According to Roland Dobbins, solutions architect for network security specialist Arbor Networks, distributed denial of service attacks are one of the must under-rated and ill-guarded against security threats to corporate IT, and in particular the biggest threat facing cloud computing.

Arbor Networks specialises in technology designed to increase networks' ability to withstand DDOS and other attacks and it counts as its customers many of the world's major service providers, including Telstra and Optus.

DDOS, Dobbins claims, is largely ignored in many discussions around network and cloud computing security. "Most discussions around cloud security are centred around privacy, confidentially, the separation of data from the application logic, but the security elephant in the room that very few people seem to want to talk about is DDOS. This is the number one security threat facing the cloud model," he told last week's Ausnog conference in Sydney.

"In cloud computing where infrastructure is shared by potentially millions of users, DDOS attacks have the potential to have much greater impact than against single tenanted architectures," Dobbins argues. Yet, he says, "The cloud providers emerging as leaders don't tend to talk much about their resiliency to DDOS attacks."

Dobbins told iTWire: "There is a decoupling of traditional information security - which is concerned with policies and procedures - from operational security which is focussed on real time availability.

He claimed also that many organisations offering security advisory services don't include DDOS in the scope of their services. "Many of these organisations don't seem to offer an assessment that will give an organisation an understanding of how vulnerable they are to DDOS attacks. The fact that DDOS seems to fall out of scope of a lot of these assessments is an issue.

"[For example] When you look at the PCI/DSS that has been put forth by Visa and Mastercard there is not a word in there about DDOS so far as I can see. And some of the things they recommend, such as putting in a application firewall in front of servers actually increase the risk of DDOS."

Dobbins said that many organisations had so little understanding of DDOS that they did not even know when there had been an attack. "All they know is that the Internet has gone down. They lack visibility into what is happening in the their network and they lack control over their network. This is true of some service providers who have a whole lot of tickets from users who say their Internet is down and they never know why."

Dobbins acknowledges that for many organisations obtaining and maintaining the necessary level of expertise to guard against all security threats is very difficult.

"Networking security is afflicted by what I call the Microsoft Word problem: 90 percent of the people use only 10 percent of the features. A lot of people have bought gear with a great deal of security features built in but they never make use of them...For many organisation it is difficult to find good people. To get the level of people they need the have to spend up to a certain plateau."

This lack of expertise, he says, affects not only these organisations but leaves their infrastructure open to exploitation for the launch of DDOS attacks on others.

"There a several hundred thousand DNS servers that have been misconfigured with an open recursor. This means that a DNS server in a network can respond to queries from users on other networks. Also many service provider have not put antispoofing technology at the edges of their networks." This, he explained, meant that these DNS servers could be used to generate DDOS attacks by being instructed to send many large packets to an address of a cyber criminal's choosing.

"These constitute a botnet with an open command and control channel and [unlike traditional zombie PCs] are on networks with lots of connectivity."

Paradoxically, although Dobbins sees DDOS as the greatest threat to cloud computing, he also sees it as the potential solution for organisations grappling with the complexities of securing the network infrastructure.

"One answer is to get rid of all IT systems and hand them over to an organisation that specialises in these things. If the cloud providers are following best practice and have the visibility to enable them to exert control over their networks it is possible for organisation to outsource everything to them."

For those organisations that do run their own data centres, he suggests they can avail themselves of 'clean pipe' services which protect against DDOS attacks According to Nick Race, head of Arbor Networks Australia, Telstra, Optus and Nextgen Networks all offer such services.


his article first appeared in ExchangeDaily, iTWire's daily newsletter for telecommunications professionals. Register here for your free trial. 


Leading global SaaS Systems Integrator. Find out more how we can help your business here: Grove Group

In the old way of thinking, companies were used to buying, building, and maintaining their IT infrastructures despite exponential costs. SaaS gives companies an alternative to those headaches. Now, a company can plug in and subscribe to services built on shared infrastructure via the Internet. The SaaS model has gained popularity in recent years with transportation management software because of the many benefits it offers to businesses of all sizes and types, but it also begs several questions and considerations to be thought of as well.

The main benefits that are attracting businesses customers to take advantage of SaaS solutions:

• Higher Adoption Rates: SaaS applications are easily accessible from any computer or any device—anytime, anywhere. Because most people are familiar with using the Internet to find what they need, SaaS apps tend to have high adoption rates, with a lower learning curve.
• Lower InitialCosts and Easier IT Implementation: SaaS applications are typically subscription based. No license fees mean lower initial costs. Having the SaaS provider manage the IT infrastructure means lower IT costs for hardware, software, and the people needed to manage it all.
• Automatic Upgrades: Because the SaaS provider manages all updates and upgrades, there are no patches for customers to download or install. The SaaS provider also manages availability, so there’s no need for customers to add hardware, software, or bandwidth as the user base grows.
• Seamless Integration: SaaS vendors with true multitenant architectures can scale indefinitely to meet customer demand. Many SaaS providers also offer customization capabilities to meet specific needs. Plus, many provide APIs that let you integrate with existing ERP systems or other business productivity systems.

Items to think about when considering a SaaS solution:

• Data Security is more than just user privileges and password policies. It’s a multidimensional business imperative, especially for vendors responsible for customer data. Make sure any provider you’re considering has solid policies and procedures in place to guarantee the highest possible levels of security.
• With on-demand applications, customers rely on their providers to keep systems and data available. You need to trust your SaaS provider to meet your business requirements, so expect them to communicate with you as a partner in your business.
• Scalability is important. With any utility, customers benefit from the scale of the supplier. Scale provides a larger customer community that can deliver more and higher-quality feedback to the vendor to drive future innovation. And a larger customer community provides rich opportunities for collaboration between customers. 

Make sure the vendors you’re evaluating provide:

• Any vendor providing on-demand services should be professionally paranoid, considering every potential disaster, and being prepared for anything.
• Data backup procedures should create multiple backup copies of customers’ data in near real time at the disk level. The strategy should include a multilevel backup strategy that includes disk-to-disk-to-tape data backup where tape backups serve as a secondary level of backup, not as their primary disaster recovery data source. Failover should cascade from server to server and from data center to data center in the event of a regional disaster, such as a hurricane or flood.
• Any provider offering SaaS applications needs to be able to deliver very high availability. A detailed history should be available. Vendors should provide availability data on the entire service, not just on individual servers.

Leading global SaaS Systems Integrator. Find out more how we can help your business here: Grove Group

Leading global SaaS Systems Integrator. Find out more how we can help your business here: Grove Group

A very frequently asked question in schools is this:

How is a Google Account different from a Google Apps account?

Although Google Apps and Google Accounts allow you to access several of the same Google products, they're different types of accounts. A Google Account is a unified sign-in system that provides access to a variety of free Google consumer products -- such as Gmail, Google Groups, Google Shopping List, Picasa, Web History, iGoogle, and Google Checkout -- administered by Google. Google Apps provides access to products powered by Google but administered by a your organization.

My thoughts:

Public Google Accounts provide all the goodies of Google with one simple sign 

Leading global SaaS Systems Integrator. Find out more how we can help your business here: Grove Group

To start using Busy Docs you have to first add folders that you want to share over the network or sync to Google Docs. The next step will be to connect to your Google Docs account. After the connection is established, you can click on the ‘Browse Documents’ link to view the contents of both your Google Docs account as well as the shared folders.

Uploading files to your Google Docs account is just a matter or dragging a document from the local folder and dropping it to a folder in Google Docs. Downloading documents from Google Docs works the same way. Further, there is a ‘Sync Documents’ link on your dashboard that lets you quickly sync documents between the local folders and the remote locations.

Limitations:

Configuration and customization options in Busy Docs is non existent. The server program monitors at a specific port number (9039) and there is no way to change that. There is not even a decent way to shutdown the server, other then end-tasking it from the Task Manager.

To make matter worse, there are no permission or restrictions settings whatsoever. This can be a huge privacy risk for those users who have their machines connected to a network but do not want to share folders with other users. In such situations, proper firewall rules is the only way to keep intruders out.

On standalone machines, however, this poses no risk as Busy Docs cannot be accessed from the Internet.




Leading global SaaS Systems Integrator. Find out more how we can help your business here: Grove Group

One of the most important aspects of running a small business is to keep an organized Office. With a small operation, there typically isn’t a lot of money in the budget to put into an expensive IT infrastructure, and most small businesses don’t worry about it too much because their small amount of employees allows them to communicate and collaborate easily. However, email is still a huge part of the business world, shared calendars are invaluable, and collaborating on documents that are constantly changing is a big part of service-based small businesses. Google Apps offers all of those features and A LOT more. If you own a small business and you don’t want to pay $300 per MS Office license, then keep reading.

Google Apps Standard and Google Apps Premier

For small businesses with less than 50 employees, the recommended product is Google Apps Standard which is COMPLETELY free. You don’t pay a dime. It’s a pretty sweet deal for you business owners out there. The reason it’s recommended for businesses with less than 50 employees is because the free version only allows 50 Gmail hosted email addresses. For businesses with more than 50 employees, there is Google Premier that charges $50 per user, per year but it offers more space and more features. Here’s a chart to show you the differences:
Advantages of Google Apps


It’s FREE for the first 50 users!! This works out great, because a lot of small businesses have less than 50 employees.

• It’s cloud computing at its best. All of your email, important documents, calendars, and other project management information can be accessed anywhere there is an internet connection.
• You get all of the great advantages of Gmail such as their sweet SPAM filter and their accurate search function to easily find archived email.
• Sharing is everywhere. ou can make changes to a Google doc at the same time that a co-worker is making changes to it. Also, the shared calendar is a beautiful thing.
• It’s a great solution for a company without an IT department because it’s fairly easy to set up, and it doesn’t require any hardware or software to install.

The Disadvantages of Google Apps

• If you have a business over 50 users, they charge you $50 per user per year. That’s still not much for what you get, but it sucks for businesses with 52 employees.
• Technical support is not personal. If something goes wrong or the Google server goes down, who do you call? Your guess is as good as mine. You pretty much just wait. However, Google rarely has outages, so this isn’t that big of a deal.
• Google Docs may not be as feature-rich as the desktop office apps by Apple and Microsoft, but it’s getting there, and it can easily import/export the most common file formats.
• My Experience With Google Apps

I’ve used Google Apps as an employees and I’ve used it with my personal freelance business to keep things organized and to help my partner and me collaborate best. I’ve set it up on my own, and if you have some basic knowledge of DNS name servers and records, it’s really not that hard to set up. I’m a big fan of the Google products, and I’m forever a fan of Gmail, so this is a no-brainer for me. I love that my business lives online rather than on one network or only on work computers. Google Docs is great because it literally allows you to work together with someone on a document without overwriting each other’s changes.

I would highly recommend that small businesses make the switch to Google Apps if they do not already have a cohesive inter-office system. Organization is key to a successful business, and what I like most about the Google Apps suite is that it all connects together. It only requires one login for each user, and it offers simplicity to your employees. Also, Google is in the works of allowing your Google Apps login to be able to be used in conjunction with a ton of their other applications like Picasa, Google Maps, Google Alerts, Google Trends, and Google Analytics, just to name a few. If you want to make the switch but you aren’t tech savvy, look for a Google Apps specialist in your area.

Have you worked directly with Google Apps or even Gmail in general? What’s your feedback on their products and features?

Leading global SaaS Systems Integrator. Find out more how we can help your business here: Grove Group