As a result, this CTO’s company, which had deployed its applications on top of Amazon’s Web service offering, is bugging out of the public cloud and into a private co-location facility. While he believes his team can configure the Amazon service to be just as secure as the on-site option, and the cloud’s low startup costs and rapid deployment benefits are attractive, he had to ask: Could the model cost us business?
No matter how many times public cloud providers assert–often correctly–that data is well-protected on their servers, they just can’t shake the insecurity rap. And that means CIOs need to ask not just whether the cloud makes business sense, but whether their customers will see it that way. They may not: Security tops the list of cloud worries in every InformationWeek Analytics cloud survey we’ve deployed. In our 2010 Cloud GRC Survey of 518 business technology professionals, for example, respondents who use or plan to use these services are more worried about the cloud leaking information than they are about performance, maturity, vendor lock-in, provider viability, or any other concern.

That doesn’t mean businesses are shunning the cloud. Of those respondents who do use or plan to use these providers, within the next two years, 20% say up to half of their IT services will come from the cloud; an additional 45% say a quarter of their IT services could be delivered that way. The benefits, such as lower deployment costs and faster time to market, are just too attractive, particularly in today’s business climate of stagnant budgets and staffing uncertainty. Still, your customers have legitimate questions about running applications in the cloud, whether on infrastructure-as-a service (IaaS) or platform-as-a-service (PaaS) environments. IT must help the business be prepared with good answers to the two main questions we raise, and others specific to the product. It may make the difference between winning business and losing confidence.

First, customers will look for assurance that an application that runs on PaaS is as secure as an application that runs behind an on-premises firewall. The answer will normally be “No–unless it is.” It’s an irritating response, but that’s because cloud security is frustrating. Here’s the breakdown.

A Web application you develop and deploy in a PaaS environment is no more–and no less–secure than a Web app you develop and deploy yourself. The basic principles of secure application development don’t change because of the cloud. “Cross-site scripting is still cross-site scripting. There’s not much difference whether it’s in-house or PaaS,” says Brian Chess, chief scientist and co-founder of Fortify Software, an application security testing company. The upshot? Developers must be trained to write secure software, regardless of where that software runs. Applications must be tested regularly to ensure that the inevitable vulnerabilities are found and remediated. Building and running an application on top of Windows Azure, Google App Engine, or Engine Yard doesn’t excuse an organization from following these principles.

Source

Rackspace convened a group of interested companies the week of July 12 and asked them if they would help build a stack of open source software that would power a more uniform, future cloud environment. This move had one target, Amazon Web Services EC2, which has run away with the cloud infrastructure market.

Isn’t there already open source code opening up EC2? There is, from Eucalyptus Systems, which did a sterling job of duplicating basic Amazon functionality in its set of compatible interfaces. The Eucalyptus interfaces duplicate basic Amazon functionality, such as ‘load this workload onto a virtual server,’ and then builds them out into cloud infrastructure — for the enterprise private cloud. Eucalyptus Enterprise Edition is a commercial product meant to capitalize on what Eucalyptus open source code created.

The Rackspace initiative is different, and Eucalyptus Systems CEO Marten Mickos said as much when he responded to an InformationWeek query. It “aims at a cloud with a million nodes. It is an entirely non-commercial initiative,” he said. By “aimed at a million nodes,” he means OpenStack, unlike Eucalyptus, is a code project aimed at major cloud suppliers of the future (which, of course, will be commercial initiatives). The project itself isn’t aimed at producing code to be sold as a commercial product so much as providing a cloud infrastructure to be shared across many cloud suppliers.

I found Thorsten von Eicken, CTO of RightScale, which front ends both Rackspace and EC2, the most zeroed in on this new development. In a July 18 blog, he said: “RackSpace has committed itself to a true open source project, meaning that it’s not just source code thrown over the wall into the open, but also an open design process, an open development process and an open community.”

The Rackspace-sponsored meeting lead to a session on OpenStack requirements, with Rick Clark, senior manager of software product development at Rackspace, “managing the requirements gathering very openly,” wrote von Eicken. “I expect we will see a good number of companies contributing code to this project.”

The companies participating at what Rackspace termed its Design Summit were: AMD, Intel, Dell, Citrix Systems, NTT Data, RightScale, Zenoss, Autonomic Resources, SoftLayer, Opscode, CloudSwitch, Cloudscaling, Cloud.com, Cloudkick, enStratus, FathomDB, iomart Group, Limelight, Nicira, Peer 1, Puppet Labs, Riptano, Scalr, Sonian, Spiceworks and Zuora.

The strength of this group is that it has the expertise to cover many bases. The weakness is that it may or may not have the ability to keep a strict focus, keep members engaged, keep code coming over a long period of time. Even if it meets those goals, it may not appeal to all cloud suppliers, who for reasons of their own may adopt a more Amazon-like approach or simply their own approach.

This is open source by and for the benefit of a group of vendors, who wish to supply components to the future cloud and know they will not be able to do so if Amazon’s EC2 is the only player. That’s a little different from the wide open Linux project, which attracted skilled developers whose efforts were then adopted by thousands of other skilled developers on an independent basis. Whatever OpenStack produces, there’s no guarantee that a majority of open source developers, nevermind a majority of cloud suppliers, will adopt it.

But we need the OpenStack project. The open source projects keep Amazon honest, keep it innovating and pushing the cloud frontier forward rather than letting others get there first. We need an alternative to Amazon as well, lest the dominant supplier become so dominant that it can dictate the market. We need more than one alternative.

We now have Eucalyptus and OpenStack injecting code directly to the future cloud market, with different target users in mind. One way to insure we don’t end up in a cloud era that resembles the age of IBM mainframe domination or Microsoft desktop domination is to create and sustain these alternatives.

“Having many fragmented cloud efforts doesn’t really help build a compelling alternative to Amazon,” warns von Eicken.

That’s right, but in the long run, the cloud isn’t just one thing. There will be many variations to the sets of services that it offers and business models that it employs. These services will be built out more rapidly if providers can share infrastructure components and customers can move with ease from one cloud to another.

By putting its weight behind this stack, Rackspace at a stroke has generated a possible basis for competition with EC2 — a future environment shared across a wide range of providers. Whether that eventuality ever materializes remains to be seen, but I see no technical barrier standing in the way.

“The bottom line is, we believe this to be a potentially game changing event,” wrote von Eicken. If the desire to produce code by this set of vendors is matched by a desire to use the code by an even broader one, then, yes, we will have just witnessed a game changing event.

For more thoughts on open source in cloud computing, see Zenoss engineer Mark Hinkle’s presentation on Linux, Open Source and Socialized Software at the O’Reilly Open Source Conference in Portland, Ore.

Source

“We’ve sent detectives out to every gas station within a mile of (U.S.) Interstate (highway) 75,” says Lt. Steve Maynard, spokesman for the Alachua County Sheriff’s Office in Gainesville, Fla., which last Thursday was first notified about a suspicious skimming device discovered by a maintenance worker at a Shell Station. So far, three card-skimming devices hidden in gas pumps at three stations have been discovered by the Alachua County Sheriff’s Office, and the U.S. Secret Service has been notified as part of the gas-pump card-skimming investigation.

The Secret Service may be best known as the U.S. president’s bodyguard, but it is also responsible for investigating fraud and computer crime.

The Alachua County Sheriff’s Office, along with other local police departments, are trying to inspect as many gas stations in the area as possible, especially focusing on those along I-75. But law enforcement is encouraging gas station operators to look for signs of the skimmers at their pumps and contact them if they think they’ve found something. The Secret Service has indicated there’s a crime wave throughout the Southeast involving the gas-station pump card skimmers, and it may be traced back to a single gang that may be working out of Miami, Maynard says.

Nearby St. Johns County in Florida has also been hit by the gas-pump card skimmers. Maynard says criminals wanting to hide the credit-card skimmers in gas pumps have to have a key to the pump, but in some cases a single key will serve to get into many gas pumps. It’s not known if the gas-pump skimming operation involves insiders or not. Law enforcement is encouraging gas-station operators to train video surveillance they may use on the pumps.

The particular card-skimmers seen in Alachua County have put together devices with computer components and in this case, a Bluetooth wireless capability to easily send the card information to the thieves. It’s not yet known how many credit cards may have been stolen by means of the skimmers and fraudulently used. The investigation is “ongoing,” Maynard says. “We’re nowhere near closure. We wish we were.”

Source

PORTLAND, OR – OSCON – July 19, 2010 – Puppet Labs, the leader in data center automation, today released Puppet 2.6, a major upgrade with a focus on improvements for enterprise environments. Puppet 2.6 includes new functionality and features that make managing servers even easier. To download Puppet 2.6, visit www.puppetlabs.com/.

“The 2.6 release places an even stronger emphasis on the enterprise while also opening up new opportunities for people with varied skill sets to use Puppet,” said Luke Kanies, CEO of Puppet Labs. “Since our last release was 0.25.5, we say that it’s ‘eleventy times better.’ The changes are truly significant because Puppet is now even more capable of making traditionally painful, manual process easier for systems administrators. We’ve also dramatically improved the ability to integrate Puppet with existing systems, making it a platform for automating your infrastructure.”

New features include:

REST API, making it easier to integrate Puppet with other systems.
Preliminary Windows support for heterogeneous computing environments.
Language enhancements & an Internal DSL so administrators who know and want to use pure Ruby for infrastructure development, can easily do so.
Event model, which lays the foundation for powerful reporting and monitoring. It provides structure to data generated by the system and facilitates reporting and analysis, simplifying the identification of infrastructure problems.
Easy to deploy and maintain, Puppet simplifies many standard tasks for systems administrators, while ensuring consistent environments for application engineers. Puppet is cloud-ready, but can also be used with current infrastructure: internal or external clouds, virtual environments, or in physical infrastructure. Puppet is supported on a variety of operating systems: Red Hat, CentOS, Fedora, Debian, Ubuntu, SuSE, Solaris, HP-UX, AIX, BSD, Windows, and OS X.

Other additions with Puppet 2.6 include significant work in the core of Puppet to make it easier to work with configuration data, including enhancing how Puppet reports on what it does, adding more audit capabilities and helping export information about the infrastructure environment. The command line interface has also been completely redesigned to allow using a single executable to interact with all of Puppet’s functionality.

Today Puppet Labs also announced a $5 million Series B round of funding from Kleiner Perkins Caufield & Byers, True Ventures, Radar Partners, and Emerson St. Partners. With this new funding, Puppet Labs plans to accelerate the expansion of its engineering team.

For more information about Puppet, visit www.puppetlabs.com. For more information about the 2.6 release visit www.puppetlabs.com/2dot6.

Source

Today, we at Rackspace launched an ambitious project called OpenStack that aims to make this new world a reality.

I want to lay out the thinking that got us here and why we think this moment will change computing forever.

“The cloud” at its most fundamental level is all about a massive supply increase in computing power. The PC era was all about putting a computer on every desk. The cloud era goes a step further, putting the power of supercomputing at the literal fingertips of every individual at anytime. Whether it’s enabling a youth soccer coach to schedule practice across the online calendars of 18 families, or helping a scientist fold proteins to design new cancer drugs, or encouraging a frontline employee to instantly and cheaply test a new marketing campaign, the exponential growth in computing power and applications is changing every corner of our economy and society. And, this era is truly just beginning. We have seen only a tiny fraction of the potential gains that arise from cheap, ubiquitous computing power.

As this landscape has evolved, some have dismissed cloud computing as just a return to the mainframe era. This view is fundamentally wrong. Mainframes were available to only the smartest employees at the richest companies. The cloud is accessible to all, and usable by anyone, at low cost. Its ubiquity is the source of its power.

However, there is one area where mainframe concepts are intruding into the cloud – the vertically integrated technology stack. As hardware and software merge into services, the danger of locked down proprietary software stacks are emerging in the cloud space. The cloud world changes everything, and that is not good to many entrenched interests of the old guard. Core technologies from operating systems to hypervisors to databases are being used to tie cloud customers into an integrated view of the world.

If the web has taught us anything, it is that open systems, portability, and choice drive innovation. The open Linux system brought us a mountain of software and tools to help accomplish almost any task. And, each component, whether a database or a widget could be moved in and out freely based on the job getting done.

We at Rackspace have long talked about an “open” cloud. And as a service provider built on our Fanatical Support difference, we have never had an interest in creating technical walls around our service. But, given that no standards tools have emerged to build massively scalable clouds, we too have had to build custom software that creates some level of wall around our cloud offerings. For months we have debated how to drive greater standards and increase the velocity of cloud technologies in general. We finally converged on the obvious answer: open source our cloud technology.

Today, we announced a new open source project that includes those core technologies: OpenStack. And, we are not alone. As we looked at all the projects that already existed to drive standards we saw that other efforts were underway that complemented what we have done. We saw a ton of promise in the Nebula computing project built by NASA and are making it a core part of the project. Taking the contributions of Rackspace and NASA as a starting point, OpenStack forms a powerful foundation of technologies including, a scalable compute provisioning engine – OpenStack Compute – and a fully distributed storage engine – OpenStack Object Storage.

The community, which we plan to actively support and drive, is live today at openstack.org with code available for download.

Last week we assembled a strong group of cloud community leaders and developers to meet and review the architecture, engage on technology direction and contribute code. The effort attracted more than 100 participants from 25 companies including hosting companies, telecom providers, hardware manufacturers, cloud ecosystem companies and beyond. This enthusiasm and collaboration around OpenStack has laid the foundation for a vibrant and innovative approach to building the core software to power the future cloud world.

What do we expect OpenStack to mean for the cloud community? Some pretty major things. One, anyone will be able to run this cloud and do it anywhere. Enterprises and governments will be able to build private clouds. Service providers will have the same technology used by Rackspace and NASA to build new offers. Choice and portability are inevitable in this world. Two, the whole tech ecosystem can build around this foundation. With wide adoption, there will be a market for new services all around this core engine. From storage systems to monitoring tools to management systems, there is no end to what can be attached to the core project. Three, the cloud will advance faster than ever. Between just NASA and Rackspace, an army of developers are committed to the continued advancement of OpenStack. With our emerging supporters in the project, we expect to dramatically expand that army. Finally, a core set of standards will be freely available and totally open. New technologies can be attached. Better solutions will be driven into the product. And, the use of this powerful technology will not tie you to the use of any other technologies.

For our customers, we think there are many benefits that flow from these community gains. Not only will this help our offers develop faster and more transparently, but our customers can run private editions of our core systems in house or in our managed hosting operation.

We could not be more excited about the launch of this project and the enthusiasm around it. As a company that has invested a great deal in the development of cloud technologies, we did not take the decision to open source lightly. We think this decision will serve our interests and those of our customers. While we at Rackspace hire top developers and engineers to make sure our technology is second to none, seeking a technology advantage has never been our approach. We have our own vision about how to deploy this technology and serve customers – by giving them seamless access to scalable computing with the trusting partnership that comes through Fanatical Support. But, there will be many approaches and winning formulas. We think by welcoming those approaches and driving standards and more rapid innovation we will all win.

We hope you join us in this cause. We know there are many parties who might want to join us in the effort, please reach out to us.

We look forward to updating you as we make progress.

Source

No customer data was affected. The data was held by the company’s pension department.

The drive contained images of microfilm files, which included names, addresses, dates of birth, Social Security numbers and a “limited amount” of bank account information. Some health insurance information may have also been included — mostly enrollment forms, but also details about coverage, treatment, and other administrative information.

The data spans a period from 1960 to 1995.

AMR also believes some of the employee files also contained information on beneficiaries, dependents and other employees from 1960 to 1995.

The company has sent letters to the people that were impacted by the breach. AMR is offering one year of free credit monitoring for those affected.

It has already stepped up protective measures at its headquarters, including increasing security and testing the vulnerability of its computers.

AMR said it’s still investigating the incident.

Source

We have created a set of AKIs (Amazon Kernel Images) which contain the PV-Grub loader. This loader simply chain-boots the kernel provided in the associated AMI (Amazon Machine Image). Net-net, your instance ends up running the kernel in the AMI instead of the kernel specified in the boot process.

You need to install an “EC2 compatible” kernel and create an initrd (initial RAM disk) as part of your AMI. You also need to create a menu (/boot/grub/menu.lst) for the Grub boot loader. Once you’ve done this you can create the AMI and then launch instances by using one of the PV-Grub “kernels” as described above. You may find this document to be helpful if you want to learn more about the Linux boot process.

To be compatible with EC2, a Linux kernel must support Xen’s pv_ops (paravirtual ops) infrastructure with XSAVE disabled or the Xen 3.0.2 interface. The following kernels have been tested and/or have vendor support:

Fedora 8-12 Xen kernels
SLES/openSUSE 10x, 11.0, and 11.1 Xen kernels
SLES/openSUSE 11.x EC2 Variant
Ubuntu EC2 Variant
RHEL 5.x
CentOS 5.x
Other kernels may not start reliably within EC2. We’re working with the providers of popular AMIs to make sure that they will start to use PV-Grub in the near future.

You can read more about this in our “Enabling User Provided Kernels in Amazon EC2″ document.

– Jeff;

Source

While perhaps not surprising that disgruntled workers top the list, it’s noteworthy that 28 percent suspected “human error” as the next most likely cause, followed by falling victim to an external hack or loss of a mobile device/laptop, each at 10 percent. The most popular information shared with competitors was the customer database (26 percent) and R&D plans (13 percent).

There was little year-over-year change in the number of respondents who suspected the loss of intellectual property to a competitor, indicating that more needs to be done to protect companies’ most valued assets.

Additionally, to address vulnerabilities related to human error that could expose a proprietary database or financial information, organizations must employ additional layers of control such as the ability to grant privileges to sensitive data and systems on-demand. This limits “innocent” mistakes by allowing access to information only when users need it to perform a particular task or query.

The research also confirmed that snooping continues to rise within organizations both in the UK and the US. Forty-one percent of respondents confessed to abusing administrative passwords to snoop on sensitive or confidential information – an increase from 33 percent in both 2008 and 2009. When examining the information that people were willing to circumvent the rules to access, US respondents targeted the customer database first (38 percent versus 16 percent in the UK) with HR records most alluring to UK respondents (30 percent versus 28 percent in the US).

Despite the rise, there was also the admission that organizations are trying to better curb snooping and are installing stronger controls to prevent these incidents. Based on this year’s survey, 61 percent responded they could circumvent those controls – a decrease from 77 percent in 2009. Additionally, 88 percent of IT professionals believe their use of these privileged accounts should be monitored, however only 70 percent of organizations actually attempt to do so – with one-third turning a blind eye to what’s happening within their networks and therefore failing to meet regulatory and compliance requirements.

Insider sabotage, unfortunately and rather disconcertingly, has increased from 20 percent last year to 27 percent this year.

The survey found that 67 percent of respondents admitted having accessed information that was not relevant to their role. When asked what department was more likely to snoop and look at confidential information, more than half (54 percent) identified the IT department, likely a natural choice given the group’s power and broad responsibility for managing multiple systems across the organization. Of note, this is an up-tick compared to the 35 percent who identified the IT department as likely suspects in 2009, a number that had decreased from 47 percent in 2008. Respondents identified Human Resources the next curious at 11 percent, followed by administrative assistants.

Source

The device will be available to customers in January, according to the people, who declined to be named because the information isn’t public. Natalie Kerris, an Apple spokeswoman, and Jeffrey Nelson, a Verizon Wireless spokesman, declined to comment.

The iPhone, which has been the sole domain of rival AT&T in the U.S. since June 2007, will give Verizon a boost in its competition for smartphone customers, UBS AG analyst John Hodulik said in an interview. Verizon customers, who numbered 92.8 million at the end of the first quarter, may buy 3 million iPhones a quarter, he estimates.

“Apple is going to dramatically increase the number of devices it sells in the U.S. when exclusivity at AT&T ends,” said Hodulik, who is based in New York and rates Verizon shares “neutral.” “It’s hard to ignore the quality issues that AT&T has faced.”

Verizon Wireless, which is building a high-speed fourth- generation network, plans to unveil several devices that will run on the new technology in January at the Consumer Electronics Show, Chief Executive Officer Lowell McAdam has said.

IPhone Gains

Verizon Communications Inc., which co-owns the wireless company with Vodafone Group Plc, slid 9 cents to $28.62 in New York Stock Exchange composite trading at 4 p.m. AT&T fell 49 cents to $24.46. Apple, based in Cupertino, California, dropped $12.13 to $256.17 on the Nasdaq Stock Market.

Peter Thonis, a spokesman for Verizon Communications, and Mark Siegel, an AT&T spokesman, declined to comment. Tenille Kennedy, a spokeswoman for Research in Motion Ltd., didn’t return a call seeking comment.

The iPhone has helped AT&T add subscribers even as the U.S. mobile-phone market nears saturation. There are enough wireless devices for more than nine out of 10 people, according to the CTIA wireless industry association.

In the first three months of this year, about a third of AT&T’s iPhone activations came from customers who were new to the carrier. Without those 900,000 new subscribers, the company may have posted a loss in contract customers that quarter, analysts said.

Still, Dallas-based AT&T has battled customer complaints about its wireless service, especially in New York and San Francisco, and dedicated an extra $2 billion to upgrading its network this year.

BlackBerry, Android

For Apple, a partnership with Basking Ridge, New Jersey- based Verizon Wireless is a victory over rivals such as RIM and Motorola Inc., whose smartphones are currently promoted by the carrier.

“For Apple it means a larger addressable market,” said Andy Hargreaves, an analyst at Pacific Crest Securities in Portland, Oregon. “It’s also good news for Apple in that it will spread the load on the wireless data networks, which will be good for their customers.”

Motorola, which makes Droid phones that use Google Inc.’s Android operating system, fell 27 cents, or 3.8 percent, to $6.80 on the New York Stock Exchange. Google dropped $17.82, or 3.8 percent, to $454.26 on the Nasdaq. RIM, maker of the BlackBerry, declined $3.22, or 6.1 percent, to $49.75.

Apple has sold more than 50 million iPhones since the phone’s introduction in 2007. The latest version, iPhone 4, sold more than 1.7 million units in the first three days after its June 24 debut, a record for the product. Chief Executive Officer Steve Jobs said the company didn’t have enough supply to meet demand. Many stores, including retailer Best Buy Co., sold out.

A release at Verizon in the first quarter will help Apple’s sales in the U.S. grow to at least 15 million units next year from 11 million in 2010, Barclays Capital analysts said in a note today. The company’s suppliers have been ramping up production of components for a phone on Verizon’s CDMA network, according to the research report.

Source

Effective July 1st, 2010, your first 100,000 requests to SQS each month will incur no usage charges. We’ll also provide you with 1 GB per month of outbound data transfer at no charge.

We’ve made SQS more flexible by giving you more control of the maximum message size and the message retention time:

Maximum Message Size – Up until now, SQS messages were limited to 8 kB. This is now a user configurable limit, with a maximum value of 64 kB.

Message Retention Time – Up until now, the message retention time for all SQS queues was four days. This is now a user configurable value with valid values ranging from one hour to two weeks.

Source