•
At 1:00 a.m. on Sunday morning I was doing routine maintenance on my personal Amazon Web Services account and instead found myself looking at something I had no right to be seeing: A database with 800,000 user accounts to the e-card site CardMaster.com . Along with that were the database passwords and back end of a major U.S. Public Broadcasting Service news show website ( Gwen Ifill's Washington Week ), including daily updates from panelists on the stories they cover. I wish I wasn't the person to find this. I founded one of Amazon's earliest dashboards. My consultancy is on Amazon's European Customer Advisory Board. But this highlights a significant issue in the cloud today: There is a whole new user profile acting as developer and administrator. We are becoming empowered with amazing tools - and being given enough rope to really hang ourselves. Sponsor Guest author Jonathan Siegel is a serial entrepreneur and founder of the cloud applications consultancy ELCTech.com as well as a handful of cloud startups. Jonathan's book, Electric Connections , is due out in June of this year. I am an early adopter, business builder and owner of a cloud consultancy. On Sunday morning I went to clear out my personal Amazon Web Services account of excess files after seeing huge usage numbers from a report by CloudSplit. For those technically inclined, I was clearing out my S3 buckets and moving the few files that I wanted to save into an EBS disk instead. My EBS disk ran out of space and I went to use a feature called EBS Snapshots. Snapshots are like a tape backup of your EBS disk drive. That's when I noticed something odd: My EBS Snapshot account was filled with hundreds of snapshots, when I knew I had only made a handful. I wondered, Why do I have access to these backups? Were these backups made by my teammates? Shared snapshots from Amazon? Or something else... What I saw were backups of Enron emails, a genomics database and then two made my stomach turn - a database for 800,000 user accounts to CardMaster.com and the database and site files for the Washington Week website. Yeah, the Enron emails are a non sequitur and the genomics database was likely meant to be public. But the other two, there's no way they were intended for the public, yet here they were - marked as public and available to me or any other Amazon cloud user. How Did This Happen? Amazon is the largest and longest running public cloud computing platform. It has pushed the boundaries of technology infrastructure for us users. In fact, it has given us tools that are more powerful than anything we previously had available in our own small datacenters. This is great, because before we needed to hire trained Cisco or NetApp administrators in order to do basic tasks as our websites scaled. This was expensive and added another step - a delay - to our deployments. Amazon's infrastructure commoditizes much of this technology into simple Web calls; paste some XML to Amazon and your website gets a full incremental backup to live-networked NAS. But as Stan Lee has warned us: With great power comes great responsibility. By giving programmers control of the network and storage, we've empowered developers to take on system administration chores. This power has come too quickly or is being digested too lightly - as my discovery has shown. In the case of PBS's Washington Week there was quick acceptance of the issue. "It was human error and nothing personal was exposed," said Kevin Dando, PBS's Director of Digital Communications. "Although we weren't aware of the issue initially, it was easily corrected. Because of Amazon's strong audit capabilities we could pinpoint the error and fix it quickly." Despite numerous attempts we were unable to reach CardMaster.com. This highlights a deeper issue in the cloud today: Despite what you may think, cloud security is not sexy. We are seeing products that address the baseline needs of cloud functionality, like Amazon's dashboard and the support sites for the cloud. They focus on the sexy: deploying mobile apps, auto-scaling, grid processing and other buzz-word-friendly features. But the dirty truth is that the cloud has a whole new user profile acting as administrator and needs a new set of tools and expectation management to ensure that little mistakes make little problems and not big ones. Remember: This is not something that Amazon did wrong. This is an intentional switch thrown by Amazon's users that allowed their data to be public to any other Amazon user. The users did not mean to hit that switch and it's unclear whether those users would have found this issue without my notification. This is the switch in Amazon's Web Console. It can be more subtle when packaged deep within cloud-assisting tools: And Why Me? A spokesperson for Amazon pointed out that snapshots were private by default and users must choose to share them. According to Amazon, "users understand this feature very well as this is no different than users explicitly choosing to share their data by any means." However, as we've seen, users are obviously making their data inadvertently public. Amazon said they were updating their documentation "to provide more explicit guidance on this feature," and that they would be "reaching out to the few who may be unknowingly sharing their snapshots." The question, though, is: Is it too easy to accidentally make your data public - and whose role is it to play data cop? This leads to me, at 1 a.m., and finding security leakage with Amazon's cloud customers while doing unrelated housekeeping. Look, I'm anything but an IT Security guy; I've got enough on my plate to worry about. For god's sakes, I have 6 kids! Moreover, I'm an outspoken supporter for moving companies to the cloud - and I exclusively recommend Amazon's cloud because of its reliability and features. Why is it me that finds this security issue - one that has been open since January of this year if the Snapshot dates are accurate. This tells me that there is a pattern about to be replayed: That the users on the cloud today are a motley crew. That we need more supervision and hand-holding - whether we like it or not. That powerful services like CloudKick and CloudSplit need to be encouraged to add security as a top-priority feature. And we need to budget for their services and embrace their boring, yet hyper-important role as perimeter guard and security inspector. If I were to try to keep this security problem in the bag - and avoid alerting the community - I would be fostering a sense of complacency that is antithetical to the marketplace needs. The cloud is so young that when we find a problem we need to admit it and find real, workable solutions. Since the cloud represents new ways of doing things, it gives us new ways of getting in trouble, and we need a lively forum for nipping these issues in the bud and laying a framework for ongoing success. What Now? If you are on Amazon's cloud, I can't stress enough that you need to immediately go to your AWS Management Console. Check at a minimum that your Snapshots, for every Region, are marked PUBLIC only if you mean them to be available to ALL other Amazon Web Services users. I've already checked mine. If you find data that you did not intend to make public, you need to engage your security team to remove the snapshots from the public and mitigate any data exposure. Hopefully this gets chalked on the wall as a lesson learned - and we continue our march to the cloud with a deeper appreciation of our security support needs. This isn't about calling people out. I work in the cloud and am passionate about its development. These mistakes could very well have been ones I made - or any other cloud user. To move the cloud forward we need to encourage a dialog about our new found power, new paradigms and new needs in the cloud. Discuss
Read the original here:
User Ignorance Causes Cloud Security Leak; Accounts, Passwords Revealed
Tags:
amazon web,
Cisco,
cloud,
data,
database,
digital,
director,
european,
Jonathan Siegel,
network,
person,
personal,
public broadcasting service,
security,
snapshots,
technology
•
If you believe in matches made in heaven then you will understand why the new partnership between Quova and SimpleGeo is just that. Developers can now harness the power of Quova's complex IP geolocation technology within SimpleGeo's framework for creating location apps. Quova announced the partnership today at Where 2.0 in San Jose, and said it will broaden its customer base and provide new contexts for its data. In return, SimpleGeo wins by giving developers a more complete solution for geolocation. Sponsor Quova specializes in IP Geolocation - a process that uses the IP address of a person's computer or mobile phone gateway to determine that person's location. The results are less specific than those provided by a GPS-enabled smartphone or WiFi, but is often the best available location data for many users. The data can be used to target content by region, or localize online searches. Quova has historically focused on the enterprise market, which is highly sophisticated and able to consume raw IP location data. SimpleGeo is a cloud-based geodata company that has been building its geolocation services since May 2009. The company, founded by Joe Stump and Matt Galligan , is unique in its focus on location-based services. It announced the availability of a data storage service, an iTunes-like data marketplace, and an API to developers today at Where 2.0. These offerings are described by SimpleGeo as a "ready-to-use platform that makes it easy to store, scale and discover geodata for use on the Web and in applications." "After discovering Quova¹s offerings, it became obvious that we needed to include their IP Geolocation data in our ready-to-use location infrastructure," said Matt Galligan, cofounder and CEO of SimpleGeo. "Quova's data will enable developers using SimpleGeo to locate their users easily, regardless of access to GPS or WiFi data. The partnership just made sense." Essentially, the partnership creates a geolocation "failover" system for developers. Applications and services can select the best available source for location data. The level of accuracy ranges from GPS smartphones, at the high end, to Wi-Fi data from
See original here:
Where 2.0: Quova and SimpleGEO Make App Building Easier
Tags:
api,
availability,
data storage service,
digital,
enterprise,
flexibility,
geolocation,
gowalla-access,
ip geolocation data,
Joe Stump,
location,
Matt Galligan,
partnership,
power,
Quova,
San Jose,
select-the-best,
simple,
SimpleGeo,
the-partnership
•
Nearly 15 years ago, libraries were still primarily a place to go check out the printed, bound word. Only 28 percent offered Internet access, whereas today, almost all public libraries offer access and are helping to bridge the digital divide, according to a report by the University of Washington on Internet use in libraries across the country. According to the report, "the wiring of public libraries has transformed one of the nation's most established community resources into a critical digital hub". Sponsor Every year, 169 million people visit their local public library and 45 percent of them access the Internet, according to the report. The report, which focuses its numbers of people 14-years old and older, is based on nearly 50,000 surveys from patrons of more than 400 public libraries across the country. As Seth Godin pointed out last January, libraries "can't survive as community-funded repositories for books that individuals don't want to own" and that the "number one thing they deliver to their patrons is free DVD rentals." Now, we can add "Internet access" to the top of the list, as "Internet access is now one of the most sought after public library services", according to the report. The report notes that patrons use the Internet for a variety of tasks - from job searches to civic participation to finance to school kids doing their homework - but offers an interesting stat right off the bat. Of those people using the Internet at the library, "more than three-quarters of these people had Internet access at home, work, or elsewhere." The library, it would seem, offers a respite from the coffee shop, a refuge from familial fights over the single home computer and an alternative to the dizzyingly slow dial-up Internet that so many still have to deal with. But what are they doing with this new found Internet provider? Another telling number, though, was that 60 percent of respondents said they use library computers to maintain "social connections" and we can't help but wonder if libraries are giving people a safe place to Facebook-lurk. That is, many places of employment and schools ban social networks - are libraries a way around that for workers and teens? Overall though, the report does seem to show that libraries are a "technological lifeline to children and families in need", with 44 percent of people in households below the federal poverty line using public libraries for Internet access. And while we may make fun of Facebook occasionally, social networking can be a key tool in finding employment and networking. But beyond that, we can see that employment, education and health information are among the top use cases. In the end, the report calls for continued support for a public system that seems to be the biggest bridge for the digital divide . It is certainly a shift in focus, but we hope that any hard feelings over digital taking away from the printed word don't get in the way of keeping public libraries funded. As the report reads, "The findings signal this is a moment when federal, state, and local governments should invest more, not less, in the computing capacity of the nation's libraries to help advance a wide range of policy goals." Discuss
Link:
Report: Last Bastion of the Bookworm Becomes Internet Hub
Tags:
access,
coffee,
country,
digital,
digital-divide,
dvd,
government,
internet,
library,
local public library,
nation,
printed,
public library services,
report,
Seth Godin,
social-networking,
university
•
In the next few weeks, the ReadWriteWeb events guide will take you from New York City, to San Francisco, to Portland, Oregon. Along the way you'll find a conference on search engine strategies, a showcase for startups, an in-depth look at the freemium business model, and a day filled with of social media case studies. How do you like your events calendar? As a world map ? As an iCal (and Google Calendar-importable) file? You can also import individual events using the link beside each entry. Know of something cool taking place that should appear here? Let us know in the comments below or contact us . Sponsor 22 – 26 March 2010: New York City Search Engine Strategies New York Conference & Expo Go beyond search at Search Engine Strategies New York . Learn the newest trends, strategic action plans, and technology that industry leaders are employing today. Our experts will trace the natural evolution of search exploring topics such as: digital asset optimization, mobile application development, transition from search to discovery and more.Book your pass today. Enter RWW15 to save 15% off the registration. Sessions include: Digital Asset Optimization Deep Dive Into Analytics Augmented Reality: It's a Brave New World Bringing SEO In-House: The Pros and Cons Advanced B2B Search Marketing Duplicate Content & Multiple Site Issues 23 March 2010: San Francisco, California S.F. Beta 4.0 After a long winter's hiatus, S.F. Beta is back, for its forth year straight! Join hundreds of founders, investors, developers, and technologists for a lively evening of demos, drinks, conversation, and new connections. Early bird tickets are available, and they're going fast. Register now for discounted admission. As always, we feature startup demos all night. This time around, the theme is Search & Discovery. If you're building the next Google (or the next Google acquisition), we want you here! Email cperry@sfbeta.com for more info. 26 March 2010: San Francisco, California Freemium Summit The first Freemium Summit is a one day event focused on exploring what it takes to succeed under the freemium business model. Across all segments of the media landscape, entrepreneurs and executives are pioneering models that combine a free offering with a premium, paid offering. This hybrid business model is one of the most exciting areas of business model innovation impacting the world of media and the Freemium Summit will explore the most important topics on the minds of leading practitioners. Confirmed Speakers: Toni Schneider, Automattic (WordPress); Matt Brezina, Xobni; Aaron Levie, Box.net; Phil Libin, Evernote; Tom Conrad, Pandora; Drew Houston, Dropbox; Ranjith Kumaran, YouSendIt; Ben Chestnut, Mailchimp; Lance Walley, Chargify; Isaac Hall, Recurly; and Lincoln Murphy, Sixteen Ventures. March 29, 2010: Portland, Oregon Social Fresh Portland The social media conference for marketers, Social Fresh is not about concept, but focused purely on case studies from the front lines. Learn what social media can really do for business bottom lines. Over the course of the day, you'll hear from 35 speakers from companies like Intel, Ford, Comcast, Nike and many more, as well as keynote Peter Shankman. Register now and use coupon code RWW15 for 15% off. 4 April 2010: Carnegie Mellon University, Pittsburg, Pennsylvania ConnectNow TEDx CMU is an independently organized TEDx event that will be held on April 4th, 2010 at Carnegie Mellon University and will feature a full day of talks by prominent speakers as well as recorded videos from past TEDTalks. Confirmed speakers include Jonathan Fields (author, blogger and entrepreneur), Stacey Monk (founder of Epic Change, a startup nonprofit), Chase Jarvis (photographer, director and social artist) and Nathan Martin (CEO of Deeplocal, an innovation studio in Pittsburgh). The theme of the event is "Fearless", and we are inviting speakers from cross-disciplinary backgrounds to talk about their experiences, and tell us a little about what inspires them to be fearless in the pursuit of goals. We hope to spark discussions and foster connections between participants, encouraging aspiring individuals to follow their dreams and make a difference. The event is free to attend, and the application deadline is March 21, 2010. For more information about the event, visit tedxcmu.com or email info@tedxcmu.com. You can also find TEDx CMU on Facebook or follow us on Twitter . 7 – 9 April 2010: Sydney, Australia ConnectNow ConnectNow brings together international specialists and thought leaders in social media, emerging technologies and their intersection with business. Learn how the realtime web, location based services, augmented reality, ubiquitous computing and personalised services are changing marketing and communications. Understand the importance of trust in relationship marketing and what is "social currency". For more info email info@connectnow.net.au . 13 – 15 April 2010: Dallas, Texas PubCon South PubCon , the premier search and social media conference, features the industry's biggest names and key players shaping the future of the Web. PubCon South will include cutting-edge panel sessions exploring tracks dedicated to search, social media and affiliate marketing, an intensive professional search and social media training program, and some of the world's top keynote speakers. PubCon South at Dallas will also hold a one-day, two-track slate of intensive educational training programs led by some of the industry's most respected search professionals. The event takes place at the Richardson Conference and Civic Center. Register here . 16 April 2010: Mountain View, California Under the Radar: Cloud Under the Radar: Cloud is must-attend event for dealmakers and heads of IT from large enterprises, SMBs, service providers, carriers and media companies who are responsible for helping their companies leverage new technology and innovation in the fast-evolving IT ecosystem. Join us for the 15th Under the Radar conference, featuring a hand-picked selection of the world's most innovative cloud startups among 350 top tech, media, telcom and finance executives. For ticket and more information, visit http://undertheradarblog.com . 16 – 17 April 2010: Royal Oak, Michigan FutureMidwest FutureMidwest is the region's largest technology and knowledge conference. Founded by Adrian Pittman, Jordan Wolfe and Zach Lipson, FutureMidwest is the fusion of two successful conferences held in Michigan in 2009 - the Module Midwest Digital Conference and TechNow. Both conferences highlighted how technology and digital tools have dramatically changed the way we do business and the effect this transition has had on companies. FutureMidwest kicks things up a notch with presentations, group breakout sessions, relationship-building opportunities and influencers who are taking action to redefine business in the digital age. Register here . April 19, 2010: St. Louis Missouri Social Fresh St. Louis The social media conference for marketers, Social Fresh is not about concept, but focused purely on case studies from the front lines. Learn what social media can really do for business bottom lines. Over the course of the day you'll hear from 35 speakers from companies like Ford, Best Buy, Scottrade, Hardees, CMT and many more. Register now and use coupon code RWW15 for 15% off. 19 – 21 April 2010: San Francisco, California DrupalCon DrupalCon is the premier conference focused on Drupal, the award-winning open source content management framework that is galvanizing social publishing and web development today. For a registration fee of $195, attendees get three full days of sessions led by the best and brightest Drupal experts. Drupal has been downloaded over 2 million times since its inception, and project growth has doubled annually for several years. Drupal is used to deliver a wide variety of application types including blogs, wikis, community networks, digital media portals, and web content publishing and management. 26 April 2010: San Francisco, California Future of Money and Technology Summit The Future of Money & Technology Summit will bring together the best and brightest thinkers around money, including visionaries, entrepreneurial business people, developers, press, investors, authors, solution/service providers, and organizations who work where cash and commerce collide. We meet to discuss the evolving ecosystem around money in a proactive, conducive to dealmaking environment. Featured speakers include Jolie O'Dell from ReadWriteWeb, as well as representatives from Wells Fargo Bank, Kiva, SharesPost, Jambool, Founders Fund, Outright.com, SoftTech VC, and many more. Use discount code "rww" to get 10% off registration . 7 May 2010: Mountain View, California ReadWriteWeb Mobile Summit 2010 The ReadWriteWeb Mobile Summit 2010 will be an exploration of the latest Mobile development trends - both the technology and the emerging business applications. Get ready to explore, think and create the future of Mobile with the brightest in the industry, your peers! As in our last Summit, The Real-Time Web, the ReadWriteWeb Mobile Summit is an unconference. An unconference is a participant driven conference where the agenda is created on the day, in real-time and discussions are lead by conference participants. Read about the history of unconferences . We will have two main tracks at this Summit - Development and Business - so the Summit will be of interest to managers, marketers, developers, innovators, entrepreneurs and thought leaders alike. Here's a sample of some of the topics we'll explore in both of these tracks. Geo-location services - what can you do using location as a platform ? Commerce & Marketing - as more and more consumers use smartphones, how can businesses utilize this channel? Content, Publishing & Recommendations - the technologies and best practices. Mobile Social Networking - how to tap into communities on mobile devices. Internet of Things - the emerging opportunities from sensor and RFID data. Augmented Reality - the technology and business applications of AR. Native App vs. Browser Based - Including iPhone, Android, RIM, Palm, Windows Mobile and Symbian. Click here to register now , or to become a sponsor , or to help shape the conference . 11 May 2010: San Francisco, California FinovateSpring FinovateSpring 2010 will again showcase the most cutting-edge financial and banking technology innovations to Silicon Valley and the world. With Finovate's signature mix of short, fast-paced onstage demos (no slides are allowed) from handpicked companies and intimate networking time with their executives, this conference packs a ton of unique value into a single day. Come see the cutting edge of banking and financial technology and network with hundreds of the leading financial executives, venture capitalists, press, industry analysts, bloggers and fintech entrepreneurs. Early bird registration rates are available. May 17 2010: San Francisco, California SF MusicTech Summit The SF MusicTech Summit will bring together 700-plus visionaries in the music/technology space - the best and brightest entrepreneurs, developers, investors, service providers, journalists, musicians and organizations who work with them at the convergence of culture and commerce. We meet to discuss the evolving music, business and technology ecosystem in a proactive, conducive-to-dealmaking environment. Enter the discount code "rww" to get 10% off . 25 – 27 May 2010: Denver, Colorado Glue Glue is the only conference devoted solely to exploring the problem-sets facing architects, developers and IT professionals in a "post-cloud" world. Glue focuses on the APIs and protocols (Twitter, Facebook, Websockets, PubSubHubBub, XMPP), formats and standards (RDF/Linked Data, JSON, Microformats, HTML5), platforms and providers (Amazon, Rackspace, Google App Engine, Salesforce.com, Eucalyptus), Identity Protocols (OAuth/WRAP, SAML, OpenID, SPML) emerging NoSQL data models (Cassandra, CouchDB, MongoDB, Riak, HBase), and other mechanisms that are building the post-cloud world. ReadWriteCloud will be blogging live from Gluecon and CloudCamp, and ReadWriteWeb's Alex Williams will be moderating the "Managing Complexity in the Cloud" session. Please join us May 25-27 in Denver, Colorado. ReadWriteWeb readers can receive 10% off of registration by using the code "RWW12". 15 – 16 June 2010: New York City Corporate Social Media Summit The Corporate Social Media Summit is a two day conference focused exclusively on how big businesses can take advantage of social media to enhance their marketing/comms strategy. Featuring: Practical and relevant insights from peers who have already used social media successfully 20-plus corporate speakers (including PepsiCo, Whole Foods, Dell, McDonald's, General Motors, Citi, Johnson & Johnson), Best practice, benchmarks and practical next steps you can use to take advantage of social media in your business A tightly-focused agenda with 14 in-depth, practical workshops giving you knowledge on only the most critical business issues surrounding corporate use of social media Save $400 if you quote RWW400 when booking. Book here . 29 – 30 June 2010: London Cloud Computing World Forum The 2nd annual Cloud Computing World Forum is the perfect event to learn and discuss the development, integration, adoption and future of cloud computing and SaaS. Building on the success of the 2009 show, this two day conference and free-to-attend exhibition will provide a focused platform for the global cloud and SaaS industry. Show highlights include: Co-located with CloudCamp London Co-located with Green IT conference Free-to-attend exhibition with seminar and scenario theatre Free-to-attend evening awards presentation Hear from leading case studies on how they have integrated cloud computing and SaaS into their working practices Learn from the key players offering cloud and SaaS services Evening networking party for all attendees 5 October 2010: New York City FinovateFall FinovateFall will return to Manhattan on Tuesday, October 5 to showcase dozens of the biggest and most innovative new ideas in financial and banking technology from established leaders and hot young companies. The Fall event is the original and largest Finovate and features a single day packed with our special blend of short, fast-paced onstage demos (no slides are allowed) and intimate networking time with top executives from the innovative demoing companies. FinovateFall is a unique chance to see the future of finance and banking before your competition and find the edge you need in today's market. Early bird registration rates are available. Download this entire events calendar in iCal format. Discuss
See the original post here:
ReadWriteWeb Events Guide, 20 March 2010
Tags:
California,
digital,
history,
industry,
marketing,
Michigan,
social,
technology
•
Here's an idea for you: instead of slowly amassing followers, like on Twitter, or carefully culling your friends list over time on Facebook, making sure everyone is in their appropriate list and category, collect and dispose of friends like you ask for the time or a spare cigarette on a busy city street. That's what Lokast , the self-described "disposable" social network lets you do - carry your throw-away lifestyle over into the digital world. Sponsor The LoKast iPhone app was released earlier this week at the South By South West festival in Austin and is the perfect app for finding yourself among throbbing masses of the technologically inclined. But what is this disposable thing? From the email we received this week on the app's release: Disposable? Yes. That means unlike Facebook which is friends and family, this app is about finding random people in close range and being able to share and see parts of their public digital profile including downloading their public-share videos, music and pictures. The best part, is that after you're in that close range, you may never see them again. IE: Disposable. According to the press release, the name is short for "local casting", as opposed to broadcasting, and "aims to eliminate the need for physical media sharing, thereby eradicating physical CDs, plastic cases, video DVDs or waiting to get back to a PC computer to share and experience content." We have to agree that SXSW seems like the perfect venue for this type of app and we'd say why not give it a shot? We haven't made it all the way downtown yet to be close enough to give it a full whirl, but it looks more than capable from toying with it. Now, the thing is, we can't see a lot of people using this outside of big, hi-tech cities or conferences. Where does this fit into our day to day life? Are we really going to run around town staring at my screen trying to see if someone else with the same app is nearby? We don't think so. For now, though, we'd say give it an install and run around collecting some demos and see what people are listening to. Discuss
Link:
LoKast : The Disposable Social Network
Tags:
digital,
digital profile,
Disposable,
dvds-or-waiting,
facebook,
friends,
like-on-twitter,
perfect,
press,
public,
slowly-amassing,
sxsw 2010,
technologically,
time,
week