Welcome!

Cloud Expo Authors: Gilad Parann-Nissany, Carmen Gonzalez, Liz McMillan, Noel Wurst, David H Deans

Related Topics: Cloud Expo, Java, SOA & WOA, Virtualization, Web 2.0, Security

Cloud Expo: Article

Deploying Cloud Security for Shifting and Evolving Defenses

Cloud offers agile and flexible defenses that consider situational context and real time management

A few weeks back I was watching my beloved San Diego Chargers lose in a most embarrassing way on Monday night. And in the waning seconds of blaming the quarterback for such ineffectual 2nd half play, it occurred to me, it wasn’t his fault.  It was the coach. It was the lack of planning for the type of attack the Denver Broncos would bring. It was the lack of leadership that should have easily closed the deal. In short, it was sticking to the status quo while everything around was changing.

My second epiphany was that this is a spot-on metaphor for the recent spate of bank hacks being levied by the hacktivist group Izz ad-Din al-Qassam. Not to make light of a serious issue, but the Charger collapse reminded me that the most insidious and effective attacks are not brute force in nature. In fact, most banks (according to compliance mandates) have decent processes to repel these attacks. In this case, the brutish DDoS (denial of service) was a feint to misdirect a smaller DDoS attack launched at the same time…and it was these more subtle attacks that were effective against 8 banks and counting. Continuing the football metaphor, it is like showing the blitz and falling back into tight pass defense resulting in the quarterback throwing an interception.

So the moral of the story is organizations need to evolve their security platforms to provide an agile shifting defense and change with the scenarios.

Now this is not to say the sky is falling, but a reputable IT security report noted a 50% increase in total number of DDoS attacks since Q2 of 2011 and a 10% increase since April. This means it’s time to look at your defensive processes and ensure they transcend compliance code. But moreso, to start anticipating what new threats, compliance requirements and business needs might be coming your way. You can’t be that guy who says “I’ll worry about it when I have to worry about it.” You simply can’t be paralyzed by the status quo. It’s a recipe for throwing 4 interceptions in the second half and squandering a 24 point lead.

We grouse a great deal about the burden of compliance, but they create a wall of protection that would otherwise create greater vulnerabilities. But all the audits, all the bureaucracy…it simply detracts from you being able to do the job you were hired to do. So the question begs, how do we evolve? How can we make security management easier yet stronger. Effective yet efficient. Agile yet layered? Proactive rather than reactive? If these questions are keeping you up at night, then it is time you took a deeper look at security-as-a-service or security managed from the cloud.

If you approach the security issue from the traditional sense of on-premise brick-building, server-stacking, resource-adding development, then yes, there are significantly costs in capital expenditures, human resources, and still not guaranteed that you have the necessary functionality, capability and visibility to anticipate tomorrow’s issues.

However…

By implementing a best-of-breed enterprise you gain a holistic view of what’s happening to your enterprise in real time. And because of the cloud computing advantages, the price point is very affordable (for what you are paying in support and maintenance, you could integrate an entire enterprise solution). You gain capability, you lessen expenses and, if your vendor also practices security as a service, your automated efficiencies come with 7/24/365 review of your logs by a live expert analyst.

But let’s put a real face on potential changes. Take FFIEC standards; very soon they will be more than guidelines. It's highly likely they will become compliance mandates. And they force you to address possible vulnerability gaps in your enterprise. Will you be prepared to meet the shifts in emphasis?

  • Layered security:

Most compliance-beholden organizations must recognize that security is not just about implementing virus scan and configuring firewalls. Ways and devices people reach your networks are changing quickly. Beyond log management protocols, you might need to add a SIEM or access management components. But the interpretation of layered security is choosing what is monitored and not relying on just a firewall to beat back possible intrusions, worms, phishing expeditions and user carelessness. You need multiple means, protocols and processes managed centrally.

  • Real-time, intelligence based assessment

There’s a saying in security circles: If you’ve noticed it, it’s already too late. The goal is to prevent, alert and remediate. And the only way to do this is through round the clock vigilance. Anything less than 24/7/365 monitoring opens the risk door too wide. It’s a cliché, but we are all acutely aware that hackers don’t sleep. But part of the question is not that monitoring is active, but how is it monitored? What data is collected? If you automate too much, you lose the human expertise; the context and the ability to respond effectively. Cloud-based security can cover a large enterprise or modest SMB with the same watchfulness while integrating the human intelligence assessment. Additionally, it provides additional resources, wider intelligence and greater coverage you don't have to fund.

  • Rapid adaptation against evolving threats

By applying a solution that uses real-time forensics including advanced correlations to examine for specific patterns, you create real time operational visibility. By recognizing traffic patterns correlated with a variety of other rules and processes you not only remove the false positive alerts, but can predict where your perimeter is soft and takes the necessary steps to shore them up.

  • Protect against ID and personal theft

Passwords are not enough. Time and again this has proven to be the weakest link. However, by instituting a solution that includes multi-credentialing, identity management, provisioning and the like, you can secure access to the most sensitive information. And if you make is easy for the user and minimize the impact of their usage experience, you take another step in maintaining the necessary trust while still ensuring people only see what they are supposed to see.

And all this can be deployed and managed from the cloud. The technology and security of these features has already matured to meet the concept.

These FFIEC guidelines seem very vague, but their meaning is clear: today’s operation needs to change. Not to keep up with the bureaucracy, but to improve the scalability, flexibility and control of an often volatile and fluid IT threatscape. However, don’t mistake this as a suggestion for mega-suite replacement. This should be part of any go-forward initiative that builds on or what is already in place. The cloud provides that agility to maintain an enterprise-powered security solution, yet adapt to the changing needs faster and more completely than most organizations can do on their own.

With that said, the best defense against an aggressive opponent is knowing what play is being called. Your holistic view gives you the ability to predict when the blitzes are coming, from what side, and most important, provide the flexibility to call an audible. One thing is for certain, you just can't stand still anymore; you can't rely on the status quo I just wish the Chargers saw that on Monday.

As an additional note, I participated in the development of a white paper for Fairway Technologies called , Get Your Head Into The Clouds! Industry Experts Answer Today’s Cloud Computing Questions ! Fairway’s collaborative new report not only examines the cloud computing issues that are dominating the industry, but also identifies key challenges behind cloud adoption and implementation, and presents best practices for organizations to develop and implement a sound cloud strategy. Guidance on cloud service brokers, open source cloud, data destruction, cloud bursting, and other topical issues are also discussed.

More Stories By Kevin Nikkhoo

With more than 32 years of experience in information technology, and an extensive and successful entrepreneurial background, Kevin Nikkhoo is the CEO of the dynamic security-as-a-service startup Cloud Access. CloudAccess is at the forefront of the latest evolution of IT asset protection--the cloud.

Kevin holds a Bachelor of Science in Computer Engineering from McGill University, Master of Computer Engineering at California State University, Los Angeles, and an MBA from the University of Southern California with emphasis in entrepreneurial studies.

@CloudExpo Stories
In high-production environments where release cycles are measured in hours or minutes — not days or weeks — there's little room for mistakes and no room for confusion. Everyone has to understand what's happening, in real time, and have the means to do whatever is necessary to keep applications up and running optimally. DevOps is a high-stakes world, but done well, it delivers the agility and performance to significantly impact business competitiveness.
"Our premise is Docker is not enough. That's not a bad thing - we actually love Docker. At ActiveState all our products are based on open source technology and Docker is an up-and-coming piece of open source technology," explained Bart Copeland, President & CEO of ActiveState Software, in this SYS-CON.tv interview at DevOps Summit at Cloud Expo®, held Nov 4-6, 2014, at the Santa Clara Convention Center in Santa Clara, CA.
ScriptRock makes GuardRail, a DevOps-ready platform for configuration monitoring. Realizing we were spending way too much time digging up, cataloguing, and tracking machine configurations, we began writing our own scripts and tools to handle what is normally an enormous chore. Then we took the concept a step further, giving it a beautiful interface and making it simple enough for our bosses to understand. We named it GuardRail after its function - to allow businesses to move fast and stay sa...
The Internet of Things is not new. Historically, smart businesses have used its basic concept of leveraging data to drive better decision making and have capitalized on those insights to realize additional revenue opportunities. So, what has changed to make the Internet of Things one of the hottest topics in tech? In his session at @ThingsExpo, Chris Gray, Director, Embedded and Internet of Things, discussed the underlying factors that are driving the economics of intelligent systems. Discover ...
"BSQUARE is in the business of selling software solutions for smart connected devices. It's obvious that IoT has moved from being a technology to being a fundamental part of business, and in the last 18 months people have said let's figure out how to do it and let's put some focus on it, " explained Dave Wagstaff, VP & Chief Architect, at BSQUARE Corporation, in this SYS-CON.tv interview at @ThingsExpo, held Nov 4-6, 2014, at the Santa Clara Convention Center in Santa Clara, CA.
SYS-CON Media announced today that Sematext launched a popular blog feed on DevOps Journal with over 6,000 story reads over the weekend. DevOps Journal is focused on this critical enterprise IT topic in the world of cloud computing. DevOps Journal brings valuable information to DevOps professionals who are transforming the way enterprise IT is done. Sematext is a globally distributed organization that builds innovative Cloud and On Premises solutions for performance monitoring, alerting an...
The major cloud platforms defy a simple, side-by-side analysis. Each of the major IaaS public-cloud platforms offers their own unique strengths and functionality. Options for on-site private cloud are diverse as well, and must be designed and deployed while taking existing legacy architecture and infrastructure into account. Then the reality is that most enterprises are embarking on a hybrid cloud strategy and programs. In this Power Panel at 15th Cloud Expo (http://www.CloudComputingExpo.com...
Verizon Enterprise Solutions is simplifying the cloud-purchasing experience for its clients, with the launch of Verizon Cloud Marketplace, a key foundational component of the company's robust ecosystem of enterprise-class technologies. The online storefront will initially feature pre-built cloud-based services from AppDynamics, Hitachi Data Systems, Juniper Networks, PfSense and Tervela. Available globally to enterprises using Verizon Cloud, Verizon Cloud Marketplace provides a one-stop shop fo...
Leysin American School is an exclusive, private boarding school located in Leysin, Switzerland. Leysin selected an OpenStack-powered, private cloud as a service to manage multiple applications and provide development environments for students across the institution. Seeking to meet rigid data sovereignty and data integrity requirements while offering flexible, on-demand cloud resources to users, Leysin identified OpenStack as the clear choice to round out the school's cloud strategy. Additional...
SYS-CON Events announced today that IDenticard will exhibit at SYS-CON's 16th International Cloud Expo®, which will take place on June 9-11, 2015, at the Javits Center in New York City, NY. IDenticard™ is the security division of Brady Corp (NYSE: BRC), a $1.5 billion manufacturer of identification products. We have small-company values with the strength and stability of a major corporation. IDenticard offers local sales, support and service to our customers across the United States and Canada...
The move in recent years to cloud computing services and architectures has added significant pace to the application development and deployment environment. When enterprise IT can spin up large computing instances in just minutes, developers can also design and deploy in small time frames that were unimaginable a few years ago. The consequent move toward lean, agile, and fast development leads to the need for the development and operations sides to work very closely together. Thus, DevOps become...
SYS-CON Events announced today that Windstream, a leading provider of advanced network and cloud communications, has been named “Silver Sponsor” of SYS-CON's 16th International Cloud Expo®, which will take place on June 9–11, 2015, at the Javits Center in New York, NY. Windstream (Nasdaq: WIN), a FORTUNE 500 and S&P 500 company, is a leading provider of advanced network communications, including cloud computing and managed services, to businesses nationwide. The company also offers broadband, p...
SYS-CON Events announced today that AIC, a leading provider of OEM/ODM server and storage solutions, will exhibit at SYS-CON's 16th International Cloud Expo®, which will take place on June 9-11, 2015, at the Javits Center in New York City, NY. AIC is a leading provider of both standard OTS, off-the-shelf, and OEM/ODM server and storage solutions. With expert in-house design capabilities, validation, manufacturing and production, AIC's broad selection of products are highly flexible and are conf...

ARMONK, N.Y., Nov. 20, 2014 /PRNewswire/ --  IBM (NYSE: IBM) today announced that it is bringing a greater level of control, security and flexibility to cloud-based application development and delivery with a single-tenant version of Bluemix, IBM's

The BPM world is going through some evolution or changes where traditional business process management solutions really have nowhere to go in terms of development of the road map. In this demo at 15th Cloud Expo, Kyle Hansen, Director of Professional Services at AgilePoint, shows AgilePoint’s unique approach to dealing with this market circumstance by developing a rapid application composition or development framework.
SYS-CON Events announced today Isomorphic Software, the global leader in high-end, web-based business applications, will exhibit at SYS-CON's DevOps Summit 2015 New York, which will take place on June 9-11, 2015, at the Javits Center in New York City, NY. Isomorphic Software is the global leader in high-end, web-based business applications. We develop, market, and support the SmartClient & Smart GWT HTML5/Ajax platform, combining the productivity and performance of traditional desktop software ...
AppZero has announced that its award-winning application migration software is now fully qualified within the Microsoft Azure Certified program. AppZero has undergone extensive technical evaluation with Microsoft Corp., earning its designation as Microsoft Azure Certified. As a result of AppZero's work with Microsoft, customers are able to easily find, purchase and deploy AppZero from the Azure Marketplace. With just a few clicks, users have an Azure-based solution for moving applications to the...
“In the past year we've seen a lot of stabilization of WebRTC. You can now use it in production with a far greater degree of certainty. A lot of the real developments in the past year have been in things like the data channel, which will enable a whole new type of application," explained Peter Dunkley, Technical Director at Acision, in this SYS-CON.tv interview at @ThingsExpo, held Nov 4–6, 2014, at the Santa Clara Convention Center in Santa Clara, CA.
The cloud is becoming the de-facto way for enterprises to leverage common infrastructure while innovating and one of the biggest obstacles facing public cloud computing is security. In his session at 15th Cloud Expo, Jeff Aliber, a global marketing executive at Verizon, discussed how the best place for web security is in the cloud. Benefits include: Functions as the first layer of defense Easy operation –CNAME change Implement an integrated solution Best architecture for addressing network-l...
“We help people build clusters, in the classical sense of the cluster. We help people put a full stack on top of every single one of those machines. We do the full bare metal install," explained Greg Bruno, Vice President of Engineering and co-founder of StackIQ, in this SYS-CON.tv interview at 15th Cloud Expo, held Nov 4–6, 2014, at the Santa Clara Convention Center in Santa Clara, CA.