Technics: Internet Biz Transparency: Google explains and justifies itself on its transparency/privacy policies

It seems the sometimes glorious, sometimes nefarious Google has just set the standard for corporate accountablity in regard to transparency.

Google Explains Security Procedures
by Thomas Claburn,InformationWeek (Jun5,2k10)

In what it describes as a move toward greater transparency, Google has provided details about its security practices in a newly published paper.

In an effort to communicate its commitment to the security of its online services, Google on Friday published a paper that delves into its corporate security strategy. Eran Feigenbaum, director of security for Google's enterprise group, characterizes the paper as an attempt to be more transparent. It would also be fair to characterize the paper as an attempt to counter the perception that Google's online services are somehow less secure than traditional on-premises systems, a claim often made by Google's competitors.

More Security Insights

Whitepapers Panic slowly: integrated disaster response and built-in continuity

ForwardView: Four Areas of security vital to business health

Webcasts:

DNS DDOS Threats and Corresponding Mitigation Strategies

Spoofing Server2Server Communication: How You Can Prevent It

Analytics Breach, Diaries, Virtual Servers, Real Risks

Vids

Videos

Heartland Payment Systems suffered a major security breach at the hands of Russian Hackers. It sent shockwaves through the industry. We talked to CSO Kris Herrin about the attack and what's being done at Heartland and across the industry.

Feeling comfortable storing data in the cloud involves trusting a cloud services provider and the practices and policies they have in place," said Feigenbaum in a blog post. "In today's ultra-connected, Web-capable world, [and] understanding how data will be protected -- [this concept] is ultimately more meaningful than knowing it [your data, perhaps a company's worth of it] is physically located in one data center or another."

Google itself put that trust at risk earlier this year when it disclosed that "a highly sophisticated and targeted attack on our corporate infrastructure originating from China, that resulted in the theft of intellectual property from Google."

China and Google

Part of Google's response to that incident -- said to be made possible as a result of a previously unrecognized flaw in Internet Explorer 6 -- has reportedly been phasing out the use of Microsoft's Windows operating system at the company, a move that may be motivated by marketing concerns in addition to worries about security.

But Google's work making potential customers feel comfortable in its cloud isn't done. In March, Yale delayed a planned move to Google Apps for Education over s e c u r i t y concerns. When the City of Los Angeles was considering abandoning its Novell e-mail system for Google Apps and Gmail, similar concerns were raised. The deal ultimately went through but such fears remain.

Technotes, by Sportikos

Google's paper, Security Whitepaper: Google Apps Messaging and Collaboration Products, should help allay those fears. It describes the company's

corporate security policies,
organizational and operational security,
asset classification and control
practices,
personnel,
physical, and environmental security,
access control,
systems development and maintenance, and
disaster recovery efforts.

It may not be quite as fun as, say, the comic book Google used to introduce its Chrome browser, but it's likely to help IT decision-makers render more informed judgments about Google's services.

Dark Reading's Vulnerability Management Tech Center is your portal to all the news, product information, best practices, reports, and other data related to detecting and remediating security vulnerabilities. Check it out now.