Click here to close now.


@CloudExpo Authors: Jason Bloomberg, Liz McMillan, Victoria Livschitz, Lori MacVittie, Elizabeth White

Related Topics: @CloudExpo, Microservices Expo, Agile Computing, Cloud Security, @BigDataExpo, SDN Journal

@CloudExpo: Article

Privileged Identity Management in the Cloud

Key security concerns for cloud service providers

Every cloud infrastructure can be home to potentially hundreds of thousands of vulnerable privileged accounts. The presence of automated hacking tools means improperly secured privileged logins are almost certain to give hackers free reign on the network and access to customers' private data, within minutes of an incursion.

Until now privileged accounts and other file-based secrets have proven difficult to secure within large-scale, dynamic Cloud Service Provider (CSP) networks, and many still use humans and first-generation software tools to manage the task.

As a result, improperly secured privileged accounts provide an easily exploited attack surface for hackers and malicious insiders.

Key Security Concerns for Cloud Service Providers
The problem with improperly secured privileged accounts is a particular concern for cloud providers.

CSPs face significant problems from any data loss incidents - including direct remediation and legal costs, along with the loss of business resulting from public disclosure of data breaches. These service providers also face a daunting challenge to secure constantly changing physical and virtual IT assets using security methodologies that, in some cases, were never intended to scale to the size of today's cloud services networks.

In general, privileged identities aren't managed by conventional Identity and Access Management (IAM) systems because, unlike conventional user logins, privileged accounts aren't typically provisioned. Instead, privileged accounts frequently appear on the network whenever physical and virtual IT assets are deployed and changed.

As a result, privileged credentials must be discovered and continuously tracked by software that's separate from IAM. And, because every shared, static, or cryptographically weak privileged identity represents a potential attack surface, IT regulatory mandates - including PCI-DSS, SOX, HIPAA and others - require that these credentials be frequently changed and cryptographically complex. Access to these privileged accounts must also be attributed to named individuals and audited.

However, this can seem an overwhelming challenge when access lists, and even the assets themselves, change more rapidly than human intervention can manage.

How to Manage the Privileged Account Problem
Cloud Service Providers are faced with significant security challenges when managing privileged identities, certificates and other file-based secrets on a massive scale in large and elastic environments. In the world's largest multi-tenant organizations, the number of systems that need to be managed can extend into the hundreds of thousands. A truly secure environment requires all identities on all systems to be discovered and managed.

In order to accomplish this, cloud providers and other large enterprise deployments need a solution that can discover, audit and control access to privileged accounts entirely by machines in an automated and programmatic manner - rather than through direct human intervention. Only by deploying automated security solutions can these organizations locate and remediate weaknesses faster than nation-state attackers and other professional criminal hackers can exploit them.

With automated and programmatic controls over privileged identities, cloud service providers can achieve:

  • Privileged account discovery and tracking that is both broad in platform scope and deep in account discovery (including process and service interdependencies to enable safe, automated changes of any interdependent accounts without disruptions)
  • Password changes, as needed to comply with regulatory mandates
  • Rules for human and machine access to privileged accounts
  • Ongoing detection and decommissioning of inactive privileged accounts as they are removed

Now that next-generation security solutions exist that meet Cloud Service Provider requirements for managing privileged identities, certificates and other file-based secrets in large, elastic environments, a significant operational roadblock is removed that once prevented the largest CSPs from complying with industry and regulatory requirements.

More Stories By Jess Richter

As Vice President of Strategic Alliances at privileged identity management vendor Lieberman Software Corporation, Jess Richter is responsible for developing strategic partnerships with large enterprise cloud providers, system integrators and OEMs. For more information on Lieberman Software visit

Comments (0)

Share your thoughts on this story.

Add your comment
You must be signed in to add a comment. Sign-in | Register

In accordance with our Comment Policy, we encourage comments that are on topic, relevant and to-the-point. We will remove comments that include profanity, personal attacks, racial slurs, threats of violence, or other inappropriate material that violates our Terms and Conditions, and will block users who make repeated violations. We ask all readers to expect diversity of opinion and to treat one another with dignity and respect.

@CloudExpo Stories
According to Forrester, public cloud platforms are evolving, blurring the lines between Software as a Service (SaaS), Infrastructure as a Service (IaaS), and Platform as a Service (PaaS) in order to satisfy the needs of enterprises and widen their appeal to developers. In The Forrester Wave™: Enterprise Public Cloud Platforms, Q4 2014, Forrester evaluates the 16 most significant Enterprise Public Cloud Platforms and details how each vendor fulfills the 19 evaluation criteria points.
Interested in leveraging automation technologies and a cloud architecture to make developers more productive? Learn how PaaS can benefit your organization to help you streamline your application development, allow you to use existing infrastructure and improve operational efficiencies. Begin charting your path to PaaS with OpenShift Enterprise.
SYS-CON Events announced today that MobiDev, a software development company, will exhibit at the 17th International Cloud Expo®, which will take place November 3-5, 2015, at the Santa Clara Convention Center in Santa Clara, CA. MobiDev is a software development company with representative offices in Atlanta (US), Sheffield (UK) and Würzburg (Germany); and development centers in Ukraine. Since 2009 it has grown from a small group of passionate engineers and business managers to a full-scale mobi...
SYS-CON Events announced today that Agema Systems will exhibit at the 17th International Cloud Expo®, which will take place on November 3-5, 2015, at the Santa Clara Convention Center in Santa Clara, CA. Agema Systems is the leading provider of critical white-box rack solutions to data centers through the major integrators and value added distribution channels.
The cloud has reached mainstream IT. Those 18.7 million data centers out there (server closets to corporate data centers to colocation deployments) are moving to the cloud. In his session at 17th Cloud Expo, Achim Weiss, CEO & co-founder of ProfitBricks, will share how two companies – one in the U.S. and one in Germany – are achieving their goals with cloud infrastructure. More than a case study, he will share the details of how they prioritized their cloud computing infrastructure deployments ...
Data loss happens, even in the cloud. In fact, if your company has adopted a cloud application in the past three years, data loss has probably happened, whether you know it or not. In his session at 17th Cloud Expo, Bryan Forrester, Senior Vice President of Sales at eFolder, will present how common and costly cloud application data loss is and what measures you can take to protect your organization from data loss.
Organizations already struggle with the simple collection of data resulting from the proliferation of IoT, lacking the right infrastructure to manage it. They can't only rely on the cloud to collect and utilize this data because many applications still require dedicated infrastructure for security, redundancy, performance, etc. In his session at 17th Cloud Expo, Emil Sayegh, CEO of Codero Hosting, will discuss how in order to resolve the inherent issues, companies need to combine dedicated a...
The modern software development landscape consists of best practices and tools that allow teams to deliver software in a near-continuous manner. By adopting a culture of automation, measurement and sharing, the time to ship code has been greatly reduced, allowing for shorter release cycles and quicker feedback from customers and users. Still, with all of these tools and methods, how can teams stay on top of what is taking place across their infrastructure and codebase? Hopping between services a...
For almost two decades, businesses have discovered great opportunities to engage with customers and even expand revenue through digital systems, including web and mobile applications. Yet, even now, the conversation between the business and the technologists that deliver these systems is strained, in large part due to misaligned objectives. In his session at DevOps Summit, James Urquhart, Senior Vice President of Performance Analytics at SOASTA, Inc., will discuss how measuring user outcomes –...
Clearly the way forward is to move to cloud be it bare metal, VMs or containers. One aspect of the current public clouds that is slowing this cloud migration is cloud lock-in. Every cloud vendor is trying to make it very difficult to move out once a customer has chosen their cloud. In his session at 17th Cloud Expo, Naveen Nimmu, CEO of Clouber, Inc., will advocate that making the inter-cloud migration as simple as changing airlines would help the entire industry to quickly adopt the cloud wit...
Apps and devices shouldn't stop working when there's limited or no network connectivity. Learn how to bring data stored in a cloud database to the edge of the network (and back again) whenever an Internet connection is available. In his session at 17th Cloud Expo, Bradley Holt, Developer Advocate at IBM Cloud Data Services, will demonstrate techniques for replicating cloud databases with devices in order to build offline-first mobile or Internet of Things (IoT) apps that can provide a better, ...
SYS-CON Events announced today that VividCortex, the monitoring solution for the modern data system, will exhibit at the 17th International Cloud Expo®, which will take place on November 3–5, 2015, at the Santa Clara Convention Center in Santa Clara, CA. The database is the heart of most applications, but it’s also the part that’s hardest to scale, monitor, and optimize even as it’s growing 50% year over year. VividCortex is the first unified suite of database monitoring tools specifically desi...
“All our customers are looking at the cloud ecosystem as an important part of their overall product strategy. Some see it evolve as a multi-cloud / hybrid cloud strategy, while others are embracing all forms of cloud offerings like PaaS, IaaS and SaaS in their solutions,” noted Suhas Joshi, Vice President – Technology, at Harbinger Group, in this exclusive Q&A with Cloud Expo Conference Chair Roger Strukhoff.
SYS-CON Events announced today that Cloud Raxak has been named “Media & Session Sponsor” of SYS-CON's 17th Cloud Expo, which will take place on November 3–5, 2015, at the Santa Clara Convention Center in Santa Clara, CA. Raxak Protect automates security compliance across private and public clouds. Using the SaaS tool or managed service, developers can deploy cloud apps quickly, cost-effectively, and without error.
SYS-CON Events announced today that ProfitBricks, the provider of painless cloud infrastructure, will exhibit at SYS-CON's 17th International Cloud Expo®, which will take place on November 3–5, 2015, at the Santa Clara Convention Center in Santa Clara, CA. ProfitBricks is the IaaS provider that offers a painless cloud experience for all IT users, with no learning curve. ProfitBricks boasts flexible cloud servers and networking, an integrated Data Center Designer tool for visual control over the...
SYS-CON Events announced today that Key Information Systems, Inc. (KeyInfo), a leading cloud and infrastructure provider offering integrated solutions to enterprises, will exhibit at the 17th International Cloud Expo®, which will take place on November 3–5, 2015, at the Santa Clara Convention Center in Santa Clara, CA. Key Information Systems is a leading regional systems integrator with world-class compute, storage and networking solutions and professional services for the most advanced softwa...
SYS-CON Events announced today that IBM Cloud Data Services has been named “Bronze Sponsor” of SYS-CON's 17th Cloud Expo, which will take place on November 3–5, 2015, at the Santa Clara Convention Center in Santa Clara, CA. IBM Cloud Data Services offers a portfolio of integrated, best-of-breed cloud data services for developers focused on mobile computing and analytics use cases.
Learn how IoT, cloud, social networks and last but not least, humans, can be integrated into a seamless integration of cooperative organisms both cybernetic and biological. This has been enabled by recent advances in IoT device capabilities, messaging frameworks, presence and collaboration services, where devices can share information and make independent and human assisted decisions based upon social status from other entities. In his session at @ThingsExpo, Michael Heydt, founder of Seamless...
In recent years, at least 40% of companies using cloud applications have experienced data loss. One of the best prevention against cloud data loss is backing up your cloud data. In his General Session at 17th Cloud Expo, Bryan Forrester, Senior Vice President of Sales at eFolder, will present how organizations can use eFolder Cloudfinder to automate backups of cloud application data. He will also demonstrate how easy it is to search and restore cloud application data using Cloudfinder.
Cloud Foundry open Platform as a Service makes it easy to operate, scale and deploy application for your dedicated cloud environments. It enables developers and operators to be significantly more agile, writing great applications and deliver them in days instead of months. Cloud Foundry takes care of all the infrastructure and network plumbing that you need to build, run and operate your applications and can do this while patching and updating systems and services without any downtime.