joined Prism or any government surveillance programs.”

“We do not provide any government with access to our systems and we provide user data to governments only in accordance with the law,” a spokeswoman said.

Both Yahoo and Microsoft offered more legalistic, complicated responses. Their responses make it clear that the companies’ deals for government compensation are more complicated than something they can simply confirm or deny.

“Microsoft only complies with court orders because it is legally ordered to, not because it is reimbursed for the work,” a spokesman said. “We could have a more informed discussion of these issues if providers could share additional information, including aggregate statistics on the number of any national security orders they may receive,” he said.

Microsoft asked for permission in June to aggregate statistics about the number of requests for data it receives under the U.S. Foreign Intelligence Surveillance Act.

Currently, companies can reveal the number of FISA requests they receive only if they lump them together with all other requests from U.S. law enforcement agencies.

Yahoo said it had nothing to add beyond the statement that the company supplied to The Guardian, which said “federal law requires the U.S. government to reimburse providers for costs incurred to respond to compulsory legal process imposed by the government.”

“We have requested reimbursement consistent with this law,” the company said.

Semantics are at play in companies’ responses, experts said.

Friday’s leaked documents “say that these companies cooperate with bulk NSA data collection,” said Schneier. “The companies deny it, but their denials are precisely worded with a lot of wiggle room,” he said.

Also, if companies are compelled by a National Security Letter to comply, they are prohibited from talking about their compliance, Schneier said.

In its response Friday, Google said it continues to await the government’s decision on the company’s petition to publish more national security request data, “which will show that our compliance with American national security laws falls far short of the wild claims still being made in the press today.”

Roger Kay, an IT analyst and founder at Endpoint Technologies Associates, said he was not surprised by the documents that were revealed Friday. Though the companies don’t say whether they provided information to the government, the legalistic language in some of their responses suggests they did, he said.

Also, companies’ responses to the growing number of leaks, whether they are flat-out denials, chock full of complicated legalese, or just plain vague, are probably damaging some users’ trust in the companies, Kay argued.

But for Internet users with short attention spans, disclosures like the ones revealed Friday may just blow over, he added.

Still, many questions remain about the type of data collection that was paid for in the millions of dollars in compliance costs that companies reportedly incurred.

It’s not clear how the NSA gathers data from companies, Kay said. “Is it like a direct stethoscope into the main artery, or a broader snapshot?”

Getting answers to those kinds of questions may also boil down to semantics. “Perhaps different people mean different things by ‘direct access,’” said Seth Schoen, senior staff technologist at the Electronic Frontier Foundation.

In another new development, The Guardian and The New York Times announced on Friday that they would work as partners to give the U.S. paper access to other documents leaked by Snowden. Both papers will be working together to publish more stories tied to the documents.

View the original article here

Box rolls out new cloud storage plans catering to small and medium businesses

Box has big news today for small companies and individuals. It is launching new, more affordable pricing plans to attract small and medium businesses to its cloud data storage and file sharing service, and it is doubling the amount of storage it provides for free personal accounts.

Cloud data storage today is like instant-messaging services used to be. Everyone has a favorite, but they also have an account set up with virtually every service available to allow them to share files with co-workers, customers, or friends and family who prefer a different service. Because the services offer free storage plans, many people have a Box, Dropbox, SugarSync, Google Drive, Microsoft SkyDrive, and other accounts.

Box has doubled space for the free Personal account, and added a new Starter tier for SMBs.

For those people, Box is increasing the amount of storage available with the free Personal plan from 5GB to 10GB. Box also frequently runs promotions that add storage for customers, such as the campaign earlier this year that rewarded Dell customers with 50GB of free storage for life. It might still be beneficial to maintain accounts on other services in certain scenarios, but for general personal use it would be much better to have data consolidated in one place than trying to juggle four or five different services.

The increased storage is great for individuals, but a business can’t—or at least shouldn’t—have employees running around sharing business data across their own personal cloud storage services. From a number of perspectives—protecting intellectual property, securing data from unauthorized exposure, and regulatory compliance to name a few—it’s just a bad idea. The company has no ability to limit or control access to the data once it leaves the internal network, and there is no way for the company to know which data is being stored where, or who it’s being shared with.

This makes the new Box plans particularly attractive for SMBs. The Starter plan offers customers 100GB of pooled storage for teams up to 10 users for $5 per user per month. As a business grows and its needs exceed what the Starter plan has to offer, they can step up to the Business plan which provides 1TB of pooled storage for more users and enterprise application integration (such as Active Directory or Salesforce.com), along with more robust administrative tools for $15 per user per month.

In a blog post about the changes, Box CEO Aaron Levie, says “Whether you’re a boutique financial services firm, a construction company, a small medical practice, or a startup working with manufacturers in China, Box can make your business more competitive. We want to help big businesses be as nimble as small ones, and small businesses be as scalable and global as giants.”

Box isn’t cheap, but the old adage “you get what you pay for” applies. Box offers better administrative controls and business tools and works with a variety of developers and services to provide a complete ecosystem that integrates seamlessly with the data stored in Box.

The new Starter plan lets small and medium businesses step up from using rogue personal storage services and manage and protect cloud data the way a business should. Box now gives SMBs a way to affordably dip a toe in the water, and a path to evolve and scale up as needs change.

Tony is principal analyst with the Bradley Strategy Group, providing analysis and insight on tech trends. He is a prolific writer on a range of technology topics, has authored a number of books, and is a frequent speaker at industry events.
More by Tony Bradley

View the original article here

Despite recent cloud service outages, security a bigger concern than availability

Wow. No sooner did I finish writing about how the Google and Microsoft outages were not a reason to lose confidence in the cloud, than Amazon went down. The online retail site—and its associated cloud services—were down for just under half an hour Monday afternoon. I stand by my assertion that the sky is not falling, but there’s more to using the cloud than just availability.

Amazon.com was the third major cloud service to suffer an outage in the last week.

Over on WindowsITPro.com, Paul Thurrott summed up the hysteria over cloud outages nicely. “And of course, the cloud computing doubters—who, like global warming doubters are increasingly at odds with reality—will argue that such outages prove that our move away from on-premises hardware and local storage is nothing but a temporary trend.”Let’s start with some perspective, breaking down the math like I did yesterday for Google and Microsoft. Amazon was down for about 25 minutes (although I’ve seen reports from 15 minutes to 40 minutes). In the grand scheme of things, Amazon was down for an infinitesimally small period of time. Depending on the estimate you go with, Amazon lost about $5 million in retail commerce during that timeframe—or about two percent of what it cost Amazon CEO Jeff Bezos to buy the Washington Post, or about two thousandths of a percent of his net worth.

Thurrott also pointed out the irony of how many users turn to Internet-based services like Facebook or Twitter to complain about cloud outages and declare the impending death of this cloud fad.

The debate over cloud availability is silly. As I pointed out my post about the Google and Microsoft outages, local networks and servers are not impervious to outages, so the risk is essentially the same as it pertains to availability.

Security and privacy are more relevant cloud concerns than availability.

There are, however, other concerns that offer a much more valid argument against cloud services for some businesses. Chief among them is security and privacy.

The convenience of outsourcing the IT infrastructure to a cloud-based third-party comes with increased risk that your network traffic or stored data could be compromised in some way, either directly by the IT support personnel charged with maintaining your services, or inadvertently by exposing it to increased risk on Internet-based servers.

It doesn’t have to be that way, though. You can enjoy some of the benefits of cloud servers and storage without sacrificing control, or putting the data at increased risk by hosting your own private cloud, or using a hybrid approach that includes on-premise and cloud-based services.

For example, you could store your data locally in an appliance like the ioSafe N2. The NAS (network attached storage) device can hold terabytes of data in a redundant configuration inside a fire proof, flood proof enclosure. Best of all, the N2 connects to the network and to the Internet, and it makes the data available from virtually anywhere, and from any computer or mobile device.

Another option is to choose a hybrid cloud solution like Egnyte. Egnyte does provide cloud file storage, but it can also connect and sync with local storage platforms.

Just keep in mind that this approach has tradeoffs. In order to gain greater security and privacy, you have to take responsibility for managing and maintaining the servers and data, which is arguably one of the biggest benefits of cloud services for small businesses. Also consider the fact that the third-party cloud support personnel might know more than you do about security and privacy, so managing it yourself may give you an illusion of greater security and privacy, while actually putting your servers and data at greater risk.

Tony is principal analyst with the Bradley Strategy Group, providing analysis and insight on tech trends. He is a prolific writer on a range of technology topics, has authored a number of books, and is a frequent speaker at industry events.
More by Tony Bradley

View the original article here

Businesses shouldn't let Google and Microsoft outages shake their confidence in the cloud

The recent outages of Google and Microsoft’s Outlook.com reinforce concerns many businesses have about relying on cloud services and may cause organizations that have already moved or are considering moving to the cloud to reconsider. When you look at the big picture, though, you can still trust the cloud.

It’s no secret at this point that there are a number of benefits to using cloud services. Cloud providers are generally able to take advantage of economies of scale that let them offer servers, storage, and services cheaper on a per user basis than what businesses can accomplish on its own—particularly small and medium businesses that have fewer employees to average the investment across.

There are 8,760 hours in a year. Google went dark for about five minutes. That's barely a hiccup.

Along with those benefits, however, comes the stark reality that you’re entrusting your business to third-party companies and to servers that exist somewhere “out there.” If your Internet connection fails for any reason, or if those servers suffer an outage as Google and Microsoft did, suddenly business grinds to a halt.

It’s obviously a huge deal when servers or services you depend on are unavailable, and your business is dead in the water at the mercy of a third party. That sucks. But before you swear never to trust the cloud again, think of the bigger picture.

The Holy Grail of uptime for servers and services—whether local or in the cloud—is generally accepted as “five nines.” In other words, we recognize that no system is perfect, and that some downtime is to be expected, and we consider 99.999 percent uptime to be pretty awesome.

There are 8,760 hours in a year. That’s 525,600 minutes—not including leap days. Google went dark for about five minutes, or a fraction of a fraction of the year. That's barely a hiccup. The Outlook.com outage was significantly longer—a few hours—but that is still less than a tenth of one percent of the year.

A company that chooses to trust any part of its business to cloud-based services should consider the potential disruption that will result from an Internet or server outage. But the question they have to consider as well is, “Can we do it better?”

For most small and medium businesses, the answer is probably “No.” That is especially true if you factor in cost.

No server or network is perfect. If a business chooses to manage its own network and servers on premise to avoid the inherent risk of the cloud, there is still an equal possibility of a server or network outage. For many businesses, the risk is actually greater because the cloud provider has trained personnel tasked to maintain the infrastructure 24/7, whereas SMBs tend to just dump IT management in someone’s lap and hope for the best.

There are pros and cons to the cloud, but there are also pros and cons to managing a local IT infrastructure. The reality is that for most small and medium businesses the cons of the cloud don’t outweigh the pros.

Businesses should consider the fact that servers will crash, and networks will go down. Hopefully, it won’t happen often, but if your business relies on access to certain servers or data to conduct basic operations, there should be a disaster recovery and business continuity plan in place that defines what to do when an outage occurs.

If the outage is a few minutes, or even a of couple hours, it’s not such a big deal for most companies. But consider what you would do if your servers are unavailable for days, or weeks. Define mitigating processes that can be used to conduct business on a short-term basis, and consider what your options are to restore, rebuild, or replace your infrastructure if necessary.

Tony is principal analyst with the Bradley Strategy Group, providing analysis and insight on tech trends. He is a prolific writer on a range of technology topics, has authored a number of books, and is a frequent speaker at industry events.
More by Tony Bradley

View the original article here

Google to encrypt Cloud Storage data by default

Google said Thursday it will by default encrypt data warehoused in its Cloud Storage service.

The server-side encryption is now active for all new data written to Cloud Storage, and older data will be encrypted in the coming months, wrote Dave Barth, a Google product manager, in a blog post.

"If you require encryption for your data, this functionality frees you from the hassle and risk of managing your own encryption and decryption keys," Barth wrote. "We manage the cryptographic keys on your behalf using the same hardened key management systems that Google uses for our own encrypted data, including strict key access controls and auditing."

The data and metadata around an object stored in Cloud Storage is encrypted with a unique key using 128-bit Advanced Encryption Standard algorithm, and the "per-object key itself is encrypted with a unique key associated with the object owner," Barth wrote.

"These keys are additionally encrypted by one of a regularly rotated set of master keys," he wrote. "Of course, if you prefer to manage your own keys then you can still encrypt data yourself prior to writing it to Cloud Storage."

Data collection programs revealed by former U.S. National Security Agency contractor Edward Snowden have raised questions about U.S. government data requests made to Internet companies such as Google for national security investigations.

A Google spokeswoman said via email the company does not provide encryption keys to any government and provides user data only in accordance with the law.

"Our legal team reviews each and every request, and we frequently push back when the requests appear to be fishing expeditions or don't follow the correct process," she wrote. "When we are required to comply with these requests, we deliver it to the authorities. No government has the ability to pull data directly from our servers or network."

Send news tips and comments to jeremy_kirk@idg.com. Follow me on Twitter: @jeremy_kirk

View the original article here

IBM, Verizon to compete for $10 billion in government cloud work

IBM, Verizon and eight other companies will compete for $10 billion worth of work to help move the U.S. Department of the Interior’s IT systems to the cloud.

The Department of Interior (DOI) anticipates saving over $100 million a year between 2016 and 2020 by shifting workloads from the 400 data centers that it now maintains.

“These contracts will not only allow us to move these apps to the cloud, but move them in a well-planned, methodical way,” wrote Andrew Jackson, DOI deputy assistant secretary for technology, information and business services, in a statement.

Ten companies have each been awarded an Indefinite Delivery Indefinite Quantity (IDIQ) contracts that will allow them to compete for individual task orders in building out the Interior Department’s cloud. AT&T, IBM, CGI Group, Unisys, Verizon, Lockheed Martin, Aquilent, Autonomic Resources, Global Technology Resources and Smartronix all were awarded contracts.

Typically with an IDIQ contract, a company is not awarded any money initially. An IDIQ is often referred to as a license to hunt, meaning that it is a set of terms that have been pre-negotiated between the vendor and the agency to expedite the process of issuing work orders.

With this IDIQ, the DOI will issue task orders for individual projects, which these 10 companies will compete for. Each company can be awarded up to $1 billion of work for DOI.

Other U.S. federal government agencies can use the IDIQ contract vehicle for their own work as well.

The first project under this contract vehicle will be to set up and host an SAP implementation. The agency will also issue task orders for virtual machines, storage, database hosting, secure file transfers, Web hosting, as well as for maintaining development and test environments.

The contract vehicle was scheduled to be issued in May, but was held up by a protest from a vendor that was not included in the final selection. CenturyLink argued that the contract wording was too vague to be truly competitive. The Court of Federal Claims struck down that challenge last week.

The DOI has been working with cloud computing for awhile. In 2012, the agency began consolidating all of its email and collaboration services to a cloud service, Google Apps for Government.

For IBM, the DOI contract is potentially the largest cloud computing job the company has been awarded. IBM expects that it will use the assets from its recent purchase of IaaS (infrastructure-as-a-service) provider Softlayer, which it plans to use in its Smart Cloud for Government hosted service.

Comprised of 16 bureaus and offices, the DOI oversees federal owned lands and U.S. natural resources, including 500 million acres of park lands. Its annual IT budget is more than $1 billion a year.

Joab Jackson covers enterprise software and general technology breaking news for the IDG News Service.
More by Joab Jackson

View the original article here

What to Consider Before Moving Your Business to the Cloud

It seems like everything is about the cloud these days: servers are moving to the cloud, data is stored in the cloud, applications and services are hosted from the cloud. Based on all of the buzz, it would make sense to assume your business needs to be in the cloud as well, and that if you’re not you must be missing out on something. Before you rush off to the great big service in the sky, though, make sure you understand both the pros and the cons and ask yourself all the right questions.

You’re probably already familiar with the reported benefits of the cloud. Moving servers and storage to the cloud is alleged to provide ubiquitous access, simplify management and administration, and enable businesses to operate more efficiently all while cutting costs.

It sounds Utopian. It’s not all sunshine and roses, though. Moving servers or data storage to the cloud definitely has some pitfalls.

For starters, you have to go through the effort of getting data moved to the cloud in the first place. That introduces an issue of vendor lock-in—meaning once your servers and data are hosted with one cloud provider, it’s extremeley difficult to move them to a different provider in the future. Choosing a cloud provider is a marriage of sorts, and you’d better be confident that it’s a relationship you and your business can live with for the foreseeable future.

Meanwhile, the advantage of ubiquitous access comes with the potential that technical issues with the cloud provider or an interruption in your Internet service could cut you off from your applications and data completely. Finally, storing data out on the Internet puts it at increased exposure to risk, and requires you to entrust the security and privacy of your data to a third-party.

That's why you need to consider the whole picture—the pros and the cons—to determine what works best, and mitigate any potential risks. For example, it can be a cost-effective means of storing data, but storing data in the cloud introduces bandwidth challenges—especially for small businesses that often rely on consumer-grade Internet services—as well as potential concerns over data security.

One popular solution is to use a hybrid approach that straddles the line between local servers and the cloud. A small business can achieve many of the same benefits of simplified management, efficient operation, and rapid scalability by employing virtual servers on a local machine, and selectively choosing the applications and services that make sense to operate off-site without creating any unnecessary risk or burden.

Businesses can take advantage of cloud applications and services such as Salesforce for managing sales and customer relationships, or Office 365 for online access to Microsoft’s suite of productivity tools. Box.com and other cloud storage services can serve as an effective means of backing up and/or sharing data.

The core servers and applications the business relies on, however, can be maintained locally without the pitfalls of the cloud. Small and medium businesses don’t have to install or maintain a complete data center to accomplish that, either. With the right hardware, an entire IT infrastructure including virtual servers and data storage can be managed from one machine. Administration is simplified, power and cooling costs are minimized, and—most importantly—the virtual servers and data can still be made available over the Web to achieve the same ubiquitous accessibility as a cloud application.

To be fair, the hardware, software, Internet connectivity, and other elements of the IT infrastructure are prone to the same risks and issues whether maintained locally, or hosted in the cloud. SMBs need to consider the tradeoffs of cost, security, availability, and maintenance, and choose the mix of on-premise and cloud services that work best.

View the original article here

Attackers reported seeding cloud services with malware

LAS VEGAS -- Malware writers are ramping up their use of commercial file hosting sites and cloud services to distribute malware programs, security researchers said at this week's Black Hat conference here.

Traditionally, malware writers had distributed their malicious code from their own sites.

But as security vendors get better at detecting and blacklisting those sites, hackers are increasingly distributing their malware products from legitimate host sites. The technique has been used a bit for more than two years, but now appears be gaining steam, researchers said. (See also "When malware strikes: How to clean an infected PC."

Often, the owners of legitimate sites fail to properly scan the content they are hosting, which allows attackers to furtively post malicious code with relative ease, said Michael Sutton, vice president of research at ZScaler, a provider of cloud-based security services for enterprises.

Malicious content distributed from a legitimate site is more likely to make it past corporate defenses. Vendors are also unlikely to blacklist a legitimate hosted service, allowing malicious content hosted on one to stay up longer, he said.

Zscaler said he's heard reports of malicious files hosted on Dropbox, but the they appear to have been removed, the blog noted.

Sutton pointed to recent incidents were attackers posted and distributed malicious code on Google Code and Dropbox as an example of the trend. A blog on Zscaler's website lists nearly three dozen malicious files hosted on the Google Code site, which contains tools for software developers.

The message for IT managers: Don't blindly trust domains that seem to be secure, Sutton said.

"Attackers are starting to leverage hosting services" to stage malicious code, he said. "It used to be that [attackers] would set up their own servers," to host malware. "Then we saw them infecting legitimate third-parties. Now they are using hosting services. They are no longer paying for hosting [malware] and are less likely to get blacklisted."

Meanwhile, Firehost, a provider of cloud-hosting services for enterprises, has seen an increase in Web application attacks originating from the networks of legitimate Web hosting services, said CEO Chris Drake.

In its latest quarterly security review, Firehost observed a noticeable increase in the number of SQL injection attacks, directory traversal attacks and other Web application attacks launched from within cloud service provider networks, Drake said.

Cloud providers often have weak validation procedures when signing up new customers, allowing attackers to create accounts with fake information. The accounts are then used to deploy and administer powerful botnets that run in the cloud infrastructure, he said.

In the second quarter of 2013, the IP filtering system that Firehost uses to protect its customers against malicious attacks blocked about 1.3 million unique attacks. Of the total, a noticeable number of attacks originated from IP addresses belonging cloud services companies, Drake said.

Jaikumar Vijayan covers data security and privacy issues, financial services security and e-voting for Computerworld.
More by Jaikumar Vijayan

View the original article here

IBM says SEC will investigate how it reports cloud revenues

Sorry, I could not read the content fromt this page.

View the original article here