Cloud Hosting

Best listening experience is on Chrome, Firefox or Safari. Subscribe to Federal Drives daily audio interviews onApple PodcastsorPodcastOne.

For federal agency technology people, cloud computing seems to be, be there or be square. Despite all its virtues, getting to the cloud can be a challenge. But theres help. Such as the General Services Administrations Technology Transformation Service. With more, the TTS director of cloud adoption, Calvert Smith, joinedFederal Drive with Tom Temin.

Tom Temin: Mr. Smith, good to have you on.

Calvert Smith: Hey, Tom, how you doing? Nice to be here.

Tom Temin: You have a view kind of across federal agencies from the GSA perch, so to speak, and how would you characterize the state of cloud adoption? I mean, theres been a lot of talk for the past number of years. But how deeply into the cloud do you think the government looks at this point?

Calvert Smith: Yeah, this past year has really changed where governments are with cloud, weve seen a really big push over this past year with agencies moving more towards modern networking habits, like edge networking, and tech 3.0. Weve seen a really big push for cloud based collaboration tools. With a pandemic, weve got a lot of agencies that are now forced to be more remote friendly with their customers and with their employees. So were seeing a lot of agencies push to try and get their employees and everyone connected, better, more collaboration tools, all that past email, but more of working with documents and video and things of that nature to get them really connected easier.

Tom Temin: And review for us, what are the current top vehicles that GSA may offer to help them get there, similar to say the equivalent of the DEOS that is on the DoD side.

Calvert Smith: Theres lots of vehicles out there. And its not just about the vehicle, but its more about the agency and their needs. With the centers of excellence, when we come in and actually do a discovery to help the agency gauge where they are, and where they need to be, we actually have our own discovery BPA, which we use a lot to bring the agencies and to get them contracts report really quickly. And to help them define those requirements of where theyre going and where they want to go. We use a lot of RFIs and RFQs, to help refine those requirements. But once we have that done, it really depends on the needs that weve identified and where that agency needs to be. And well stretch that across any vehicle thats out there to really get them the best bang for their buck.

Tom Temin: And the GSA adoption office, do you mostly deal with the agencies that maybe have small IT staffs or maybe rely on shared services for most of their work? Or do you also deal with some of the large agencies?

Calvert Smith: Our CLE model is to really meet agency partners where they are in their modernization journey/ We help them accelerate their transformation efforts and give them the right tools and resources to be successful once we leave. And that model really doesnt matter the size of agency, it can be a bigger agency, like our USDA partner, where we came in with a full contingency of CLE is in leads, and contracts support across cloud adoption, data analytics and customer experience. But also, it could be a smaller agency, like the National Institute of Child Health and Human Development, where we came in really small, and we came in to work with them to build their IT modernization roadmap, and that was just really one CLE. So were always here to help any agency no matter the size, and well work with them to build something that works best for them.

Tom Temin: And from a practical standpoint, agencies may have licenses for collaboration tools, and the Microsoft suite, for example, how does that transfer to the cloud? What do you do with those licenses? How do they rationalize all that so that they end up with just the cost that they need for the new cloud based tools?

Calvert Smith: We really encourage agencies to go through some type of CIO application roadmap, or specifically this IO application rationalization roadmap to really take a look at what they currently have, what licenses they have, what technologies and systems that they have within their agencies, identify those, assess them, define what the best roadmap is for moving those licenses or those systems to the cloud, they may be a lift and shift, or maybe theres license will shift right over into the cloud easily, or those systems, or it may need to be rewritten for the cloud. So identifying what those are setting those priorities and those goals really helps those agencies make better decisions based on resources they have. And no one has unlimited resources. So identifying what licenses they have. And their best route, its really important to make sure that prioritization is set.

Tom Temin: And what about the issue of all of the baggage that people have stored? Presentations, emails, Word documents, you name it, and people get a certain finite amount of space in the cloud. Is there a methodology for clearing out the unneeded from that storage container before they move?

Calvert Smith: Absolutely, that kind of goes back to that application rationalization where youre looking at what you have and whats best for you. And theres lots of different cloud strategies to look at when youre moving that data, some of that data that you need or use on daily basis, maybe you want to move easily to the cloud, but theres also different migration strategies like an archival platform like glacier or other different things. Pretty cool things within the cloud, different cloud environments that you may want to move them off to that you dont access every day or every month. So it really depends on what that data is, where its going to sit, and how often youre going to access it to develop a migration strategy that works for it.

Tom Temin: In at least two famous cases, the providers of the collaboration tools, the productivity tools, are also the cloud provider is it ever possible to separate those two to have tools from one place, and a different supplier of the cloud hosting?

Calvert Smith: Sure, multi cloud strategies are very popular within federal government. Again, it really comes back to the needs of the agencies, what they currently have, where they may be able to go and some of those acquisition strategies. And some of that comes back to the requirements, what current licenses they have, what current applications, the systems that they have, and whats actually possible and feasible for the agency. So theres really a mix. And it really depends on what theyre trying to do and where its best to get that from.

Tom Temin: And on the assumption that a lot of agencies still have not moved, whats your best advice for how you get started?

Calvert Smith: Really goes back to that a rationalization and that roadmap, we specialize and one of the things we really like to do with agencies, with the CLE is come in and help build that IT modernization roadmap. Whats that strategy and that roadmap look like for the agency? What system should they prioritize first? What systems are needed for the business values for that agency? And thats really where you should start. Whats the best value for the agency? Where should they be going and how we can help them get there?

Tom Temin: Yeah, the real theme here is not so much cloud, per se, it sounds like but cloud as a strategy for the real goal, which is modernization.

Calvert Smith: Exactly. Its really about trying to build better for the agency and help them provide better services for the citizens for their employees. And whats the best roadmap for that?

Tom Temin: And do they need any documentation as a rule to make sure that theyre getting the savings or the increases in efficiency? I mean, what are the metrics that they want to watch for in the before and after state?

Calvert Smith: Theres always metrics around cloud cost and what youre moving and how youre accessing data, and what data youre moving to the cloud. Theres a shift when youre moving in a cloud from a capital budget to more operating budget. So the resources are using when youre moving to the cloud, really need to be geared towards the need. Theres no more buying really big servers to hold a small workload, you would gear that more towards your need, use it as your go and try and shut that down when youre not using it. So that goes back to that strategy of whats best for the agency and the systems that youre moving.

Tom Temin: Calvert Smith is director of cloud adoption at the Technology Transformation Service at the GSA. Thanks so much for joining me.

Calvert Smith: Thank you for having me, I appreciate it.

Visit link:
Getting to the cloud can be a challenge, but GSA is ready to help - Federal News Network

Read More..

Join Transform 2021 for the most important themes in enterprise AI & Data. Learn more.

In every tabletop disaster-recovery exercise in every enterprise IT shop, theres a moment when attention grudgingly shifts from high-profile threats malicious intrusion, data theft, ransomware to more mundane (and seemingly less likely) threats, like natural disasters, accidents, and low-tech turmoil.

What hurricanes, explosions, earthquakes, fires, and floods lack in cybersecurity panache, they often make up for in ferocity. The history is clear: CIOs need to put more emphasis on force majeure an act of God or moment of mayhem that threatens data availability at scale when making their plans.

On Christmas Day 2020, a bomb packed into an RV decimated a section of downtown Nashville, Tennessee. The collateral damage included a crippled AT&T transmission facility, which disrupted communications and network traffic across three states and grounded flights at Nashville International Airport. Outages for business clients and their customers lasted through the rest of the holiday season.

This week brought even more stark evidence of the disruptive power of calamity. One of Europes largest cloud hosting firms, OVH Groupe SAS, better known as OVHCloud, suffered a catastrophic fire at its facility in Strasbourg, France. The blaze in a cluster of boxy, nondescript structures actually stacks of shipping containers repurposed to save on construction costs completely destroyed one of OVHs four datacenters at the site and heavily damaged another.

OVH officials were quick to sound the alarm, with founder and chair Octave Klaba warning that it could take weeks for the firm to fully recover and urging clients to implement their own data recovery plans.

Assuming they had them. Many did not.

Scarcely protected data remains a significant problem for businesses of all stripes and sizes. In 2018, Riverbank IT Management in the U.K. found that 46% of SMEs (small and mid-size enterprises) had no plan in place for backup and recovery. Most companies (95%) failed to account for all of their data, on-premises and in the cloud, in whatever backup plans they did have.

The results of such indiscretion are costly. According to Gartner, data-driven downtime costs the average company $300,000 per hour thats $5,600 every minute. The destruction at the OVH facility on the banks of the Rhine near the German border took down 3.6 million websites, from government agencies to financial institutions to computer gaming companies, many of which remain dark as of this writing. Affected complained on blogs and social media that years worth of data was lost for good in the OVH conflagration. The final financial tally will be staggering.

Not all data catastrophes are caused by a hoodie-wearing, Eastern European hacker, said Kenneth R. van Wyk, president and principal consultant at KRvW Associates, a security consultancy and training company in Alexandria, Virginia. Some are caused by the most mundane circumstances.

Sure, we need to consider modern security threats like ransomware, [but] lets never forget the power of a backhoe ripping through a fiber optic line feeding a business-critical datacenter.

Its about a mindset of always expecting the worst, van Wyk said. Security professionals look at systems and immediately ask What could go wrong? Every business owner should do the same.

In this age of ubiquitous cloud migration and digital transformation, what can IT leadership do to gird the organization against hazards large and small? The answer lies within the realm of business continuity and disaster recovery (BCDR). This well-codified discipline in information security is a critical, but often missing, piece in enterprise risk management and mitigation. Most organizations understand the basic rules of engagement when it comes to BCDR, but security experts agree that execution often lacks rigor and commitment.

As a CIO, Id immediately ask, Have we truly tested our backups and recovery capability?' said cloud security specialist Dave Shackleford, founder and principal consultant at Voodoo Security in Roswell, Georgia. Whether cloud-based or not, too many organizations turn disaster recovery and business continuity planning and testing into paper exercises without really ensuring theyre effective.

For organizations looking to protect key digital assets, what Shackleford deems an effective BCDR approach begins with a few time-tested best practices.

Ask about redundancy and geographic resilience and get it in writing. Losing two cloud datacenters will always result in disruption and downtime, even for a host like OVH with 300,000 servers in 14 facilities across Europe and 27 worldwide. But how painful and protracted that loss is will largely depend on the robustness of the hosting companys own backup and fail-over protocols.

The assurances, as spelled out in the service-level agreement (SLA), must also go beyond data processing and storage. A big part of Roubaix-based OVHs troubles stemmed from the failure of backup power supplies that damaged its own custom-built servers even in areas unaffected by the actual fire.

Look for items in the SLA that address not only the service guarantee but also the eligibility for compensation and level of compensation offered. Offering five-nines availability is great, but the host should also demonstrate a commitment to diverse transit connections; multiple sources of power; redundant networking devices; and multiple, discrete storage assets on the backend.

Holding your cloud host accountable is a solid start, but its important to remember that, as the OVH experience casts in stark relief, enterprise-grade cloud is not some mythical realm of infinite resources and eternal uptime. Moving important digital assets to the cloud means swapping your own infrastructure for that of another, for-profit vendor partner.

The first requirement for cloud migration is to establish a framework for determining the wisdom and efficacy of making such a move to the cloud in the first place. Then there needs to be a comprehensive plan in place to protect everything the organization holds dear.

Inventory all your critical assets, van Wyk suggests. Ask how much it would cost you if any of them were unavailable, for any reason, for an hour, a day, a week. Ask how you would restore your business if everything in your inventory vaporized. What would the downtime be? Can you afford that? What is your Plan B?

The Cloud Security Alliance offers excellent guidance when preparing, analyzing, and justifying cloud projects with an eye toward risk, particularly with its Cloud Controls Matrix (CCM).

If third-party hosting is warranted, it should be guided by formal policy that covers issues such as:

Understand that failures are going to happen. Backup and recovery is so fundamental to the security triad of data confidentiality, integrity, and availability (CIA) that it enjoys its own domain in the NIST Cybersecurity Framework. NISTs CSF encourages organizations to ensure that recovery processes and procedures are executed and maintained to ensure timely restoration of systems or assets affected by cybersecurity incidents.

Theres a lot going on in that sentence, to be sure.

Developing a robust approach to recovery that can satisfy NIST and withstand a catastrophic event like the OVH fire takes more than scheduling some automated backups and hoping for the best.

Van Wyk said its a good idea to take extra precautions with your vital business data and processing and ensure you will actually be able to use your backup plans in different emergency scenarios.

Whether organizations crown jewels live on-premises, in a hybrid environment, or solely in the cloud, a mature and pragmatic BCDR approach should include:

No BCDR plan can ward off all chaos and guarantee perfect protection. But as the OVH incident demonstrates, half-hearted policies and incomplete protocols are about as effective as no plan at all. Establishing a solid BCDR posture requires meaningful investment in resources, time, and capital. The payoff comes when the lights flicker back on and rebooted systems go back online, data intact and none the worse for the experience.

Read more from the original source:
Cloudburst: Hard lessons learned from the OVH datacenter blaze - VentureBeat

Read More..

DUBLIN--(BUSINESS WIRE)--The "Disclosure Management Market - Growth, Trends, COVID-19 Impact, and Forecasts (2021 - 2026)" report has been added to ResearchAndMarkets.com's offering.

The Disclosure Management Market is expected to register a CAGR of 16.32% over the forecast period from 2021 - 2025.

Companies Mentioned

Key Market Trends

Cloud is Expected to Witness Significant Growth

North America is Expected to Hold Major Share

Key Topics Covered:

1 INTRODUCTION

2 RESEARCH METHODOLOGY

3 EXECUTIVE SUMMARY

4 MARKET INSIGHTS

4.1 Market Overview

4.2 Industry Attractiveness - Porter's Five Force Analysis

4.3 Assessment on the impact due to COVID-19

5 MARKET DYNAMICS

5.1 Market Drivers

5.1.1 Increasing complexity in the reporting process characterized by different file formats

5.2 Market Challenges

5.2.1 Multiple constraints related to regulatory disclosure processes

6 MARKET SEGMENTATION

6.1 By Component

6.2 By Deployment Type

6.3 By End-User Industry

6.4 Geography

6.4.1 North America

6.4.2 Europe

6.4.3 Asia Pacific

6.4.4 Rest of the World

7 COMPETITIVE LANDSCAPE

7.1 Company Profiles

8 INVESTMENT ANALYSIS

9 FUTURE OF THE MARKET

For more information about this report visit https://www.researchandmarkets.com/r/1xrbmd

More here:
Worldwide Disclosure Management Industry to 2026 - North America is Expected to Hold a Major Market Share - ResearchAndMarkets.com - Business Wire

Read More..

Beware! SMS for Income Tax Refund with Links is Fraud; Users Are Lured to Fake Sites of I-T Dept, SBI, ICICI Bank, Axis Bank, PNB and HDFC Bank

Suspicious messages asking users to submit a refund application for the disbursement of income tax (I-T) refund have been doing the rounds, with a link that directs users to a webpage looking like the I-T e-filing web page. An investigation by CyberPeace Foundation along with Autobot Infosec Private Ltd reveals that similar looking but fake websites of five banks, State Bank of India (SBI), ICICI Bank, Axis Bank, Punjab National Bank (PNB) and HDFC Bank, are used to collect all personal and financial data. Further, an app gets installed on the user's Android mobile device, which asks for administrator rights and takes full control for duping.

"All internet protocol (IP) addresses associated with the campaign belong to some third party dedicated cloud hosting providers. The whole campaign uses plain http protocol instead of the secure https. This means anyone on the network or internet can intercept the traffic and get the confidential information in plain text to misuse against the victim. It collects unnecessary personal data as well as financial information from the users. It asks users to download an application from a third-party source instead of Playstore. The application asks to provide administrator rights and unnecessary access permissions of the device," the release says.

Here are key findings of the analysis...

(The information mentioned here has been extracted during the investigation, information might be changed after generating the reports.)

On clicking the green 'Proceed to the verification steps' button, users are asked to submit personal information such as Full name, PAN, Aadhar number, Address, Pincode, Date of birth, Mobile number, Email address, Gender, Marital Status and banking information like Account number, IFSC code, Card Number, Expiry date, CVV/CVC and Card PIN. Additionally, the bank name is automatically detected from the IFSC code entered in the form (For the purpose of entering dummy data, the bank name used was State Bank of India)

After submission of data, users are redirected to a page where they are asked to confirm the entered data.

Clicking on the green 'confirm' button directs users to a State Bank of India internet banking login page almost like the official one. It was hosted on the same IP 78.138.107[.]132 which was not linked to the State Bank of India internet banking domain in any way. It asks for the username and password for online banking.

After these details are entered, for the next step, users are asked to enter a Hint question, Answer, Profile password and CIF number. Once submitted, a mobile verification section with instructions provided to download an android application (.apk file) appears, to complete the ITR verification.

Here, in the third point, users are deliberately instructed to grant all device permissions to the particular application.

The application, called Certificate.apk, starts downloading upon clicking the green 'Download' link.

Every time the link http://204.44.124[.]160/ITR is opened, users are redirected to different URLs with the same content and after some time, these respective URLs expire.

The IP addresses are associated with the following countries- The United States of America and France.

As mentioned before, the campaign automatically detected the bank name as State Bank of India from the IFSC code, and thus, redirected to the State Bank of India internet login website.

This was tested and confirmed with four other famous banks- ICICI, HDFC, Axis Bank and Punjab National Bank by tweaking the prefix part of the IFSC code.

Similar types of phishing pages related to the login credential and account details appeared for the respective banks. All the pages collect account related information like username, password, mPIN, security questions etc and after the details are provided, the user is taken to the 'MOBILE VERIFICATION' page mentioned earlier. This happens irrespective of whichever bank the user selects.

Some of the directories have also been found with the names of axis, hdfc, icici, netpnb and sbi.

The online bank phishing pages previously mentioned could be reached by visiting those directories manually.

Source code analysis revealed that the webpage is borrowed from some other source using the iframe tag of HTML. In this case, the contents of the webpage were being fetched from bachir[.]com. Another domain- gardenmeetsgeek[.]com was also found as the iframe source.

The title image of the landing page is "e-filing Home Page, Income Tax Department, Government of India".

The header and the navbar section masquerade as a menu area that contains the links of certain pages via which users can reach the respective pages, but in reality, no links are actually embedded in the background. This can be verified from the source code where the values of href are set to '#' instead of the respective URLs.

After the app- Certificate.apk- is opened, users are asked to enable or activate the application by giving device administrator rights to the app as a necessary step to complete the ITR verification process. This caution message can also be noticed- "Activating this admin app will allow the app certificate to perform the following operations: Erase all data Lock the Screen".

After selecting 'Activate this device admin app', it asks for multiple device permissions such as contact details, phone call details, send and view SMS messages etc.

After the access is granted, a prompt for another permission for changing the default SMS messaging app also appears.

Users are then prompted for a Mobile Verification, and after the number used to register and one of the codes assigned in the Mobile Verification page on the website are entered and verified, a sign in message appears.

On clicking the 'SIGN IN' button, a fake google account login page appears asking users to provide account credentials. The email ID used during the registration on the website is automatically picked up.

There is no background verification method to verify the credentials entered.

After clicking on the 'SIGN IN' option, a 'critical system update' installation with a progress bar and percentage is displayed.

The permissions are used by the app to perform required operations such as getting the SMS details, getting phone call log details and some particularly dangerous permissions such as full_screen_intent, foreground_service, send_sms, package_usage_stats.

The call log information and the SMS of registered number are sent to host fcm[.]point2this[.]com. This means that the host behaves like a Command and Control (CnC) for the application. point2this[.]com is a domain name offered by no-ip dynamic DNS service.

Details regarding the activation status of the application is sent to the server in encoded form, which is not readable by normal users. Decoding the content revealed status details of the device such as timestamp, mobile number and verification code are sent in an encoded form.

After the data is validated, a token, fid, name etc is provided as a response. Noticing the patterns of the parameters, it seems that in the background, a firebase infrastructure was being used.

According to CyberPeace Foundation, all IP addresses associated with the campaign belong to some dedicated cloud hosting providers and the overall layout and functionalities of the web page used in the campaign are similar to the official e-filing site to lure laymen.

It says, The campaign is collecting personal as well as banking information from the user. Getting into this type of trap could cause massive financial loss for the users. In the last step, it asks users to download an application from a third-party source. The application asks to provide administrator rights and unnecessary access permissions of the device. Agreeing to this could be a dangerous decision as it sends sensitive information of the user to a remote destination in the background. The device can be remotely handled by the cybercriminals.

How not to become victim of this fraud...

CyberPeace Foundation recommends that people should avoid opening such messages sent via social platforms. One must always think before clicking on such links or downloading any attachments from unauthorised sources. one of the ways to verify legitimacy is to look at the URL bar and see if the website uses HTTPS.

There may be other indicators like a shabbily made website, improper language unusual information being asked for etc.

Additionally, it is best to open banking or any other financial services website directly by typing in the URL into the address bar or through the legitimate mobile app downloaded from the Playstore.

Especially when asked to share or type in confidential information such as your OTPs, bank account details, and Aadhaar number, users should pay more attention and caution.

Falling for this trap could lead compromising of the whole system (access to microphone, camera, text messages, contacts, pictures, videos, and banking applications) as well as financial loss to the users. Users must always think before clicking on such links, or downloading any attachments from unauthorised sources.

CyberPeace Foundation says, at the central level government should try to look at setting up filters for such messages so that they can be marked spam add the origin. Additionally, it says, platforms that are not end to end encrypted can also monitor traffic for such kind of spam messages.

Hosting service providers should also set up filters for things like frame analysis, by way of which it is also possible to detect similar fishing campaigns using a known modus-operandi, it added.

Read more from the original source:
Beware! SMS for Income Tax Refund with Links is Fraud; Users Are Lured to Fake Sites of IT Dept, SBI, ICICI Bank, Axis Bank, PNB and HDFC Bank -...

Read More..

The next few years could be the best yet for the web hosting industry as an increasing number of businesses go fully digital to survive the post-pandemic world.

A new report from ResearchAndMarkets.com claims the global market for web hosting services may reach $204.6 billion by 2024. While the United States takes top spot, the Asia-Pacific (APAC) region is perceived as the biggest-growing market, with a compound annual growth rate (CAGR) of 17.3% predicted over the next few years.

The developing internet infrastructure, rapid digitalization of the enterprise sector, as well as increasing disposable income are some of the key factors driving this growth, the report stated. It added that the robust growth of e-commerce in APAC, as well as more cloud-based service providers entering the market are also propelling the region forward.

ResearchAndMarkets.com is not the only market research organization expecting the Asia-Pacific regions web hosting industry to keep growing. Fortune Business Insights expects a CAGR of 15.1% between 2018 and 2026, with the market expected to hit $183.18bn by that time.

For ResearchAndMarkets.com, building and maintaining customer relationships is a vital prerequisite for survival in todays environment, and with Covid-19 still lingering, websites are seen as a critical medium to achieve that goal. It helps build and nurture relationships in both business-to-business and business-to-consumer environments, it was said.

Besides customer relationship management, there are numerous other advantages of using a professional web hosting service, such as lower upfront costs that come with licensing website creation software, easy access to backup solutions, antivirus tools and spam filters.

Using professional web hosting services means no backend infrastructure to worry about, and enables a more flexible website design. Storage space is highly scalable, while cloud-based delivery models can also offer dynamic bandwidth benefits, too.

Continued here:
This could be the biggest year yet for web hosting - TechRadar

Read More..