Online collaboration has evolved during the last decade, delivering even greater value -- thanks to a new generation of business technology applications. Forbes Insights released "Collaborating in the Cloud," a Cisco-sponsored study examining the ways business leaders increasingly look at cloud collaboration as a way to increase productivity, accelerate business results and enhance innovation across borders and functions.

The research combines a global survey of more than 500 executives with 15 executive interviews.

"The ability to collaborate in the cloud is becoming a key driver of competitive advantage," says Bruce Rogers, Chief Insights Officer of Forbes Media. "Leading companies are doing more to foster cloud-based collaboration -- not only internally, but also with an ever-wider swath of external groups including customers, suppliers, partners, and even regulators." The benefits of cloud-based collaboration, Rogers continues, include "greater efficiency, organizational dexterity, and innovation," to name only a few.

Key Findings from the Market Study include:

• Cloud solutions accelerate business results. Sixty-four percent of respondents overall say that cloud-based collaboration tools help businesses execute faster than would be possible otherwise. This can shorten time to market, quicken product upgrade cycles and lead to faster responses to competitive challenges. The figure increases to 82% among leaders. Leaders, as defined in the survey (14% of the sample), are executives (CEOs, CIOs, CTOs, CFOs, vice presidents of IT and non-IT executives who are department heads) with significantly greater experience and familiarity with cloud-based collaboration tools and strategies than others in the survey.
• Cloud enhances collaboration across time zones and functional boundaries. Fifty-five percent of those surveyed -- 87% of leaders -- say that capabilities enabled by cloud-based solutions represent a true breakthrough in collaboration. Cloud-based collaboration tools enable a wide array of enhanced capabilities in areas such as communication, product and service delivery, information sharing, tapping knowledge resources and group problem solving. >>Read more

Source: BizTech Roundtable

Recently, I identified and disclosed several cross-site scripting (XSS) vulnerabilities within a website I’ve recently started using.  In case you don’t know, an XSS vulnerability basically means that an attacker can provide new scripts to execute within the context of the vulnerable web application.

The application vendor, let’s call them ‘Company X’ for now, advertises that their sites serve millions of users in over a half dozen countries.   A quick Google search for the ‘This site is provided by Company X’ returns 32,000+ results.

I looked at a few of these sites, including Company X’s own online demo site, and this cursory examination revealed the same set of persistent and non-persistent XSS vulnerabilities.

This means Company X is probably putting a huge number of their users at potential risk with these vulnerabilities.

In order to do my part in helping to secure the users of this service, I started with a friendly email to the local site admin.   I also created a few benign, proof-of-concept example links to do a JavaScript alert of the active user’s plain text username and password — these values are stored in a cookie making it trivial to reveal.

Along with this information, I explained to the admin that a malicious attacker could just as easily inject script content to silently upload the credentials or even embed exploit code.  The response I got back was unconcerned.

The admin told me that, “we do not store private information,” and that users have the “ability to change their login and password as often as they would like.”

This unsatisfactory response was what triggered my decision to write this post. Cross-site scripting vulnerabilities should never be discounted on the grounds that a web site has nothing worth protecting. >>Read more

Source: Tripwire

VMware's new vCloud Hybrid Service offers virtual networking as a way to cut cloud deployment costs

VMware has launched its long-anticipated public IaaS (infrastructure as a service), touting its virtual networking capabilities as a differentiator from other established hybrid cloud offerings.

VMware's vCloud Hybrid Service will be based on the company's vCloud architecture, allowing customers to shift their VMware encoded workloads between in-house and the VMware hosted service, a practice known as running a hybrid cloud.

"You can write an application and be safe in the knowledge it can be run anywhere," said VMware CEO Pat Gelsinger, in a Web conference announcing the new service, adding that much of the complexity enterprises experience in deploying their workloads in the cloud comes from preparing their in-house applications to run in a new environment.

Those applications that VMware has certified to work with the company's vSphere virtualization platform will also work without modification on the vCloud Hybrid Service, Gelsinger said. The company touts that its software is used by 500,000 customers.

VMware is not alone in offering a hybrid cloud approach. Both Hewlett-Packard and Microsoft both tout how their cloud services work smoothly with their on-premises software, allowing customers to move their workloads between in-house and hosted servers.

Gelsinger, however, touted VMware's expertise in virtual networking as the key that would make its service more appealing than the others. Last year the company purchased SDN (software-defined networking) pioneer Nicira, and has been incorporating Nicira's technology in its own stack of software.

The new service uses virtual networking technologies to extend customers' layer two and layer three networks from their data center to the vCloud Hybrid Service. "This is a real game changer for many of our clients, and completely reduces the risk of deploying applications onto this public cloud," Gelsinger said. >>Read more

Source: InfoWorld