Brazil looking to build country cloud in light of NSA snooping

Radical steps to safeguard Brazil internet communications

By Ron Miller

Revelations of NSA snooping on domestic and out of country targets have put everyone on edge, including heads of state. Earlier this month, the president of Brazil proposed a couple of radical steps to safeguard her country's internet communications from external spying, including building in-country data centers to protect Brazilian data.
If more countries start demanding that their data stays internal, as the EU has already done, it could begin to have an impact on cloud vendors. That could affect you, as they pass on the cost of building these country-specific data centers to all customers.

Al Jazeera reports this isn't just patriotic chest thumping on the part of Brazil. Documents released as part of the Edward Snowden revelations revealed the NSA was monitoring email and phone calls between the Brazilian and Mexican heads of state and other high-level officials. Brazil is apparently mad as hell and they aren't going to take it anymore.

In response, Brazil's president Dilma Roussef has announced plans to build an underground cable between South America and Europe in order to bypass servers in the US that are more likely to be subjected to US prying. The Verge reports she has also proposed a new law that would "force Google, Microsoft, and other US web companies to store data for Brazilian users on servers located within Brazil."

It is this last part in particular which should worry the average IT pro, because if Brazil follows through on this step, it's possible other countries would soon follow. Instead of an open flow of information, data would have to be confined to these in-country clouds. Big companies could afford to open in-country data centers to accommodate the legal requirements of each country, but for smaller companies, possibly using online services like Amazon Web Services as virtual data centers, it could prove more difficult.

That could reduce competition and innovation because there would be less pressure from startups at the bottom pushing the established players at the top. It could also lead to higher prices as these established companies are forced to build and staff in-country data centers. It's likely it would require extensive auditing to prove they are complying with the legal requirements and that the data is staying within the countries according to the letter of the law --and that could prove expensive as well.

The more legal roadblocks that get put up for internet companies trying to do business, the more costly it is likely to be. That's yet another reason why you should be concerned about NSA spying -- it not only violates your constitutional rights, but it could also end up costing you money.

All of this doesn't take into account the fact that even though the Snowden documents have illustrated that there is a lot of domestic spying going on at the NSA, the chief job of the agency is actually to keep an eye on what's going on overseas.
Moving the distribution to a different cable and confining the data to in-country may ironically make it easier for the NSA to do its defined job without spying on US citizens -- although that wouldn't be much comfort to the countries being spied upon.

But in the end, these revelations are bad for business on so many levels. They make individuals, businesses and entire countries uncomfortable and that could have an impact on how we conduct business across the entire internet.

And that's something everyone should be worried about.

On Internet, Brazil is beating US at its own game

by Bill Woodcock

Analysis: Brazil's official response to NSA spying obscures its massive Web growth challenging US dominance

U.S. National Security Agency documents from 2012 revealed this month by Glenn Greenwald show that the intelligence agency recorded email and telephone calls of Brazilian and Mexican heads of state as well as the Brazilian state oil producer Petrobras and other energy, financial and diplomatic targets. It is unsurprising that a national intelligence agency would attempt to gather such information, and it can be argued that it was, however overzealously, doing the job American taxpayers are paying for. But it is also a disappointing, though illuminating, commentary on the state of the Internet that it was successful.

In response to the revelations, on Tuesday Brazilian President Dilma Rousseff announced measures to protect the privacy of Brazil's citizens from NSA spying:

• Increase domestic Internet bandwidth production
• Increase international Internet connectivity
• Encourage domestic content production
• Encourage use of domestically produced network equipment

Rousseff could make these significant announcements not because of any government resolution or investment but because they are, by and large, successful existing Brazilian private-sector initiatives that have been under way for many years. Only those who haven't been paying attention to Brazil's phenomenal Internet development mistook the announcement for news; it was opportunistic spin on what Brazil has already been successfully doing for most of the past decade.

Nor is Brazil's plan a repudiation of the United States. Brazil is following the path of Internet development that has been proven in the U.S. and is advocated by the U.S. State Department. What's interesting about Brazil is not that it's defying the United States' under-the-table agenda but that it's doing so by executing moves from the U.S.'s above-the-table playbook so masterfully.

For more Info ........

September Newsletter – Bare Metal Cloud

Vega newsletter is published monthly by Vega BI, and distributed to our partners
 to facilitate pursuit of a common interest in top-notch technologies. 

When virtual machines just don’t provide the performance you need, you need to get physical!
Bare Metal Cloud service gives customers the opportunity to enjoy the flexibility, provisioning, 
and on-demand billing advantages of cloud computing. Bare Metal Cloud is our topic of the month.

Big Data cloud – should I use Bare Metal ?

“The Cloud”

Cloud computing, often referred to as simply “the cloud,” is the delivery of on-demand computing resources—everything from applications to data centers—over the Internet on a pay-for-use basis.

These services are broadly divided into three categories: Infrastructure-as-a-Service (IaaS), Platform-as-a-Service (PaaS) and Software-as-a-Service (SaaS).  A cloud service has three distinct characteristics: it is sold on demand, it is elastic and the service is fully managed by the provider.

Big Data & “The Cloud”

Big data is broadly defined as the capture, management, and analysis of data that goes beyond typical structured data, often to unstructured files, digital video, images, sensor data, log files, and really any data not contained in records with distinct searchable fields. In some sense, the unstructured data is the interesting data.

Big data, by its nature, needs flexible resources such as processing power storage and flexibility for processing a tremendous volume of unstructured and semi-structured data.

“The cloud”  basic nature of flexibility and  ease of  scaling  up and down as  required, sure look promising for Big data customers.

While the “common cloud services” grants tremendous flexibility and reduces overall operation costs, it is just not appropriate for all Big Data use cases. The “common cloud services” does not offer the performance necessary to process real-time data without introducing latency that would make the results un-useful. Performance degradation can occur, stemming from the introduction of a hypervisor layer and the multi-tenant nature of virtualized public cloud platforms.

In order to address the Big data customers’ needs for high performance & real time processing, service providers are introducing new services named “Bare Metal cloud”.

Bare-Metal cloud

The bare-metal cloud has emerged as a way to complement virtualized services with a dedicated server environment that eliminates the overhead of virtualization without sacrificing the flexibility, scalability and efficiency benefits of the cloud. Bare-metal servers do not run a hypervisor, are not virtualized, and can be delivered via a cloud-like service model.

This balances the scalability and automation of the virtualized cloud with the performance capabilities found in monthly dedicated server hosting plans. The hardware is fully dedicated to the customer, including any additional storage that may be required. Bare-metal instances can be provisioned and decommissioned via a web-based portal or API as needed, providing access to high-performance dedicated servers on demand. And, depending on the application and use case, a single bare-metal server can often support larger workloads than multiple, similarly sized VMs.

Bare Metal cloud infrastructure provides organizations with high performance accompanied with the full potential of cloud services.

For more ...... See Vega's September Newsletter 

Big Data cloud – should I use Bare Metal ?

Big Data – Essential

Big data is broadly defined as the capture, management, and analysis of data that goes beyond typical structured data, often to unstructured files, digital video, images, sensor data, log files, and in fact any data not contained in records with distinct searchable fields. In some sense, the unstructured data is the interesting data. Big data, by its nature, needs flexibility and scalability in order to process the tremendous volumes of unstructured and semi-structured data.

No wonder cloud computing services attract Big data customers.

“The Cloud”

Cloud computing, “the cloud,” is the delivery of on-demand computing resources—everything from applications to data centers—over the Internet on a pay-for-use basis.
The name cloud computing was inspired by the cloud symbol that is often used to represent the Internet in flowcharts and diagrams.
A cloud service has three distinct characteristics that differentiate it from traditional hosting.
It is sold on demand, typically by the minute or by the hour; it is elastic - a user can have as much or as little of a service as they want at any given time; and the service is fully managed by the provider ,the consumer needs nothing but a personal computer and Internet access.

Cloud computing services are broadly divided into three categories:

·         Infrastructure-as-a-Service (IaaS) - Storage, network, VM, load-balance , servers …

·         Platform-as-a-Service (PaaS) -  Database, backups, runtime, Web-server, development tools, API  …

·         Software-as-a-Service (SaaS) -  CRM, ERP, virtual desktop, games ….

Today's clouds are built on a mix of technologies, including virtualization, automation and orchestration. In some circles, virtualization is nearly synonymous with cloud. But above all a cloud is a pool of resources that is elastic, scalable and accessible on-demand.

“The cloud” basic nature characteristics; sure looks promising for Big data customers. 

Big Data & “The Cloud”

It is no surprise that the rise of Big Data has coincided with the rapid adoption of Platform-as-a-Service (PaaS) and Infrastructure-as-a-Service (IaaS) technologies. PaaS lets firms scale their capacity on demand and reduce costs, while IaaS allows almost instantaneously deployment of additional computing nodes.

The combination of PaaS and IaaS is what makes big data analytics achievable for firms of all kinds, regardless of their size or sector. These Cloud computing services puts Big data within the reach of companies that could never afford the high costs associated with buying sufficient hardware capacity to store and analyze such large data sets.

Brazil - Hot Market for Surveillance Technology

Brazil Becomes Hot Market for Surveillance Technology Ahead of World Cup

Written by Bruno Fonseca, Jessica Mota, Luiza Bodenmüller and Natalia Viana, by Agência Pública

Giants of the surveillance sector get contracts in a number of Brazilian cities during the games of 2014 – from security scanners to remote tracking software.

Shortly after being informed of US National Security Agency (NSA) spying, President Dilma Rouseff asked ministers Paulo Bernardo (Communication) and José Eduardo Cardozo (Justice) to include in the Marco Civil da Internet, a charter of Brazilian Internet users, a mechanism that allows the suspension of operation of companies that cooperate with international spying schemes. “It could apply to banks, or telephone companies,” said the Minister of Communication.

But the security of sensitive data could also be guaranteed by multinational surveillance companies, given that a large part of the increasing demand for surveillance in the World Cup will be supplied by sector giants – the same companies that provide equipment and software to police forces all over the world, including the American government and the NSA.

Most of them are mentioned in the recent publication by Wikileaks, part of the Spy Files 3 project , a compilation of 249 documents from 92 companies, among them brochures, contracts and metadata referring to some of the business leaders of the sector. They show that, in relation to mega-events, Brazil has become priority for the global surveillance industry.

The Extraordinary Secretariat for Large Events (SESGE) has been acquiring a number of technologies for public security. Two hundred million Brazilian reais [nearly 87 million US dollars] have been spent on national-level contracts. And the industry of surveillance equipment is betting heavily on taking advantage of this opportunity. In recent years, a number of industry fairs have taken place in the country.

When surveillance specialists get together 

In July, in Brasilia it was ISS World s turn, bringing together policy, security officials and intelligence analysts for training in legal interception, high tech electronic investigations and networked data collection. Financed by the biggest in the sector, like Gamma Group, Hackingtean, Cobhan Surveillance, Hidden Technology, GlimmerGlass and the Brazilian firm Suntech, the directors of these companies lead workshops.

For example, some courses taught participants how to use social networks as open sources in criminal investigations, or how to better use Facebook: from security on Facebook through to retention of data and interaction with security forces. Another training, given by the firm Group 2000 Netherlands, looked at the how interception of data works at a national level, combined with LBS (location-based service) – a computer programming service that allows for inclusion of place and time in a system as it is used. The firm IPS also featured social media and webmail: the architecture of Big Data for mass interception, beyond the course on “expert intrusion” of social networks and webmail. The Brazilian company Suntech, which is now part of the American group Verint, funded a whole day of training, with special focus on interception of telecommunications.

Beyond the ISS, the LAAD (Latin American Aerospace & Defence), one of the main fairs of security and defense companies in Latin America, has been held in Brazil since 1995, with support from the Ministry of Defense and the Ministry of Justice. In recent years, mega-events have been the principal focus of this fair, home for a great deal of business in the sector.

In 2011, for example, the Ministry of Defense announced a project for the Integrated Border Monitoring System (SISFRON), based on a network of sensors interlinked with control and command systems. The military wanted to accelerate the construction of the system because of the World Cup and the Olympics. The estimated cost, $6-7 billion reais [between $2.7 and 3.1 billion US dollars], enthused international markets. The reason: in spite of national firm Embraer being given the construction of the system, the Saab Group of Sweden, made it be known that its German subsidiary MEDAV will supply, as a subcontractor, the mobile and static sensor systems for the program, allowing for the monitoring and identification of HF, VHF, and UHF frequencies.

This year more than 30,000 visitors attended LAAD, which hosted 720 exhibitors from 65 countries, among those present representatives from the Ministries of Defense of the Ukraine, United Kingdom, Argentina and South Africa. In 2014, year of the World Cup, a smaller version, only on security, is set for April 8-10, in Riocentro.

August Newsletter - Advanced persistent threat (APT)

Vega newsletter is published monthly by Vega BI, and distributed to our partners to facilitate pursuit of a common interest in top-notch technologies. 

Once rare and sophisticated, the APT is now becoming a common attack.

 Is your organization ready?   Any organization linked to the Internet is at risk. To protect your organization against APTs, it’s important to know what an APT is.

 

Typically, the intention of an APT attack is to steal data rather than to cause damage to the network or to the organization. APT attacks target organizations in sectors with high-value information, such as national defense, manufacturing and the financial industry.

In an APT attack, the goal is to achieve ongoing access, therefor it is characterized as a network attack in which an unauthorized person gains access to a network and stays there undetected for a long period. In order to maintain access without discovery, the intruder must imitate a normal user’s behavior and thus continuously rewrite code and employ sophisticated evasion techniques. Advanced Persistent Threat (APT) actors follow a staged approach, as articulated in the “APT-life Cycle” diagram , to target, penetrate and exploit the organization.

For more .... See Vega's August Newsletter

APT - Advanced Persistent Threat

APT - Highlights 

Advanced persistent threat (APT) refers to a planned and assembled activity of an entity (usually an organized group) with both the capability and the intent to determinedly and effectively attack a specific target. The term is commonly used to refer to cyber threats, in particular that of Internet-enabled espionage using a variety of intelligence gathering techniques to access sensitive information.

Typically, the intention of an APT attack is to steal data rather than to cause damage to the network or to the organization. APT attacks target organizations in sectors with high-value information, such as national defense, manufacturing and the financial industry. In an APT attack, the goal is to achieve ongoing access, therefor it is characterized as a network attack in which an unauthorized person gains access to a network and stays there undetected for a long period. In order to maintain access without discovery, the intruder must imitate a normal user’s behavior and thus continuously rewrite code and employ sophisticated evasion techniques. Advanced Persistent Threat (APT) actors follow a staged approach, as articulated in the “APT-life Cycle” diagram , to target, penetrate and exploit the organization. APTs present a greater threat based on their intense attention to preparations and their desire to expand access across the organization’s networks.

Although APT attacks are difficult to identify, the intruder can never be completely invisible. Detecting anomalies in outbound data is perhaps the best way for an administrator to discover that his network has been the target of an APT attack.

There’s a lot we know about advanced persistent threats, but there’s a lot we don’t know. This is due, in large part, to the complexity of the attacks and the stealth of the attackers. Our knowledge about APTs is growing, but, unfortunately, that’s because the attacks themselves are growing in frequency. Criminals using APTs want data, so the more valuable an organization’s data, the more likely it is to be targeted. Government agencies and organizations in industries such as finance, energy, IT, aerospace, and chemical and pharmaceuticals are the most likely to be the victims of APT infections, as are those involved in international trade. Users and organizations with access through business relationships to organizations holding valuable data, such as smaller defense contractors, are also beginning to be targeted in order to be used along time as entry gate into their valuable partners’ networks.

Any organization linked to the Internet is at risk. 

To protect your organization against APTs, it’s important to know what an APT is !!!