Cloud Hosting

BROWNSVILLE, Texas A 34-year-old resident of Ciudad Victoria, Tamaulipas, Mexico, has been sentenced for possessing child pornography found on his cell phone as he tried to enter the country, announced U.S. Attorney Alamdar S. Hamdani.

Juan Jesus Banda-Olivo pleaded guilty Jan. 25.

U.S. District Judge Rolando Olvera has now ordered Banda-Olivo

to serve 97 months in federal prison. Garza was further ordered to pay $3,000 in restitution to a known victim and will serve eight years on supervised release following completion of his prison term. During that time, he will have to comply with numerous requirements designed to restrict his access to children and the internet. He will also be ordered to register as a sex offender.

On Aug. 15, 2022, Banda-Olivo attempted to make entry into the United States through the Veterans Port of Entry. Authorities believed he was in the country illegally and sent him to secondary inspection.

There, law enforcement conducted a consensual search of Banda-Olivos cell phone and discovered multiple photographs and videos of child pornography. The investigation revealed Banda-Olivo possessed 1,223 unique images and videos of child pornography on his cell phone and his cloud storage account. Some of the images included images of the sexual abuse of toddlers and prepubescent minors. The images found on the seized cell phone were submitted to the National Center for Missing and Exploited Children for victim identification.

Banda-Olivo has been and will remain in custody pending transfer to a U.S. Bureau of Prisons facility to be determined in the near future.

Homeland Security Investigations conducted the investigation.

Assistant U.S. Attorney Ana C. Cano prosecuted the case, which was brought as part of Project Safe Childhood (PSC), a nationwide initiative the Department of Justice (DOJ) launched in May 2006 to combat the growing epidemic of child sexual exploitation and abuse. U.S. Attorneys' Offices and the Criminal Division's Child Exploitation and Obscenity Section leads PSC, which marshals federal, state and local resources to locate, apprehend and prosecute individuals who sexually exploit children and identifies and rescues victims. For more information about PSC, please visit DOJs PSC page. For more information about internet safety education, please visit the resources link on that page.

See the original post here:
Southern District of Texas | Mexican national sentenced for ... - Department of Justice

After companies move to the cloud, many are under the impression that their cloud hosting providers are solely responsible for security, a misconception that can lead to data breaches and other security issues.

While the responsibility for securing cloud infrastructure falls to cloud services providers, it's up to customers to configure the cloud and secure their applications and sensitive corporate data.

Thats where cloud security posture management (CSPM) tools can help. These tools continuously and automatically check for misconfigurations that can result in data leaks and data breaches. CSPM tools manage cloud security risks on an ongoing basis and ensure compliance in the cloud so enterprises can continuously make any necessary changes.

"CSPM solutions use best practices and compliance (PCI, SOC2, etc.) templates to identify drifts and insecure configurations in cloud infrastructure (AWS, Azure, Google Cloud Platform) in the compute, storage, and network areas," says Andras Cser, vice president and principal analyst at Forrester Research. "CSPM tools can alert and optionally remediate the insecure configurations.

CSPM tools look at workloads to see whats happening and they provide context, so organizations know which of the vulnerabilities or issues is most important, says Charlie Winckless, senior director analyst at Gartner. These tools enable companies to prioritize which risks are real, which risks are important, and which risks they may be able to delay fixing a little bit, he says.

Organizations evaluating various CSPM tools should ensure that they cover all the cloud platforms theyre using, says Winckless.

"You want to be able to normalize the configuration risks across the major cloud platforms," he says. "Most organizations that are purchasing these tools will probably be multicloud. Theyll be using at least two clouds, maybe more, since the cloud providers themselves do offer some of this functionality built into their platforms."

Philip Bues, cloud security research manager at IDC, says the new reality for most organizations is a hybrid multicloud environment, "so you want something thats going to be able to give you really deep visibility throughout all the environments and workloads that you have. And that's what the CSPM solution should be able to provide you."

Other features organizations should look for in CSPM tools include:

Comprehensive threat detection: Because threats in multicloud environments are complex, these tools must gather threat intelligence from a number of sources to give companies clear views of their risks.

Integrated data security: Keeping data safe in the cloud requires a multipronged defense that gives companies deep visibility into the state of their data. This includes enabling organizations to monitor how each storage bucket is configured across all their storage services to ensure their data isnt inadvertently exposed to unauthorized applications or users.

Automated alert remediation: Organizations must ensure that the CSPM tools they select can automate routine security monitoring, audits, and remediations across their cloud environments. This allows security teams to prioritize and remediate the risks that can potentially cause the most damage.

CSPM tools offer a number of benefits that help companies boost security, minimize their risk exposure in cloud environments, and reduce costs. These benefits include:

There are some pitfalls that companies need to be aware of when it comes to CSPM tools, including:

Not understanding the requirements of CSPM tools: This is one of the biggest mistakes that organizations can make when theyre shifting workloads to the cloud because things that werent connected before are now interconnected, says Bues. The best way to implement CSPM tools is to ensure teams receive the proper training and proper awareness for how this solution is supposed to work within the environment. "You dont want to have the security team with little or no cloud experience or developers with limited security experience trying to manage this new CSPM solution," he says. "You should have the developers and the security team working together because everyone has different needs."

Not opting for a multicloud CSPM tool: Another mistake companies make is selecting tools that offer a one-size-fits-all approach offered by public cloud vendors that dont offer a unified view across all their cloud environments. Organizations should opt for CSPM tools that provide multicloud monitoring and protection.

Thinking theyre too small/not mature enough: A company that assumes its too small or not mature enough to consider security will always put the business at risk as it typically only thinks about security after an issue or breach occurs. However, companies of all sizes should ensure they protect their assets across teams by implementing CSPM tools.

There are numerous CSPM tools on the market, so to help you begin your research, we've highlighted the following products based on discussions with analysts and independent research.

Aqua Security Real-Time CSPM: Connects organizations cloud accounts so they can identify all their cloud resources running in Amazon Web Services (AWS), Alibaba Cloud, Google Cloud Platform (GCP), Microsoft Intune, and Oracle Cloud. Provides a comprehensive view of organizations' real-time cloud security risks, identifying the most critical problems so they can focus on fixing high-priority issues. Uses agentless workload scanning to scan workloads and assess companies basic risk postures. Detects cloud risks and catches threats that evade agentless detection, including fileless malware, memory-based attacks, and unknown exploit attempts, such as zero days. Provides context-based insights and recommends remediation actions. Prioritizes the most important security issues. Connects issues detected in the cloud back to development.

Check Point CloudGuard for Cloud Security Posture Management: Automates security, compliance, and governance across multicloud environments and services. Detects misconfigurations, visualizes and assesses companies security postures, and enforces compliance frameworks and security best practices. Companies can manage the security and compliance of their public cloud environments across Azure, AWS, GCP, Alibaba Cloud, and Kubernetes. CloudGuards network and asset visualization enables companies to detect any compromised workloads, vulnerabilities, misconfigurations, or open ports in real-time. Offers threat intelligence support as a free add-on to CSPM customers. This feature offers insights into account activity through threat research and machine learning.

CrowdStrike Falcon Cloud Security: Provides threat detection, prevention, and remediation and enforces compliance and security posture and compliance across AWS, Azure, and GCP. Provides CSPM features for hybrid and multicloud environments. Enables companies to continuously monitor the compliance posture of all their cloud resources from a single console and dashboard for numerous regulations, including the Payment Card Industry Data Security Standard (PCI-DSS), National Institute of Standards and Technology (NIST), SOC2, and more. Lets companies compare cloud application configurations to organizational and industry benchmarks so they can detect violations and remediate them in real time to ensure their applications are always available.

Palo Alto Networks Prisma Cloud: Safeguards resources across multicloud and hybrid environments. Its features work on AWS, Azure, Alibaba Cloud, Oracle Cloud, and GCP public cloud environments. Provides users with total visibility into their cloud environments, automated responses, and continuous threat detection. Analyzes, normalizes disparate data sources to offer enterprises clarity into risk management. Provides historical and real-time visibility across assets and configurations. Offers companies step-by-step remediation instructions for compliance violations and misconfigurations. Collects audit event logs allowing security administrations to see configuration changes and identify when they occurred.

Tenable Cloud Security: Provides a complete inventory of assets across Azure, GCP, and AWS. Automatically detects and maps organizations cloud environments, including workloads, infrastructures, data, and identities. Enables companies to view infrastructure thats configured incorrectly, as well as associated risks, vulnerabilities, excessive permissions, and network configurations that can expose corporate resources. Allows organizations to automatically remediate misconfigurations, risky privileges, and policy violations. Companies can audit multicloud environments against industry standards, including AWS Well-Architected framework, NIST, PCI-DSS, SOC2, and Center for Internet Security benchmarks for Kubernetes and more. Companies can create their own custom checks.

Here is the original post:
How to choose the best cloud security posture management tools - CSO Online

With National European Cyber Security Month shining a spotlight on some of the UK's leading tech companies in the cyber sector, SoGlos showcases 26 of the Gloucestershire businesseshelping to make the county the UK's cyber capital.

From homegrown tech start-ups to multinational organisations drawn to the county by its strong reputation, we reveal some of the best in the industry...

SGGBA winner for Cyber Business of the Yearand Gloucester tech giant Salus Cyberis a certified provider of world-class cybersecurity services. It helps clients identify and manage their cyber risks proactively and effectively and is the cyber security partner of choice for industry-leading organisations throughout the UK and Europe. Based at Eagle Tower in Cheltenham.

This Cheltenham-headquartered firm based in Eagle Tower describes itself as countering global money laundering, terrorism, and criminal networks. Founded by former members of GCHQ,Ripjardevelops software that combines automation, data visualisation and the ever-expanding features of AI to tackle complex threats to our digital society.

An official Gloucestershire B Corp, Optimising IT provides a range of services from cyber security improvement to complete outsourced IT department services, for organisations that need help managing their IT or require consultancy about changes such as mergers or acquisitions. Based at Twigworth Court Business Centre in Gloucester.

North Green Security is a UK-based cyber security training and consultancy company, with offices in Eagle Tower in Cheltenham. Its aim is to assist in providing a more secure future by ensuring more people at all levels of learning can contribute to an ever-growing and evolving industry, with companies benefitting from strategic assessments conducted by its knowledgeable consultants.

Based in Quedgeley and working with a range of organisations from SMEs to government bodies, Infrastaris a specialist computer networking andinfrastructure company. Its expertise lies in assisting organisations insecuring the IT hardware and solutions they require to operate at optimumefficiency,' from assessing current network environments to the full-scalenetwork design and implementation.

SGGBA Team of the Year 2023 winners,Bamboo Technology, worksto improve other businesses through its extensive IT and telecommunicationsexpertise and it designs and delivers digitally assured solutions for thehybrid workforce. Its headquarters are at Gloucestershire Colleges Cheltenhamcampus.

Based out of Gloucestershire's Hub8, Berta Pappenheimfounded CyberFish in 2018 to build organisational resilience in a way that issustainable, focusing on the psychology of a team so it becomes self-improvingand never goes out of date a few updates later. CyberFish works withmission-critical departments in governments, law enforcement and globalorganisations.

Amiosec specialises in the design and development of securesolutions for government and commercial organisations. The Tewkesbury-based business providesa range of next generation advanced mobile and remote access solutions thatprovide secure mobile communications across public networks. Its products aresimple to configure, easy to use.

Tewkesbury-based business Synalogik describes itself as a team ofopen-source intelligence, data processing and automation experts from across the intelligence, law enforcement and investigation industries. Its vision is to revolutionise the automation of targeted data collection and analysis, allowing organisations to make 'smarter decisions.' The team also won a prestigious Queen's Award for Innovation in 2022.

With thousands of courses spanning health and safety to data protection,Nimble Elearningscloud-based elearning platform is well-used by individuals and businesses alike. Its intuitive tools have also helped clients create thousandsmore courses too. In short, the Stonehouse firm is enabling a revolution UK-wide in thedelivery of effective, affordable, dynamic online training.

Founded byGloucestershire-based Chris Dunning-Walton, this boutique cyber andtechnology recruitment consultancy prides itself on its ability to inspire talented people to find careers that inspire them. Working exclusively within the IT sector, with specialism areas in cyber security, software development and engineering, the award-winning Infosec is based in the Eagle Tower in Cheltenham, with offices in Bristol, too. Dunning-Walton is also a key member of Gloucestershire-basedcyber networking and support group CyNam.

Founded in 2016, Savient is a bespoke software consultancy firm based in Hub8 in the Brewery Quarter in Cheltenham that uses software technology solutions and services to help customers solve business problems and unlock the value in their data. It says its mission is to find and deliver solutionsusing software technology, so your business can work faster and moreefficiently, while meeting emerging opportunities', adding 'we work closely with youapplying our creative, intuitive and adaptive thinking to deliver technologythat works the way your business thinks.

If you want a simple to understand, but sophisticatedsolution to your businesss cyber security concerns, Cheltenham-basedReformIT iscapturing a growing market of firms from all sectors looking to put their IT inthe hands of a business which can manage all its software, hardware, updates,cyber attacks and even training all under one roof.

P3M Works delivers cyber security and digital transformation projects across both private and public sector clients. Its collaboration ofpermanent, technical delivery staff and cyber SMEsare based at Cheltenham's home of private sector cyber, Hub8, in the Brewery Quarter.

Blacksmiths Group is a team of human, digital and physical security specialists who will develop your businesss capability to tackle security challenges and defend against complex threats. The Cheltenham firm provides consultancy and develops technologies to solve problems. Its teams are highly experienced technical and security experts with skills acquired in UK government and the tech industry.

North Tower Consulting is a software solutions consultancy based in Cheltenham, providing professional expertise in cyber security, cloud computing and much more. Set up in 2019 by its founding business partner, the business has gone from strength to strength, with major government contract wins and now a team of more than 50 people onboard.

Another Cheltenham-based company, Gemba Advantage, which was co-founded by Shelley Wood, is a tech development firm that builds high-impact software for businesses.Itspartners include the UK government and the National Crime Agency.Its teamcan build and maintain high quality software to help your business make the mostof its technological investments.

Founded in 2020 byRobert Diamond, Craig Morgan and Craig Stocks who bring years of experienceworking within the cyber security, defence and IT sectors, Cheltenham-based, HamiltonianDynamics provides 'high performance, big impact mission critical software', anddoes so for multiple government departments, as well as being a design anddevelopment consultancy agency.

This Cheltenham-basedfirm was started by a husband-and-wife team in 2016 and has operated primarily in the defence sector for the past few years. Fat Potato worked across multiple major projects deliveringsoftware solutions in challenging and demanding environments and has provenexpertise in a wide array of technical specialisms. It works with businesses totransform their applications and enhance performance.

Established in 2013,Cyber Security Associates (CSA) provides cyber consultancy and cyber managedservices which help to detect, protect and educate against the ever-changing threat of cyber attacks. It has built a team from government (ex-military) andcommercially experienced specialists all holding current and relevant cybercertifications. Today, its core services are based around a 24/7 securityoperations centre in Gloucester.

This Cirencester firm is dedicated to assisting organisations to adopt cloud services andtechnologies securely, whilst understanding the continued challenges of acomplex hybrid environment. Somerford Associates will work as your trusted partner and as part of yourteam to deliver success. Its aim is to meet customers needs with afocus on service quality and delivery for on-premises, hybrid or full cloudenvironments.

CoreTech is a niche cyber security company whose people aremotivated by the desire to deliver exceptional capabilities coupled with a realsense of mission. Its Cheltenham-based team is highly experienced, deeply technical,and blend vulnerability research, research engineering and software developmentskills.

Cirencester-based Core to Cloud is an SGGBA 2022 award winner and its founder, James Cunningham,was named in The Times LDC Top 50 Most Ambitious Business Leaders list in the same year. Describing itself as your 'cyber security sidekick', its services include cyber security gap analysis, MDR, crisis simulating and dark web monitoring.

Started and run by engineers from the UK intelligence anddefence communities, and headquartered in Cheltenham's Eagle Tower, Red Maple Technologies is a technicalconsultancy and product company. Founded to help organisations of all sizesprotect themselves from cybersecurity threats, it solves technical and security problems with technical solutions.

Another resident of Gloucestershires home of private sector cyber, Hub8 but in its Gloucestershire College campus workspace Indeloy specialises in helpingcustomers find the right IT solution for their needs. It can source a widevariety of products and provide services such as hardware disposal, softwareerasure, licence management and more.

Headquartered in New York but with a UK base in the Brewery Quarter's cyber hot spot, Hub8, Cylera is pioneering IoT (Internet of Things) security and intelligence to protect what matters most people, safety, privacy and business continuity. Specialising in support for the healthcare sector, it delivers acyber security platform that discovers devices, analyses network traffic andrisk, detects vulnerabilities, continuously identifies threats or maliciousdevices and helps reduce attacks.

Link:
26 Gloucestershire tech companies leading the UK's cyber sector - SoGlos

The recent announcement of a new, independent cloud for Europe by Amazon Web Services (AWS) has underlined the growing divergence between the positions of Paris and Berlin regarding digital sovereignty in the cloud sector.

The move by AWS last week came as part of an overall trend whereby American hyperscalers a term used to describe cloud service providers with massive operations seek to address the concerns of EU countries looking to keep their data within Europes borders.

Past examples include leading market players like Microsoft, which announced its Microsoft Cloud for Sovereignty offer in July 2022, and Oracle, which launched its EU Sovereign Cloud offer last June.

What worries me the most is that the German Federal Office for Information Security (BSI) has endorsed the AWS European Sovereign Cloud, French centrist MP Philippe Latombe told Euractiv, explaining he fears that the Germans start exerting pressure against Frances highest cloud security certification, called SecNumCloud.

AWS was in fact the first cloud service provider to receive the BSIs C5 testate,a German cloud security certification, based on the same international standard as SecNumCloud.

BSIs Director General Claudia Plattner said in a statement that she was very pleased to constructively accompany the local development of an AWS cloud, which will also contribute to European sovereignty in terms of security.

According to Arnaud David, Director of European Affairs at AWS, the company has put in place technical building blocks, including safeguards, controls and security features that allow customers to enforce access restrictions so that nobody, including from AWS, can access customer data.

He further explained that AWS cannot access customer data unless the access is given by its customers and that AWS provides its customers with encryption tools. Moreover, only EU-resident AWS employees located in the EU will control operations of the AWS European sovereign cloud.

A comprehensive bill aiming to secure and regulate the internet in France aims to strictly respect the new digital European regulations and, when it comes to cloud regulation, will go even further.

For MP Latombe, AWS cloud cannot be sovereign because it is subject to the US FISA and Cloud Act, legislations mandating US companies, US citizens or foreign subsidiaries on US soil to cooperate with the US security agencies.

According to AWSs David, if AWS is requested to send data to US administrations under the FISA, Amazon will challenge every request it deems inappropriate, especially if it is contrary to local law, like the EUs General Data Protection Regulation (GDPR) in the EU.

Of course, every company affirms it would not disclose sensitive information, at least until they are caught in the crossfire of conflicting jurisdictions.

We are a global company subject to laws in every country where we operate, including US law, David said, adding that this was also the case for EU companies with subsidiaries in the US.

Latombe disagrees, arguing that European cloud providers with operations in the United States are subject to US laws only through their US-based subsidiaries, which is not the case with AWS, a US-based company that must comply with US agencies globally.

Jean-Sbastien Mariez, founding partner of the French tech law firm Momentum Avocats, noted that since the Cloud Act, the location of data is irrelevant in the applicability of US laws.

Moreover, while Amazon advertises that only EU-resident AWS employees located in the EU will access data, a 2022 memo by the Dutch National Cyber Security Center states that this does not necessarily mean protection from FISA and Cloud Act laws.

Traditionally, Paris could count on Berlins support to push digital sovereignty principles that favour their national champions over foreign providers. In contrast, smaller member states prefer to buy the best available technology regardless of its provenance.

But a Franco-German divergence on the concept of the sovereign cloud has been long in the making. Different understandings of what digital sovereignty meant for cloud infrastructure are what made the Gaia-X European digital sovereignty project lose its political momentum.

Tensions came to a head with the European Cloud Services scheme (EUCS), a cybersecurity certification scheme where France, via its Commissioner Thierry Breton, tried to replicate the sovereignty requirements of SecNumCloud at the EU level.

This attempt faced significant resistance from more liberal countries, led by the Netherlands. With the liberal Free Democratic Party occupying critical ministries in the current coalition government in Berlin, France not only did not receive support from Germany but was at times more or less openly criticised.

In this context, Latombe fears that Germans are taking a pro-US and anti-French position and, therefore, would be exchanging their industrial dependency on Russian gas for a dependency on American digital companies.

That is why he considers that giving the C5 certification to the AWS European Sovereign cloud was a nook in [the French certification] SecNumCloud since the French ANSSI and German BSI authorities have a mutual recognition agreement for security certificates, albeit only for the first security level at the moment.

A BSI spokesperson told Euractiv there was no specific connection between the AWS announcement and the currently discussed EUCS. Meanwhile, the German Digital Ministry said to Euractiv that it was committed to ensuring that the [German] economy can access secure and powerful cloud structures to the extent required.

The French ANSSI and the Digital Ministry declined Euractivs requests for comment.Latombe advertised on Monday (30 October) that he sent a written question to French Digital Minister Jean-Nol Barrot on the matter.

[Edited by Luca Bertuzzi/Nathalie Weatherald]

Read the original here:
France and Germany increasingly drift apart on digital sovereignty of ... - EURACTIV