Welcome!

@CloudExpo Authors: John Worthington, Liz McMillan, Stackify Blog, Elizabeth White, Pat Romanski

Related Topics: @CloudExpo, Microservices Expo, Containers Expo Blog, Cloud Security, @DXWorldExpo, SDN Journal

@CloudExpo: Article

Brass Tacks: Answering the Cloud Security Questions That Matter

Who is logging in? What is accessed? When was it changed? And more!

Enterprise security can be a labyrinthine, complex beast with many moving parts, dozen upon dozen of requirements, needs, implications, options and alternatives.

But when we get down to the nitty gritty (the brass tacks if you will), cloud security can be simplified by six simple questions:

WHO is logging in?

WHAT are they accessing/viewing?

WHERE is the device from which that person logs in?

WHEN was any asset changed/modified/moved

HOW are they authorized/credentialed?

WHAT is the impact of the event?

Now determining the answers to those questions might require a bit of coordination, but in terms of initiative and priority, it is the answers to the above questions that must drive any enterprise security initiative.

The concept of enterprise security is simple. Allow those who you want to see and access data in, and everyone else out. Of course the addendum to that is those that are on the “inside” cannot /should not distribute information outside the “Circle of Trust.” Now note I said the concept is simple. The application of those concepts is much more complex. It requires the coordination and integration of several features from several different solutions. If you are a CFO, I can see you rolling your eyes…how much is this going to cost (the answer is not as much as you think if deploying cloud-based solutions)?! If you are a CTO, I can hear that you’ve got it covered. If so, great, but there are thousands upon thousands of companies who don’t or only have a portion of the equation adequately addressed. And the biggest issue with the latter is that too many professionals mistakenly think their portion is doing the whole job.

In journalism class, I learned that the 5W’s and an H (who, what, when, where, why and how) are what every news story needs. Extrapolated, it’s what every enterprise security initiative needs as well.  If you can answer these questions, then you’re definitely on the right path to securing your assets as well as the privacy of your users. Yet, the key to answering these questions is having certain solutions and policies in place. Beyond that, you need those access management solutions and policies to “talk” to each other. It’s no longer good enough to have user provisioning if it doesn’t communicate with intrusion detection (SIEM/Log Management) or single sign on (access management). That brings us to our first question:

Who is logging in?: You can implement all industry standards, follow all regulatory frameworks and best practices, but if you're sloppy from the start with verifying identities, maintaining credentials or parsing the data,  then your security is no better than blind man’s bluff. Let’s say Ms. Jones leaves your employ. If you don’t have user provisioning, it may take days or weeks (if ever) to remove her permissions from network access protocols. Without intrusion detection, you’ll not know if she's trying to access her account after her employment relationship ends. But assume she's an honest person and that your company de-provisioned her accounts. It still doesn’t mean someone isn’t trying to breach using her credentials. How will you know? If an alert policy is set to notify someone when an attempt for access is tried against a dormant or retired account (or three failed log-in tries), you can immediately trace it to the IP source and remediate the issue.  Thing of it is, if you think whoever is attempting a breach is limited to just Ms. Jones’ former account, you’re sadly mistaken. By integrating single sign on, identity management and SIEM, you get to know exactly who is logging in (with a record for compliance) and those without the proper credentials are left on the outside looking in.

What are they accessing? Because a user provides the proper user name and password combo, shouldn’t give them keys to the entire kingdom. Think of what would happen if all the currency plates or gold reserves were held in the same building. Anyone with a key and a wheelbarrow could be wealthy beyond the dreams of avarice. The same needs to be considered for your IT assets, your proprietary sensitive data and personal information. What files, data and applications are necessary for a person to do their or job, place an order securely? Multi-authenticated access opens the door, but it is role-based provisioning that limits what they can see based on the needs of the person and the permission policies ascribed to them. Does shipping & receiving need human resource applications to send Product X to a customer?  In this scenario, integrating single sign on with identity management creates the necessary automation, but also creates the compliance information which is automatically compiled for reporting. That’s something I call Enterprise Access Control. The next step is ensuring the data is properly encrypted…but that‘s a blog for another day.

Where is the device? You want to know that the activity is coming from validated IP addresses. For example…Carl is your salesman and spent the night in a hotel in Wichita. He logged in and uploaded some expense reports. No problem. He had the right credentials. He accessed portions on the ERP that are based on his role permissions. Three hours later, Carl’s account is accessed again; had the right user name and password, but this time the SIEM system picks up that the IP address is coming from Romania. Well unless Carl has some superhuman power or used a Star Trek transporter, it isn’t him. With the significant rise in BYOD (tablets, iPhones, laptops, etc…), you need to make sure you know where the access is coming from. Without profiling, you know that certain areas of the globe are more likely to be engaged in hacking.

When was the asset changed? Much like “where,” when certain applications or data are accessed provides clues as to whether an event is suspicious or benign. By applying adaptive risk policies (predictive behavior protocols), you can plot when certain IP addresses log on.  Does it raise any red flags that attempts on certain accounts or applications are happening at 3 in the morning? In it of itself, probably not. But if you apply context from various data deposits, the picture becomes much clearer. If you are in Chicago, 3am is 9am in London. If you have customers or partners in London, there’s probably no cause for alarm. However, if the log on is to an application that a partner would have no need of, then the time of the attempt is very relevant. However, to correlate the appropriate context, your security functions need to be centralized and collaborating 24/7/365.

How are they credentialed? I’ve addressed roles-based user provisioning, application access restriction, but the last part of the policy is ensuring that multi-factored authentication is applied. In short, the best practice is to create security questions that cannot be easily found in any other digital forum (like birthdays, hire dates, names of family). The other half is to insist on strong passwords that include letters, numbers and symbols. Recognizing that a single password has a certain likelihood of being cracked, authenticating a user on two of these factors makes it one step harder for someone to exploit your system. Multi-factor authentication will make it substantially more difficult for an attacker to gain access but it’s certainly not going to stop a determined attacker. This is again why I insist on a layered and integrated security infrastructure.

What is the impact? Not all events require your IT SWAT team. Vulnerability scans using situational context allow you to separate the white noise and the everyday routine from suspicious events. Again it is the flow of data from various silos and applications that make it more security more effective and allow you to determine the threat level of any particular cluster of activity.

But the reality is that answering all the questions takes investment. Beyond dollars, it takes investment of time, resources, expertise and infrastructure. The overarching problem is not every company has that luxury or an excess of expenditures to apply against something that is looked upon as a cost center. If for no other reason than that, companies must look towards the cloud as a provider of security solutions. Cloud-based security can be seen as the great equalizer. Whether it is adding new capabilities or leveraging what you already have in house. It centralizes all the tools, all the expertise as a holistic security-as-a-service that broadens the reach and scope of enterprise monitoring, strengthens access authentication, and satisfies regulatory compliance. Because of the cost and resource savings It changes the dynamic for an initiative to performance rather than limited scope.

To answer all the questions posed above, the most important element a security initiative must have is visibility. Without coordinating/correlating the data acquired from independent security initiatives, you are wasting resources, potentially duplicating efforts and not necessarily seeing the whole picture.

If the application of security were simple, then everybody would recognize Superman was Clark Kent. Are you trying to tell me that a simple pair of glasses can fool everybody? So it really is all about context. You don’t expect to see Superman as Clark Kent, so you don’t. However if you centrally put all the information in context, then you would see the truth. That is why it remains ever so important to continue to ask the questions of your security initiative…who, what, where, when and how?

Kevin Nikkhoo

CloudAccess

More Stories By Kevin Nikkhoo

With more than 32 years of experience in information technology, and an extensive and successful entrepreneurial background, Kevin Nikkhoo is the CEO of the dynamic security-as-a-service startup Cloud Access. CloudAccess is at the forefront of the latest evolution of IT asset protection--the cloud.

Kevin holds a Bachelor of Science in Computer Engineering from McGill University, Master of Computer Engineering at California State University, Los Angeles, and an MBA from the University of Southern California with emphasis in entrepreneurial studies.

@CloudExpo Stories
"Cloud Academy is an enterprise training platform for the cloud, specifically public clouds. We offer guided learning experiences on AWS, Azure, Google Cloud and all the surrounding methodologies and technologies that you need to know and your teams need to know in order to leverage the full benefits of the cloud," explained Alex Brower, VP of Marketing at Cloud Academy, in this SYS-CON.tv interview at 21st Cloud Expo, held Oct 31 – Nov 2, 2017, at the Santa Clara Convention Center in Santa Clar...
In his session at 21st Cloud Expo, Carl J. Levine, Senior Technical Evangelist for NS1, will objectively discuss how DNS is used to solve Digital Transformation challenges in large SaaS applications, CDNs, AdTech platforms, and other demanding use cases. Carl J. Levine is the Senior Technical Evangelist for NS1. A veteran of the Internet Infrastructure space, he has over a decade of experience with startups, networking protocols and Internet infrastructure, combined with the unique ability to it...
While some developers care passionately about how data centers and clouds are architected, for most, it is only the end result that matters. To the majority of companies, technology exists to solve a business problem, and only delivers value when it is solving that problem. 2017 brings the mainstream adoption of containers for production workloads. In his session at 21st Cloud Expo, Ben McCormack, VP of Operations at Evernote, discussed how data centers of the future will be managed, how the p...
"NetApp is known as a data management leader but we do a lot more than just data management on-prem with the data centers of our customers. We're also big in the hybrid cloud," explained Wes Talbert, Principal Architect at NetApp, in this SYS-CON.tv interview at 21st Cloud Expo, held Oct 31 – Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA.
"We're focused on how to get some of the attributes that you would expect from an Amazon, Azure, Google, and doing that on-prem. We believe today that you can actually get those types of things done with certain architectures available in the market today," explained Steve Conner, VP of Sales at Cloudistics, in this SYS-CON.tv interview at 21st Cloud Expo, held Oct 31 – Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA.
"Space Monkey by Vivent Smart Home is a product that is a distributed cloud-based edge storage network. Vivent Smart Home, our parent company, is a smart home provider that places a lot of hard drives across homes in North America," explained JT Olds, Director of Engineering, and Brandon Crowfeather, Product Manager, at Vivint Smart Home, in this SYS-CON.tv interview at @ThingsExpo, held Oct 31 – Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA.
It is of utmost importance for the future success of WebRTC to ensure that interoperability is operational between web browsers and any WebRTC-compliant client. To be guaranteed as operational and effective, interoperability must be tested extensively by establishing WebRTC data and media connections between different web browsers running on different devices and operating systems. In his session at WebRTC Summit at @ThingsExpo, Dr. Alex Gouaillard, CEO and Founder of CoSMo Software, presented ...
Enterprises are adopting Kubernetes to accelerate the development and the delivery of cloud-native applications. However, sharing a Kubernetes cluster between members of the same team can be challenging. And, sharing clusters across multiple teams is even harder. Kubernetes offers several constructs to help implement segmentation and isolation. However, these primitives can be complex to understand and apply. As a result, it’s becoming common for enterprises to end up with several clusters. Thi...
"There's plenty of bandwidth out there but it's never in the right place. So what Cedexis does is uses data to work out the best pathways to get data from the origin to the person who wants to get it," explained Simon Jones, Evangelist and Head of Marketing at Cedexis, in this SYS-CON.tv interview at 21st Cloud Expo, held Oct 31 – Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA.
WebRTC is great technology to build your own communication tools. It will be even more exciting experience it with advanced devices, such as a 360 Camera, 360 microphone, and a depth sensor camera. In his session at @ThingsExpo, Masashi Ganeko, a manager at INFOCOM Corporation, introduced two experimental projects from his team and what they learned from them. "Shotoku Tamago" uses the robot audition software HARK to track speakers in 360 video of a remote party. "Virtual Teleport" uses a multip...
"We work around really protecting the confidentiality of information, and by doing so we've developed implementations of encryption through a patented process that is known as superencipherment," explained Richard Blech, CEO of Secure Channels Inc., in this SYS-CON.tv interview at 21st Cloud Expo, held Oct 31 – Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA.
High-velocity engineering teams are applying not only continuous delivery processes, but also lessons in experimentation from established leaders like Amazon, Netflix, and Facebook. These companies have made experimentation a foundation for their release processes, allowing them to try out major feature releases and redesigns within smaller groups before making them broadly available. In his session at 21st Cloud Expo, Brian Lucas, Senior Staff Engineer at Optimizely, discussed how by using ne...
The question before companies today is not whether to become intelligent, it’s a question of how and how fast. The key is to adopt and deploy an intelligent application strategy while simultaneously preparing to scale that intelligence. In her session at 21st Cloud Expo, Sangeeta Chakraborty, Chief Customer Officer at Ayasdi, provided a tactical framework to become a truly intelligent enterprise, including how to identify the right applications for AI, how to build a Center of Excellence to oper...
"IBM is really all in on blockchain. We take a look at sort of the history of blockchain ledger technologies. It started out with bitcoin, Ethereum, and IBM evaluated these particular blockchain technologies and found they were anonymous and permissionless and that many companies were looking for permissioned blockchain," stated René Bostic, Technical VP of the IBM Cloud Unit in North America, in this SYS-CON.tv interview at 21st Cloud Expo, held Oct 31 – Nov 2, 2017, at the Santa Clara Conventi...
In his session at 21st Cloud Expo, James Henry, Co-CEO/CTO of Calgary Scientific Inc., introduced you to the challenges, solutions and benefits of training AI systems to solve visual problems with an emphasis on improving AIs with continuous training in the field. He explored applications in several industries and discussed technologies that allow the deployment of advanced visualization solutions to the cloud.
Gemini is Yahoo’s native and search advertising platform. To ensure the quality of a complex distributed system that spans multiple products and components and across various desktop websites and mobile app and web experiences – both Yahoo owned and operated and third-party syndication (supply), with complex interaction with more than a billion users and numerous advertisers globally (demand) – it becomes imperative to automate a set of end-to-end tests 24x7 to detect bugs and regression. In th...
SYS-CON Events announced today that Telecom Reseller has been named “Media Sponsor” of SYS-CON's 22nd International Cloud Expo, which will take place on June 5-7, 2018, at the Javits Center in New York, NY. Telecom Reseller reports on Unified Communications, UCaaS, BPaaS for enterprise and SMBs. They report extensively on both customer premises based solutions such as IP-PBX as well as cloud based and hosted platforms.
"We're developing a software that is based on the cloud environment and we are providing those services to corporations and the general public," explained Seungmin Kim, CEO/CTO of SM Systems Inc., in this SYS-CON.tv interview at 21st Cloud Expo, held Oct 31 – Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA.
Enterprises are moving to the cloud faster than most of us in security expected. CIOs are going from 0 to 100 in cloud adoption and leaving security teams in the dust. Once cloud is part of an enterprise stack, it’s unclear who has responsibility for the protection of applications, services, and data. When cloud breaches occur, whether active compromise or a publicly accessible database, the blame must fall on both service providers and users. In his session at 21st Cloud Expo, Ben Johnson, C...
SYS-CON Events announced today that CrowdReviews.com has been named “Media Sponsor” of SYS-CON's 22nd International Cloud Expo, which will take place on June 5–7, 2018, at the Javits Center in New York City, NY. CrowdReviews.com is a transparent online platform for determining which products and services are the best based on the opinion of the crowd. The crowd consists of Internet users that have experienced products and services first-hand and have an interest in letting other potential buye...