@CloudExpo Authors: Pat Romanski, Zakia Bouachraoui, Yeshim Deniz, Liz McMillan, Jason Bloomberg

Related Topics: @CloudExpo, Microservices Expo, Containers Expo Blog, Cloud Security, @DXWorldExpo, SDN Journal

@CloudExpo: Article

Erasing the Identity Blind Spot

Using collaborative, integtated ID and Access create key visibility

Security is not an all-or-nothing proposition. And that’s part of the problem. It creates blind spots; gaps in vulnerability. Partly because of the inherent complacency that after a company institutes a new security initiative that hackers will be held at bay, or the employees won’t be tempted to make off with a database or a hundred other internal or external threats.

I have long promoted that security is as much about planning and process as it is about the various solutions that are deployed to protect networks, data, and other assets.

Security is no longer a wall. Stick up a firewall and your customer/user data won’t get leaked. Actually it’s more like a sandwich.  And good security initiatives are like a good Dagwood sandwich - layered and integrated. But even the best sandwiches have holes (if they didn’t, you’d be eating a brick).

So, just as you wouldn’t eat the bread, then eat the meat, then the cheese, and then dip your fingers in the mustard, you shouldn’t deploy firewalls in parallel with intrusion detection, identity management, access management, etc…  The key term here is in “parallel.” As part of your strategic planning, you must recognize that although each has a certain and important function, if they are simply working in parallel and not collaboratively, you are creating significant blind spots.

To illustrate I want to focus on a typical internal threat of unregulated user access.  What happens when employees use web access to process corporate data, including on their own devices? This issue is more than just updating sales call results via salesforce.com or logging in to social media to post about an upcoming promotion. It’s about control and maintaining the control of the IT environment.

With so much data shared beyond the traditional firewall, cloud identity management (credentialing and authorization) is a good starting point, but if you simply allow users a means to enter the castle, what they do once inside still creates risk. Strong identity management not only provides the credentialing gatekeeper (user name, passwords), but must apply use roles-based provisioning to further segment users. In earlier blogs I’ve discussed how not all users are created equal and therefore should not be allowed generic universal access. To further mix my metaphors, think of it like a hotel. Only guests are allowed passed a certain point-and each has access to their own personal space. But only certain guests are allowed into premium areas such as spas or penthouse rooms. The same is true for users and the assets on your extended network.

It is important to recognize that every single user has a unique relationship to your IT environment. Employees, partners, customers, etc… each have their own agenda and their own needs. Credentialing gets them in the door. Provisioning gets them a proverbial room in the hotel. But as mentioned earlier on, that still leaves blind spots. The next obvious step is to integrate access management (single sign on) that automatically leverages roles based provisioning.

By having a single-sign on portal based off of an Active Directory or LDAP controlled identity manager does two things. It provides access to only the relevant applications that a user might need based on their role. Marketing would not see the MySQL apps, Research would not get ADP. However they might need to access Workday or Concur to help manage their timecards. But their identity limits them to just their responsibility (or if they run a department, their subordinates as well). The second provision is that access management can also control non-SAML based (Security Assertion Markup  Language) applications and websites. Not every application is cloud SaaS these days. Upwards of 85% of all applications are non-SAML based (including the legacy application sitting on your server right now!), but still require the same protections. Now you still need SAML, or OAuth or Liberty federation for some applications (especially SaaS that contains sensitive data like GoogleApps or Office365, but to get maximum benefit from integrate IDM/AM you need to incorporate all the apps.

For instance, take Wordpress. It requires a user name and password. It’s not federated via SAML. Although you may not be sharing state secrets on your blog site, it still can be hijacked for disreputable purposes, or be used as a gateway to gain entry into the network. Putting it under the protection of single sign on (under the provisioned protection of identity management), the passwords are secure and the access is limited to only those who need to see it on a user-centric portal. And practically every legacy application is the same way (do you still have MSOffice 2007 on each workstation?).

This plays into two camps of benefit. One is based on productivity and accountability; but that’s on the user (or at least the user’s boss!). To the IT administrator it is all about regaining and maintaining control; not just who gets to see what, but when and how (and leaving the necessary information trail to remediate issues or provide compliance reporting). But in terms of covering those blind spots, you cover all the application (or intranets) directly controlled on your servers, all your SaaS and web-based apps, and all relevant websites.  You now have the visibility to know Rodney from business development is certainly spending a lot of time on Facebook. But if we take this coverage to next logical level and truly erase blind spots, you should think of unifying IDM/AM with other security initiatives such as real time intrusion detection and event archiving as well. That way the visibility extends to knowing when Rodney is logging on and if it is truly him; whether he is using assets at the office, at home or on the road---or if it is someone spoofing his account from an IP address in Outer Mongolia.

There are obviously a great many benefits of an integrated identity and access management deployment, especially when managed from the cloud (security as a service). The cost, the resources, the expanded enterprise capabilities alone make it quite attractive and highly manageable for a SMB or mid-sized company. The CBS Morning Show just did a story on how smaller companies are now squarely in the sights of hackers because of the lower security barriers. The kind of initiative I have described above is typically based on one or the other enterprise solution being on premise (very expensive!). However, evolution and revolution from the cloud is currently available and ready to leverage and collaborate with any existing security plan. (I should know, right?)

Obviously the cure to removing blind spots is better visibility. Better visibility can only be achieved when you can see the entire playing field in front of you. And that can only be achieved when you security solutions work together. And now that is a fast and attainable achievement from the cloud.

Kevin Nikkhoo
Who is now craving a Dagwood sandwich

More Stories By Kevin Nikkhoo

With more than 32 years of experience in information technology, and an extensive and successful entrepreneurial background, Kevin Nikkhoo is the CEO of the dynamic security-as-a-service startup Cloud Access. CloudAccess is at the forefront of the latest evolution of IT asset protection--the cloud.

Kevin holds a Bachelor of Science in Computer Engineering from McGill University, Master of Computer Engineering at California State University, Los Angeles, and an MBA from the University of Southern California with emphasis in entrepreneurial studies.

CloudEXPO Stories
Headquartered in Plainsboro, NJ, Synametrics Technologies has provided IT professionals and computer systems developers since 1997. Based on the success of their initial product offerings (WinSQL and DeltaCopy), the company continues to create and hone innovative products that help its customers get more from their computer applications, databases and infrastructure. To date, over one million users around the world have chosen Synametrics solutions to help power their accelerated business or personal computing needs.
All in Mobile is a place where we continually maximize their impact by fostering understanding, empathy, insights, creativity and joy. They believe that a truly useful and desirable mobile app doesn't need the brightest idea or the most advanced technology. A great product begins with understanding people. It's easy to think that customers will love your app, but can you justify it? They make sure your final app is something that users truly want and need. The only way to do this is by researching target group and involving users in the designing process.
Digital Transformation and Disruption, Amazon Style - What You Can Learn. Chris Kocher is a co-founder of Grey Heron, a management and strategic marketing consulting firm. He has 25+ years in both strategic and hands-on operating experience helping executives and investors build revenues and shareholder value. He has consulted with over 130 companies on innovating with new business models, product strategies and monetization. Chris has held management positions at HP and Symantec in addition to advisory roles at startups. He has worked extensively on monetization, SAAS, IoT, ecosystems, partnerships and accelerating growth in new business initiatives.
Whenever a new technology hits the high points of hype, everyone starts talking about it like it will solve all their business problems. Blockchain is one of those technologies. According to Gartner's latest report on the hype cycle of emerging technologies, blockchain has just passed the peak of their hype cycle curve. If you read the news articles about it, one would think it has taken over the technology world. No disruptive technology is without its challenges and potential impediments that frequently get lost in the hype. The panel will discuss their perspective on what they see as they key challenges and/or impediments to adoption, and how they see those issues could be resolved or mitigated.
Lori MacVittie is a subject matter expert on emerging technology responsible for outbound evangelism across F5's entire product suite. MacVittie has extensive development and technical architecture experience in both high-tech and enterprise organizations, in addition to network and systems administration expertise. Prior to joining F5, MacVittie was an award-winning technology editor at Network Computing Magazine where she evaluated and tested application-focused technologies including app security and encryption-related solutions. She holds a B.S. in Information and Computing Science from the University of Wisconsin at Green Bay, and an M.S. in Computer Science from Nova Southeastern University, and is an O'Reilly author.