Layered Tech Official Blog

Blog Series: Reducing Risk with PCI-Compliant and Secure Community Clouds, Part II

By Jeff Reich, Chief Risk Officer, Layered Tech

In the first installment of this series, we looked at the magnitude in which companies are experiencing security data breaches and how PCI compliance can help businesses overcome these issues.  In this installment, we’ll examine how community clouds are emerging as an alternative environment for companies looking to achieve PCI compliance and robust security while also reaping benefits including reduced overhead.

The 1, 2, 3’s of securing data and achieving PCI compliance

Many technology security experts agree that securing company and customer data involves three steps:  1) identifying which data is critical and therefore needs to remain secure; 2) implementing the controls needed to protect that data; and 3) validating those controls.  As simple as this may seem, one misstep can result in not achieving PCI compliance, opening the door for highly damaging data breaches to occur.  For example, Verizon stated in its 2011 Data Breach Investigations Report that of the 761 data breaches it examined, more than 95 percent could have been avoided through simple controls.

By contracting with a PCI-compliant managed services provider, companies are able to put their security concerns in the hands of experts who stay up-to-date on security requirements and ensure that PCI compliance is maintained.  Managed hosting providers like Layered Tech make certain that regular monitoring occurs, audits run smoothly and all data is as safe as possible, allowing companies to focus resources on their businesses and customers.

Community clouds as an alternative

Community clouds are becoming a popular hosting environment option because they offer many advantages, including lower costs and more flexibility.  By utilizing community clouds, companies avoid expensive upfront hardware costs and don’t have to worry about the additional expenditures associated with hardware updates and maintenance.  In addition, companies with fluctuating data requirements can easily increase or decrease the services they receive and only pay for services used at any given time.

Community clouds also provide companies with “hidden” benefits.  For instance, if a cloud provider notices targeted malicious activity against one company, it can take actions to prevent the attack or similar attacks from affecting other companies.  Experienced cloud providers will place businesses with similar security needs and services on the same server to use the same pool of resources.

A hosting provider’s experience and expertise in the community cloud should be an important factor when selecting a vendor. Layered Tech pioneered virtualized and PCI-compliant environments and has years of accumulated experience in designing, implementing and hosting in the cloud. To learn more about Layered Tech’s services, check out the compliant hosting and cloud hosting information on our website or send us an email.

In the final installment of this blog series, we will explore security in the community cloud and explain the importance of security and how PCI compliance doesn’t necessarily ensure that data is secure.

Image credit: Kirsty Hall

Blog Series: Reducing Risk with PCI-Compliant and Secure Community Clouds

By Jeff Reich, Chief Risk Officer, Layered Tech

It seems almost daily a new report emerges detailing how a company suffered a data security breach, resulting in the release of sensitive data for hundreds of people.  To help guard against these attacks, companies can become PCI compliant, but it is not an easy goal to achieve and does not guarantee complete and total security.  As an alternative, community clouds provided through third-party resources like Layered Tech offer security options and a path to compliance without the cost and labor issues present with in-house systems.

To better understand these issues, this blog series will explore the hazards data breaches present and how, even with its challenges, PCI compliance and added security can help protect companies.  Additionally, the series will discuss how leveraging a community cloud provides companies with added benefits, such as scalable infrastructure, flexibility and availability, all in a cost-effective manner.

The real risk hackers pose

In today’s business environment, data breaches are no longer disasters that happen to other companies, nor are they an issue that only plagues large enterprises.  These adverse events can affect small- and medium-sized businesses that have made the leap to computerized systems and digital records.

Hackers are becoming more sophisticated and are able to employ several different tactics to retrieve information, such as exploiting backdoors and using spyware, forcing companies to focus on every aspect of security.  Instead of just looking for credit card and social security numbers or personal data, such as birthdates, hackers are increasingly stealing online banking login details.  According to Verizon’s 2011 Data Breach Investigations Report, the U.S. Secret Service arrested more than 1,200 cybercrime suspects in 2010 that were connected to more than $500 million in fraud loss.

PCI compliance helps but includes challenges

All companies that accept credit card payments, either online or offline, are required to takes steps to secure customer information.  One way companies can accomplish this task is to become PCI compliant, meaning that the organization meets certain criteria throughout the security process, including prevention, detection and response, as set forth by the PCI Data Security Standard (PCI DSS).  These standards, developed by the Payment Card Industry Security Standards Council, provide a range of requirements based on a company’s size, its type of business and the number of credit card transactions it handles.  (Want to know more about PCI DSS?  See the helpful PCI DSS resources available on our website.)

The strictness of these requirements, however, can make it difficult for businesses to achieve compliance.  Verizon’s Payment Card Industry Compliance Report for 2011 states that only 21 percent of the companies assessed were considered fully compliant.  Additionally, even though PCI-compliant companies are safer and less likely to encounter a breach, PCI compliance does not guarantee complete security of data.  Additional security measures, including but not limited to patching and system interfaces, must be taken.

Many companies leverage PCI compliant hosting and managed services from providers like Layered Tech to take advantage of its security, compliance and cloud expertise.  With this approach, organizations gain all the benefits of a hosted IT infrastructure but without the headaches of owning and maintaining hardware.  In addition, you can dedicate your resources to what matters most: your business and your customers.  To learn more about Layered Tech’s services, please visit our website or send us an email.

In the second installment of this blog series, we will discuss PCI compliance and security in community clouds and how this environment can provide businesses with unprecedented processing power, bandwidth and storage capacity, without the burdens of capital expenses and IT staff overhead.

Image credit: Mikael Altemark

Brad Hokamp Interview with Light Reading

We were recently approached by Light Reading, one of the most widely read IT publications in the industry, to do an interview on Layered Tech’s approach to cloud computing services.  Naturally, we obliged, and our president, Brad Hokamp, sat down with Light Reading’s editor, Phil Harvey, to discuss the results our clients are achieving with our managed compliant cloud solutions:

• Control costs more effectively – with a cloud environment, customers can build/repurpose infrastructure towards normal loads of traffic and then use cloud for peak capacity management
• Drive revenue growth and increase agility as a company – allows companies to bring on their customers more rapidly, load applications quicker, etc.
• Innovate and launch products much faster – leading to faster return on investments

Security and compliance concerns have often prohibited businesses from migrating to the cloud, but a private cloud or even hybrid/community cloud architecture of the kind that Layered Tech regularly deploys for its clients has demonstrated time and again that data and transactions can be so secure as to meet even PCI DSS strict requirements.

The full interview is available as an audio podcast at LightReading.com and as a slide presentation summary on SlideShare.net.

CA Announces AppLogic 3.0

This week CA Technologies announced Applogic 3.0. This comes after VMware announced vCloud Director 1.5 and Citrix acquired Cloud.com. This was an exciting month of events for the leading Cloud OS platforms. This is interesting to Layered Tech and our customers because this illustrates the rapid maturing of cloud platform technologies. It exemplifies that these technologies initially targeted to service providers like Layered Tech are also adopting many of the capabilities enterprises are looking for to build out private, hybrid and secure multi-tenant cloud environments.

Today, Layered Tech utilizes both CA Technologies AppLogic and VMware vSphere to provide unique multitenant and private cloud services to our customers. We have long standing relationships with both companies and are one of the original adopters of 3Tera AppLogic before server virtualization, orchestration and automation was called Cloud.  As one of the early adopters of the AppLogic 1.0 platform, we have a unique insight and relationship with CA Technologies. I would like to share a few thoughts regarding the latest release.

The CA AppLogic 3.0 cloud computing platform continues its focus to innovate on the application deployment layer with its intuitive drag and drop application deployment interface. The visual interface, which is the hallmark of AppLogic, continues to differentiate this platform from the others. AppLogic enables complete deployment of entire application environments including virtual load balancers, firewalls, web servers, application server and databases in a single motion.

Among significant new enhancements, AppLogic has added the capability to support:

1)      vLAN tagging to further enable private networking and VPN;

2)      Role-based user access to further separate observers, operators, admins and owners access levels and to improve security;

3)      Support of OVF (Open Virtualization Format) standard to facilitate the import of Xen and VMware workloads from outside the Cloud;

4)      Enhanced cloud operation with the global fabric controller to further automate the maintenance and addition of resources and the enrichment of usage metering capabilities

These are interesting enhancements, and enable a broader set of use cases for our customers with privacy requirement and who want to migrate VMware and Xen environments to the cloud.

Our broad portfolio of managed hosting services includes on-demand multi-tenant cloud services, dedicated virtual and physical environment, and compliance services. With the AppLogic platform we offer Virtual Private Servers (VPS) which is a multi-tenant public cloud with on-demand user portal, and Virtual Private Data Centers (VPDC), which are dedicated cloud environments and give you complete customization and admin access.  In addition, we offer additional cloud services to meet enterprise high availability and compliance challenges.

Layered Tech applauds the advancements by CA Technologies, VMware and Citrix and we remain dedicate to offering the latest best of breed technologies with excellent service and support.

Bye for now.

Kevin Van Mondfrans

Sr. Director Cloud Services, Layered Tech

Cloudbook Profiles JDA and Layered Tech