Right time to review the following security standards

Security is the keyword that makes or breaks an organization and an essential requirement of cloudification of your business. Even though it is debatable whether compliance and security are one and the same, it is easy to see that security concerns begat the other.

Instead of adding a reading list, I am summarizing some of the security related acronyms that I came across while looking at the security standards and the standards adopted by some of the countries.

Here are some links to Asian Standards.

China:
http://csis.org/publication/national-security-and-chinas-information-security-standards

India:
This is quoted from the following:
"The International Standard IS/ISO/IEC 27001 on “Information Technology –
Security Techniques – Information Security Management System – Requirements”
has been adopted by the country"
In effect it adopts IEC 27001 for its requirements.

http://www.naavi.org/cl_editorial_11/draft_guidelines_43A-79-cyber_cafe/senstivepersonainfo07_02_11.pdf

Japan:
Also follows ISO 27001 and it is required by companies just like in India.
http://www.safis-solutions.com/resources/IndustryNews/iso27001.shtml

Regarding the acronyms:

PII is ―"any information about an individual maintained by an agency, including (1) any information that can be used to distinguish or trace an individual‘s identity, such as name, social security number, date and place of birth, mother‘s maiden name, or biometric records; and (2) any other information that is linked or linkable to an individual, such as medical, educational, financial, and employment information."

The above is taken from NIST's document at this link:
http://csrc.nist.gov/publications/nistpubs/800-122/sp800-122.pdf

Although this is a very broad definition, because of our education, work, or other activity the PII for most people should readily be available. It also turns out that even if you are non-PI source now, once you carry our activities like applying for driver's license; getting an new email address etc may turn you into a PII source.
More here on this:
http://www.gsa.gov/portal/content/104256


PCI
Payment Credit Card Industry Data Security Standard (PCI DSS) applicable to credit card transactions. PCI DSS puts down the requirments to secure entities that deal with processing, storing or transmitting credit card information. There are no visible penalites for not being PCI compliant.

PA DSS is Processing Application Data Security Standard where the application  includes entities that store, transmit Credit Card Information electroncally such as Point-of-sales devices at retail stores; shopping carts on on-line; restaurants; your tax preparer  etc.

Members of Payment Card Industry Security Standard Council (PCI SSC) are American Express, Discover, JCB, MasterCard or Visa

More here:
https://www.pcisecuritystandards.org/security_standards/documents.php?document=pci_dss_v2-0#pci_dss_v2-0

PIPEDA - Canada
Personal Information Protection and Electronic Documents Act (PIPEDA) is an act of Canadian government related to electronic commerce.

"An Act to support and promote electronic commerce by protecting personal information that is collected, used or disclosed in certain circumstances, by providing for the use of electronic means to communicate or record information or transactions and by amending the Canada Evidence Act, the Statutory Instruments Act and the Statute Revision Act
"
This is a quote from the following site:

Details here:
http://laws-lois.justice.gc.ca/eng/acts/P-8.6/

Directive 95/46/EC - Europe
A directive of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data.

Download the directive in pdf here:
http://ec.europa.eu/justice/policies/privacy/docs/95-46-ce/dir1995-46_part1_en.pdf

This here,
http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX:31995L0046:en:HTML
Comprehensively covers the global features of 'Personal Privacy'. It is good read.

Honolulu SQL Training: Register, the classes are going to start soon

The two non-credit courses offered by the Pacific Center for Advanced Training are going to start soon. Register and upgrade your database skills.

Course content and more details here:
http://hodentek.blogspot.com/2013/12/sql-training-in-honolulu-introduction.html

Oracle Day in Honolulu, January 28, 2014

Converge, Connect was the theme of the Oracle Innovation Forum in Honolulu,
Hawaii. With an attendance of over 100 there were lots of interesting
discussions. The event took place in the ball rooms of Westin Moana Surfrider
on the beach side of Waikiki.

The event started off with the key note, Innovation in Practice by Gayle
Fitzpatrik focusing on innovation, convergence and integration. She touched
upon Oracle Cloud Solutions. 25 million Users, and over 10000 customers makes a
compelling case. There were many slides showing how Oracle Cloud Solutions were
better than others in all respects including flexibility, security, and
performance. She also spoke about the dawn of the M2M era and the Internet of
things. In any case business should be good in the coming years with over 50
billion connected devices. Some examples of Oracle solutions adopted by industry
was also mentioned with  lot more details about a Regional Power
Company.

Mark Kelder of Oracle described the Oracle 12 C features; the advantages of
pluggable vs. separate databases for an enterprise. The scaling of pluggable
databases beats that of Separate databases by a wide margin. With Container
Database 12.1, the upgrading in place (in-situ) is a matter of minutes (I am not sure if I got the unit correct; I will sure when the promised PPT arrive)  and you
can plug/unplug databases as required (versions 10.2, 11.1 and 12.1). Point in
time recovery for plugged databases is another great feature which is most
appropriate for SaaS. He also described the cloning of pluggable databases for
test and development as well as dual format covering both row and column for
the in-memory database.

Troy Kitch spoke on Internet of things and various security regulatory
compliances (PII, PCI, PIPEDA, PCI DSS and Directive 95/46/EC). Unfortunately I missed most part of his talk.

In the afternoon Srividhya Kasturi explained the details of Oracle Mobile
Solution covering Mobile Apps; Mobile Platform and Mobile Security. She
mentioned MbaaS, the Mobile backend as service. There was a lot of talk in
trying to answer, what is driving the cloud? Globalization; data explosion;
rise of mobile devices; Social media; and the necessity to modernize to
survive were all mentioned.

I am not sure if this is the order of importance in the driving forces
but what appears to be given is security is still a troubling issue.

She also touched upon a hybrid cloud with private cloud (SaaS, Paas, and IaaS) and Public Cloud (SaaS and PaaS). 5 considerations for cloud integration were laid out; Connectivity, flexibility, (Visibility-Management?), security and scalability). CISCO WebEx order management system with Oracle SOA Suite was mentioned.

Michelle Beasley and Gia Villanueva compared and contrasted traditional ETL+CDC
vs. the modern E-LT + real time. Ross stores case study was mentioned.

All in all it was an interesting day with all the modern buzz and Oracle as
usual extended impeccable hospitality to the attendees.

Full schedule here:

Creating and connecting to a Contained Database in SQL Server 2012

Contained databases are the best choice if you have migration in mind and with SQL Servers both in-house and the cloud, migration will always be an important item to consider.

Read this article for the benefits of Contained databases:
http://stackoverflow.com/questions/5932293/what-is-the-real-benefit-of-contained-databases

SQL Server 2012 only supports partially contained databases and in future versions this may change.

Depending of the version of SQL Server Management Studio you may or may not be able to connect to the Contained database although you will be able to create one. Once you get connected (SQL Server authentication) you will be able to access only the connected database.

The following link describes some error messages you may encounter trying to create a contained database and connect to it. You can use both SSMS as well as T-SQL to create a partially contained database.

http://hodentekmsss.blogspot.com/2014/01/troubleshooting-connection-to-contained.html

The next image shows the tree structure of a partially contained database.

 

UK Government Chooses the OS - the winner is...

According to this article in TechRepublic, UK's Communication-Electronics Security Group seems to have checked out Linux, Windows and Mac OS X from the stand point of security and have come up with Linux as a clear winner.

After you read the article please also read the interesting comments both pro and cons before you jump into big conclusions.

The test for cheching out the Oss consisted of the following:

•VPN
•Disk Encryption
•Authentication
•Secure Boot
•Platform Integrity and Sandboxing
•Application Whitelisting
•Malicious Code Detection and Prevention
•Security Policy Enforcement
•External Interface Protection
•Device Update Policy
•Event Collection for Enterprise Analysis
•Incident Response

The specific OSs tested were Ubuntu 12.04 LTS; Windows 8  and  Mac OS X and the summary of the rating is:

*Ubuntu 12.04 nine of the 12 tests and had zero significant risks
*Windows 8 passed seven with 1 significant risk
*Mac OS X passed eight tests with zero significant risks

Well security is a very important parameter in the choice but there are other criteria such as cost as well. With Microsoft not supporting Windows XP in the near future there may folks looking for a suitable platform and perhaps some Windows folks may go over to Linux.