Welcome!

@CloudExpo Authors: Ed Featherston, Yeshim Deniz, Dalibor Siroky, Liz McMillan, Rostyslav Demush

Related Topics: @CloudExpo, Microservices Expo, Containers Expo Blog, Cloud Security, @DXWorldExpo, SDN Journal

@CloudExpo: Article

Brass Tacks: Answering the Cloud Security Questions That Matter

Who is logging in? What is accessed? When was it changed? And more!

Enterprise security can be a labyrinthine, complex beast with many moving parts, dozen upon dozen of requirements, needs, implications, options and alternatives.

But when we get down to the nitty gritty (the brass tacks if you will), cloud security can be simplified by six simple questions:

WHO is logging in?

WHAT are they accessing/viewing?

WHERE is the device from which that person logs in?

WHEN was any asset changed/modified/moved

HOW are they authorized/credentialed?

WHAT is the impact of the event?

Now determining the answers to those questions might require a bit of coordination, but in terms of initiative and priority, it is the answers to the above questions that must drive any enterprise security initiative.

The concept of enterprise security is simple. Allow those who you want to see and access data in, and everyone else out. Of course the addendum to that is those that are on the “inside” cannot /should not distribute information outside the “Circle of Trust.” Now note I said the concept is simple. The application of those concepts is much more complex. It requires the coordination and integration of several features from several different solutions. If you are a CFO, I can see you rolling your eyes…how much is this going to cost (the answer is not as much as you think if deploying cloud-based solutions)?! If you are a CTO, I can hear that you’ve got it covered. If so, great, but there are thousands upon thousands of companies who don’t or only have a portion of the equation adequately addressed. And the biggest issue with the latter is that too many professionals mistakenly think their portion is doing the whole job.

In journalism class, I learned that the 5W’s and an H (who, what, when, where, why and how) are what every news story needs. Extrapolated, it’s what every enterprise security initiative needs as well.  If you can answer these questions, then you’re definitely on the right path to securing your assets as well as the privacy of your users. Yet, the key to answering these questions is having certain solutions and policies in place. Beyond that, you need those access management solutions and policies to “talk” to each other. It’s no longer good enough to have user provisioning if it doesn’t communicate with intrusion detection (SIEM/Log Management) or single sign on (access management). That brings us to our first question:

Who is logging in?: You can implement all industry standards, follow all regulatory frameworks and best practices, but if you're sloppy from the start with verifying identities, maintaining credentials or parsing the data,  then your security is no better than blind man’s bluff. Let’s say Ms. Jones leaves your employ. If you don’t have user provisioning, it may take days or weeks (if ever) to remove her permissions from network access protocols. Without intrusion detection, you’ll not know if she's trying to access her account after her employment relationship ends. But assume she's an honest person and that your company de-provisioned her accounts. It still doesn’t mean someone isn’t trying to breach using her credentials. How will you know? If an alert policy is set to notify someone when an attempt for access is tried against a dormant or retired account (or three failed log-in tries), you can immediately trace it to the IP source and remediate the issue.  Thing of it is, if you think whoever is attempting a breach is limited to just Ms. Jones’ former account, you’re sadly mistaken. By integrating single sign on, identity management and SIEM, you get to know exactly who is logging in (with a record for compliance) and those without the proper credentials are left on the outside looking in.

What are they accessing? Because a user provides the proper user name and password combo, shouldn’t give them keys to the entire kingdom. Think of what would happen if all the currency plates or gold reserves were held in the same building. Anyone with a key and a wheelbarrow could be wealthy beyond the dreams of avarice. The same needs to be considered for your IT assets, your proprietary sensitive data and personal information. What files, data and applications are necessary for a person to do their or job, place an order securely? Multi-authenticated access opens the door, but it is role-based provisioning that limits what they can see based on the needs of the person and the permission policies ascribed to them. Does shipping & receiving need human resource applications to send Product X to a customer?  In this scenario, integrating single sign on with identity management creates the necessary automation, but also creates the compliance information which is automatically compiled for reporting. That’s something I call Enterprise Access Control. The next step is ensuring the data is properly encrypted…but that‘s a blog for another day.

Where is the device? You want to know that the activity is coming from validated IP addresses. For example…Carl is your salesman and spent the night in a hotel in Wichita. He logged in and uploaded some expense reports. No problem. He had the right credentials. He accessed portions on the ERP that are based on his role permissions. Three hours later, Carl’s account is accessed again; had the right user name and password, but this time the SIEM system picks up that the IP address is coming from Romania. Well unless Carl has some superhuman power or used a Star Trek transporter, it isn’t him. With the significant rise in BYOD (tablets, iPhones, laptops, etc…), you need to make sure you know where the access is coming from. Without profiling, you know that certain areas of the globe are more likely to be engaged in hacking.

When was the asset changed? Much like “where,” when certain applications or data are accessed provides clues as to whether an event is suspicious or benign. By applying adaptive risk policies (predictive behavior protocols), you can plot when certain IP addresses log on.  Does it raise any red flags that attempts on certain accounts or applications are happening at 3 in the morning? In it of itself, probably not. But if you apply context from various data deposits, the picture becomes much clearer. If you are in Chicago, 3am is 9am in London. If you have customers or partners in London, there’s probably no cause for alarm. However, if the log on is to an application that a partner would have no need of, then the time of the attempt is very relevant. However, to correlate the appropriate context, your security functions need to be centralized and collaborating 24/7/365.

How are they credentialed? I’ve addressed roles-based user provisioning, application access restriction, but the last part of the policy is ensuring that multi-factored authentication is applied. In short, the best practice is to create security questions that cannot be easily found in any other digital forum (like birthdays, hire dates, names of family). The other half is to insist on strong passwords that include letters, numbers and symbols. Recognizing that a single password has a certain likelihood of being cracked, authenticating a user on two of these factors makes it one step harder for someone to exploit your system. Multi-factor authentication will make it substantially more difficult for an attacker to gain access but it’s certainly not going to stop a determined attacker. This is again why I insist on a layered and integrated security infrastructure.

What is the impact? Not all events require your IT SWAT team. Vulnerability scans using situational context allow you to separate the white noise and the everyday routine from suspicious events. Again it is the flow of data from various silos and applications that make it more security more effective and allow you to determine the threat level of any particular cluster of activity.

But the reality is that answering all the questions takes investment. Beyond dollars, it takes investment of time, resources, expertise and infrastructure. The overarching problem is not every company has that luxury or an excess of expenditures to apply against something that is looked upon as a cost center. If for no other reason than that, companies must look towards the cloud as a provider of security solutions. Cloud-based security can be seen as the great equalizer. Whether it is adding new capabilities or leveraging what you already have in house. It centralizes all the tools, all the expertise as a holistic security-as-a-service that broadens the reach and scope of enterprise monitoring, strengthens access authentication, and satisfies regulatory compliance. Because of the cost and resource savings It changes the dynamic for an initiative to performance rather than limited scope.

To answer all the questions posed above, the most important element a security initiative must have is visibility. Without coordinating/correlating the data acquired from independent security initiatives, you are wasting resources, potentially duplicating efforts and not necessarily seeing the whole picture.

If the application of security were simple, then everybody would recognize Superman was Clark Kent. Are you trying to tell me that a simple pair of glasses can fool everybody? So it really is all about context. You don’t expect to see Superman as Clark Kent, so you don’t. However if you centrally put all the information in context, then you would see the truth. That is why it remains ever so important to continue to ask the questions of your security initiative…who, what, where, when and how?

Kevin Nikkhoo

CloudAccess

More Stories By Kevin Nikkhoo

With more than 32 years of experience in information technology, and an extensive and successful entrepreneurial background, Kevin Nikkhoo is the CEO of the dynamic security-as-a-service startup Cloud Access. CloudAccess is at the forefront of the latest evolution of IT asset protection--the cloud.

Kevin holds a Bachelor of Science in Computer Engineering from McGill University, Master of Computer Engineering at California State University, Los Angeles, and an MBA from the University of Southern California with emphasis in entrepreneurial studies.

@CloudExpo Stories
Blockchain. A day doesn’t seem to go by without seeing articles and discussions about the technology. According to PwC executive Seamus Cushley, approximately $1.4B has been invested in blockchain just last year. In Gartner’s recent hype cycle for emerging technologies, blockchain is approaching the peak. It is considered by Gartner as one of the ‘Key platform-enabling technologies to track.’ While there is a lot of ‘hype vs reality’ discussions going on, there is no arguing that blockchain is b...
In his keynote at 18th Cloud Expo, Andrew Keys, Co-Founder of ConsenSys Enterprise, provided an overview of the evolution of the Internet and the Database and the future of their combination – the Blockchain. Andrew Keys is Co-Founder of ConsenSys Enterprise. He comes to ConsenSys Enterprise with capital markets, technology and entrepreneurial experience. Previously, he worked for UBS investment bank in equities analysis. Later, he was responsible for the creation and distribution of life settle...
DevOps is under attack because developers don’t want to mess with infrastructure. They will happily own their code into production, but want to use platforms instead of raw automation. That’s changing the landscape that we understand as DevOps with both architecture concepts (CloudNative) and process redefinition (SRE). Rob Hirschfeld’s recent work in Kubernetes operations has led to the conclusion that containers and related platforms have changed the way we should be thinking about DevOps and...
The need for greater agility and scalability necessitated the digital transformation in the form of following equation: monolithic to microservices to serverless architecture (FaaS). To keep up with the cut-throat competition, the organisations need to update their technology stack to make software development their differentiating factor. Thus microservices architecture emerged as a potential method to provide development teams with greater flexibility and other advantages, such as the abili...
Product connectivity goes hand and hand these days with increased use of personal data. New IoT devices are becoming more personalized than ever before. In his session at 22nd Cloud Expo | DXWorld Expo, Nicolas Fierro, CEO of MIMIR Blockchain Solutions, will discuss how in order to protect your data and privacy, IoT applications need to embrace Blockchain technology for a new level of product security never before seen - or needed.
Leading companies, from the Global Fortune 500 to the smallest companies, are adopting hybrid cloud as the path to business advantage. Hybrid cloud depends on cloud services and on-premises infrastructure working in unison. Successful implementations require new levels of data mobility, enabled by an automated and seamless flow across on-premises and cloud resources. In his general session at 21st Cloud Expo, Greg Tevis, an IBM Storage Software Technical Strategist and Customer Solution Architec...
Coca-Cola’s Google powered digital signage system lays the groundwork for a more valuable connection between Coke and its customers. Digital signs pair software with high-resolution displays so that a message can be changed instantly based on what the operator wants to communicate or sell. In their Day 3 Keynote at 21st Cloud Expo, Greg Chambers, Global Group Director, Digital Innovation, Coca-Cola, and Vidya Nagarajan, a Senior Product Manager at Google, discussed how from store operations and ...
"As we've gone out into the public cloud we've seen that over time we may have lost a few things - we've lost control, we've given up cost to a certain extent, and then security, flexibility," explained Steve Conner, VP of Sales at Cloudistics,in this SYS-CON.tv interview at 20th Cloud Expo, held June 6-8, 2017, at the Javits Center in New York City, NY.
Blockchain is a shared, secure record of exchange that establishes trust, accountability and transparency across business networks. Supported by the Linux Foundation's open source, open-standards based Hyperledger Project, Blockchain has the potential to improve regulatory compliance, reduce cost as well as advance trade. Are you curious about how Blockchain is built for business? In her session at 21st Cloud Expo, René Bostic, Technical VP of the IBM Cloud Unit in North America, discussed the b...
The use of containers by developers -- and now increasingly IT operators -- has grown from infatuation to deep and abiding love. But as with any long-term affair, the honeymoon soon leads to needing to live well together ... and maybe even getting some relationship help along the way. And so it goes with container orchestration and automation solutions, which are rapidly emerging as the means to maintain the bliss between rapid container adoption and broad container use among multiple cloud host...
In his session at 21st Cloud Expo, Michael Burley, a Senior Business Development Executive in IT Services at NetApp, described how NetApp designed a three-year program of work to migrate 25PB of a major telco's enterprise data to a new STaaS platform, and then secured a long-term contract to manage and operate the platform. This significant program blended the best of NetApp’s solutions and services capabilities to enable this telco’s successful adoption of private cloud storage and launching ...
You know you need the cloud, but you’re hesitant to simply dump everything at Amazon since you know that not all workloads are suitable for cloud. You know that you want the kind of ease of use and scalability that you get with public cloud, but your applications are architected in a way that makes the public cloud a non-starter. You’re looking at private cloud solutions based on hyperconverged infrastructure, but you’re concerned with the limits inherent in those technologies.
Imagine if you will, a retail floor so densely packed with sensors that they can pick up the movements of insects scurrying across a store aisle. Or a component of a piece of factory equipment so well-instrumented that its digital twin provides resolution down to the micrometer.
"Since we launched LinuxONE we learned a lot from our customers. More than anything what they responded to were some very unique security capabilities that we have," explained Mark Figley, Director of LinuxONE Offerings at IBM, in this SYS-CON.tv interview at 21st Cloud Expo, held Oct 31 – Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA.
Is advanced scheduling in Kubernetes achievable?Yes, however, how do you properly accommodate every real-life scenario that a Kubernetes user might encounter? How do you leverage advanced scheduling techniques to shape and describe each scenario in easy-to-use rules and configurations? In his session at @DevOpsSummit at 21st Cloud Expo, Oleg Chunikhin, CTO at Kublr, answered these questions and demonstrated techniques for implementing advanced scheduling. For example, using spot instances and co...
A strange thing is happening along the way to the Internet of Things, namely far too many devices to work with and manage. It has become clear that we'll need much higher efficiency user experiences that can allow us to more easily and scalably work with the thousands of devices that will soon be in each of our lives. Enter the conversational interface revolution, combining bots we can literally talk with, gesture to, and even direct with our thoughts, with embedded artificial intelligence, whic...
Sanjeev Sharma Joins June 5-7, 2018 @DevOpsSummit at @Cloud Expo New York Faculty. Sanjeev Sharma is an internationally known DevOps and Cloud Transformation thought leader, technology executive, and author. Sanjeev's industry experience includes tenures as CTO, Technical Sales leader, and Cloud Architect leader. As an IBM Distinguished Engineer, Sanjeev is recognized at the highest levels of IBM's core of technical leaders.
As DevOps methodologies expand their reach across the enterprise, organizations face the daunting challenge of adapting related cloud strategies to ensure optimal alignment, from managing complexity to ensuring proper governance. How can culture, automation, legacy apps and even budget be reexamined to enable this ongoing shift within the modern software factory? In her Day 2 Keynote at @DevOpsSummit at 21st Cloud Expo, Aruna Ravichandran, VP, DevOps Solutions Marketing, CA Technologies, was jo...
While some developers care passionately about how data centers and clouds are architected, for most, it is only the end result that matters. To the majority of companies, technology exists to solve a business problem, and only delivers value when it is solving that problem. 2017 brings the mainstream adoption of containers for production workloads. In his session at 21st Cloud Expo, Ben McCormack, VP of Operations at Evernote, discussed how data centers of the future will be managed, how the p...
When shopping for a new data processing platform for IoT solutions, many development teams want to be able to test-drive options before making a choice. Yet when evaluating an IoT solution, it’s simply not feasible to do so at scale with physical devices. Building a sensor simulator is the next best choice; however, generating a realistic simulation at very high TPS with ease of configurability is a formidable challenge. When dealing with multiple application or transport protocols, you would be...