@CloudExpo Authors: Yeshim Deniz, Liz McMillan, Pat Romanski, Elizabeth White, Zakia Bouachraoui

Related Topics: @CloudExpo, Java IoT, Microservices Expo, Microsoft Cloud, Agile Computing, Cloud Security

@CloudExpo: Article

Proverb: When a Door Closes, Just Make Sure You Don't Leave a Window Open

Not every employee leaves a company with a gold watch and a handshake.

Earlier this month I attended a local cloud developers group, and I met a gentleman who consults with companies to engage in deep dive forensic examinations of their networks. He looks for the virtual fingerprints of misdeeds, fraud, and misdoings that can be used for e-discovery in legal cases. He essentially gets down to the bits and bytes of how much information flows to certain IP addresses to ascertain whether or not proprietary data has been tampered or stolen.

He confirmed something that I long believed to be true. One of the greatest threats to an organization comes from within. Not everyone who exits a company leaves with a handshake and a gold watch. Often time there are hard feelings; that the employer wronged the former employee and that employee will exact a matter of revenge or feel justified to extract some sort of perceived compensation. This includes everything from the outright theft of sales leads and databases, to accessing their company email account to send “nasty-grams” to customers and other employees, to malicious sabotage. I am aware of several specific incidents where someone knowingly introduced malware into the company network.

Now this isn’t meant for you to look sideways at the person sitting in the next cubicle. However, access policies  needs to be a part of any company’s  internal risk assessment and security policy.

One of the easiest ways to prevent the disgruntled employees is to bar their access. Seems straight-forward enough, right? If it were the case, it really wouldn’t continually rank as one of the top threats to networks. The problem is that there are so many moving parts to properly dismiss an employee.  Sure there’s someone watching them pack up their physical belongings and making sure they don’t leave a little goodbye gift on the network on their way out. But if the tap is left on, the employee can come in hours, days or weeks later and create unnecessary havoc.

And the more diverse the enterprise (multiple divisions, brands, franchises, etc…), the harder it is to keep tabs on the coming and going of legitimate employee access.

Case in point:  I know of a national enterprise that franchises their individual locations to independent operators. Each franchisee is free to hire and fire their own staffs. Every staff member has a corporate email account and is allotted certain access to corporately managed applications. So, we are talking thousands of employees with a large enough churn rate to raise some issues with corporate headquarters.

There is a definitive need to promote franchise autonomy while still assuring adherence to corporate access and usage policies. The quick answer is a policy of provisioning and de-provisioning. There are plenty of solutions that accomplish this. Identity management and access management is not a new concept…even via the cloud. The trick is to create an easy-to-use, cost effective process to create self-service that allows the franchisee to add new employees and automatically give them certain rights based on their role. Conversely, when an employee leaves the company, there must be an equally simple way to retire the account and prevent anyone from using that account to access corporate information.

The key word is automatically.

So before the termination paperwork reaches the headquarters in Fort Meyers, Florida, the franchise manager in Rhode Island or Honolulu can inactivate the employee’s access via self-service. With a single keystroke in the IDM solution and their access to email ceases; their ability to get on the network and access files is blocked; their accounts to every application is removed. Even if  a manager forgets, the central system can take steps to assess usage. If an account is dormant for 10 days or 3 weeks (examples not hard and fast rules), it is marked for inactivity and retired.

But bolting the door behind them, doesn’t mean they don’t know how to pick the lock. This is part of our cautionary tale that keeps the forensic investigator busy.

This is also where the benefit of unified security comes into play. You’ve used your IDM investment to remove the credentials, but that doesn’t mean the motivated insider won’t try. Because of continuous monitoring practices (in real time) you can generate alerts if anyone tries to access retired accounts, tries to change a password, or generates multiple login failures in a short period of time. A system that leverages IDM with SIEM and log management, not only receives the alert, but sees the IP address (and other identifying attributes) of who is attempting access.

Now for argument’s sake, let’s say they were particularly bright and used some shadow IT shenanigans to back door into your network. Real time monitoring will still catch the access attempt and also recognize if any proprietary asset is changed, downloaded or modified. In that it is real time and not simply logged, gives you a strong chance to repel or immediately respond to the attack. As I have said in several blogs, unless you have the budget, the IT sophistication and the resources, having all of these concurrent initiatives can be seen as a luxury—unless you package them as a security as a service platform from the cloud. The ability to leverage a variety of capabilities—have them “talk” to one another across multiple information silos, physical locations, various applications and divisions. When you can centralize them, it creates a unique advantage that strengthens your position to ensure  a former employee cannot take advantage of your sensitive data and proprietary assets.

And before I forget…make sure in your written employment policies you address BYOD. That way you retain the option/right to completely or partially wipe their personal devices upon termination of employment.

I’ll leave you with another old proverb: “The key that opens is also the key that locks.”

Kevin Nikkhoo

Cloud Access

More Stories By Kevin Nikkhoo

With more than 32 years of experience in information technology, and an extensive and successful entrepreneurial background, Kevin Nikkhoo is the CEO of the dynamic security-as-a-service startup Cloud Access. CloudAccess is at the forefront of the latest evolution of IT asset protection--the cloud.

Kevin holds a Bachelor of Science in Computer Engineering from McGill University, Master of Computer Engineering at California State University, Los Angeles, and an MBA from the University of Southern California with emphasis in entrepreneurial studies.

CloudEXPO Stories
To Really Work for Enterprises, MultiCloud Adoption Requires Far Better and Inclusive Cloud Monitoring and Cost Management … But How? Overwhelmingly, even as enterprises have adopted cloud computing and are expanding to multi-cloud computing, IT leaders remain concerned about how to monitor, manage and control costs across hybrid and multi-cloud deployments. It’s clear that traditional IT monitoring and management approaches, designed after all for on-premises data centers, are falling short in this new hybrid and dynamic environment.
With more than 30 Kubernetes solutions in the marketplace, it's tempting to think Kubernetes and the vendor ecosystem has solved the problem of operationalizing containers at scale or of automatically managing the elasticity of the underlying infrastructure that these solutions need to be truly scalable. Far from it. There are at least six major pain points that companies experience when they try to deploy and run Kubernetes in their complex environments. In this presentation, the speaker will detail these pain points and explain how cloud can address them.
DXWordEXPO New York 2018, colocated with CloudEXPO New York 2018 will be held November 11-13, 2018, in New York City and will bring together Cloud Computing, FinTech and Blockchain, Digital Transformation, Big Data, Internet of Things, DevOps, AI, Machine Learning and WebRTC to one location.
Containers and Kubernetes allow for code portability across on-premise VMs, bare metal, or multiple cloud provider environments. Yet, despite this portability promise, developers may include configuration and application definitions that constrain or even eliminate application portability. In this session we'll describe best practices for "configuration as code" in a Kubernetes environment. We will demonstrate how a properly constructed containerized app can be deployed to both Amazon and Azure using the Kublr platform, and how Kubernetes objects, such as persistent volumes, ingress rules, and services, can be used to abstract from the infrastructure.
We are seeing a major migration of enterprises applications to the cloud. As cloud and business use of real time applications accelerate, legacy networks are no longer able to architecturally support cloud adoption and deliver the performance and security required by highly distributed enterprises. These outdated solutions have become more costly and complicated to implement, install, manage, and maintain.SD-WAN offers unlimited capabilities for accessing the benefits of the cloud and Internet. SD-WAN helps enterprises to take advantage of the exploding landscape of cloud applications and services, due to its unique capability to support all things cloud related.