Welcome!

Cloud Expo Authors: Elizabeth White, Carmen Gonzalez, JP Morgenthal, Liz McMillan, Pat Romanski

Related Topics: Cloud Expo, SOA & WOA, Virtualization, Security, Big Data Journal, SDN Journal

Cloud Expo: Article

Seven Causes of IT Security Paralysis & Cloud-Based Cures

From cost to complexity to covered to complacency; the excuses no longer hold up

Over and over again I am confronted with disturbing statistics on how risk is growing in disproportion to security readiness.

-91% of companies have experienced at least one IT security event from an external source.
-90% of all cyber crime costs are those caused by web attacks, malicious code and malicious insiders.
-40% reported rogue cloud issues (shadow IT) experienced the exposure of confidential information as a result
-34% share passwords with their co-workers for applications like FedEx, Twitter, Staples, LinkedIn.

These are real stats from studies by like Gartner, Forrester, Ponemon, Kaspersky, Eschelon and others. But there’s one stat that really curls my hair (what little of it is left).

  • Due to complexity, over 70% of organizations still not adequately securing critical systems.

Wow. It’s a staggering number. But it got me to thinking why. What is causing this universal security paralysis? Now I’m not proclaiming securipocolypse, but knowing what we now about the realities and fragility of an IT environment, I am a bit taken aback at the size of the issue.

I’ve broken it down into seven “excuses.” But rather than bemoaning the problem, I want to  rebut those excuses by promoting cloud-based answers.

  1. It’s expensive
  2. It’s time consuming
  3. It’s resource heavy
  4. There’s perceived imbalance in the risk/reward quotient
  5. We’ve got it covered
  6. We haven’t been attacked/complacency
  7. Expertise difficult to retain

Cost: There is no doubt many companies think that a fully integrated security program is going to force it to open its wallet. It is predominantly this reason alone that so many companies  ”get by” with what they have—be it malware or firewall protection, an email sniffer, or based on compliance requirements, whatever is the smallest investment to  get the alphabet soup of agencies off their back.

How cloud security overcomes the obstacle. It’s simple, really. More bang for the buck.  Using the ability to apply operation expenses over capital ones is a significant savings in itself. No expensive servers to buy, no software to maintain and watch depreciate, etc… More importantly is the realization that a company can incorporate a fully capable enterprise juggernaut for pennies on the dollar they would otherwise spend to manage on-premises. Most of us are already aware of the justifying benefits that cloud-based applications provide. I’ve gone on record before stating that for the amount a mid-size company currently pays in support and maintenance for their on-premise initiative, they can easily deploy a robust, fully integrated, fully-capable suite of enterprise-class security solutions from the cloud. The stumbling block here is the proof that such a deployment can adequately meet the specific needs of the unique company.  However by applying the 80/20 rule, by covering 80 percent of a company’s needs, it is more than likely well ahead of anything they are currently doing. Now on top of all that is all the professional services and consulting costs that ostensibly go away, or at least are tremendously reduced when managing from the cloud.

Time: There’s just never enough of it. Every IT pro I talk to wears many hats. They are installers, monitors, coders, patchers, reporters, developers, and a hundred other chapeau descriptors. And security in the modern enterprise needs to be a fully dedicated concern. Sure there are some companies that can afford this, but most can’t…it’s just another line of job description.

How cloud security overcomes the obstacle. Being proactive takes time. By applying security as a service, you remove any additional headcount. You can take the time that was dedicated to certain security functions and reprioritize them for core business functions. Also the fact that so many of the cloud security functions are automated—from self-service password management to HIPAA/PCI compliance reporting to role-based provisioning to correlated alert escalation— give rise to a surplus of  available resources.

Resources. In many companies this is the premium currency. And, in many companies resources are spread devastatingly thin. Whether we are talking human resources, financial resources, spatial resources, application/functional resources or knowledge resources, the ability to weigh and deploy the right amount of assets towards an issue, directly effects its successful management. In every company resources are finite and typically require hard decisions where best to position assets to ensure the smooth running of an enterprise. This is especially true when applied to security.

How cloud security overcomes the obstacle. Security managed from the cloud relieves a great deal of the resource overload. It provides the additional capabilities at a lesser cost. With this expanded functionality and potential, one can create greater awareness and better visibility across a larger scope of information. So not only are you expending less resources to secure many aspects of your enterprise, but it’s  ability to divine things faster and clearer provides a unique advantage to control a greater  scope of the IT environment. By leveraging and unifying these resources, you now know things that would have remained invisible. Therefore you gain the ability to make better decisions faster—giving you the ability to best marshal resources (minimizing costs and maximizing efficiencies) where they need to be.

Risk/Reward Imbalance. The expense of security does not necessarily pay for itself. It’s a cost center, right? But security must be perceived as more than a purchase of some software and the manpower to run reports. There are other factors to consider. The balance sheet doesn’t show the lost business because of lack of trust or poor security reputation. It doesn’t show the savings as it prevents proprietary secrets like sales databases walking away to the competition when an angry employee can gain access weeks after termination. It doesn’t show the fines and lost time when compliance isn’t met. But the big question is not that you apply a security measure or not. That point is moot, you simply have to. However the question CSOs and CIOs struggle with is how much? Where is the tipping point between peace of mind and overkill?

How cloud security overcomes the obstacle. The biggest reason for the risk-reward imbalance is typically the reasons noted already. It’s costly, it takes a certain percentage of manpower, and it’s complex. But if cloud-based security capabilities remove those obstacles, the balance starts tipping more heavily toward reward. If an organization can deploy a fully-integrated, unified security platform for what it is paying now for its current bits and pieces, AND have it properly monitored and analyzed without adding headcount, AND have it deployed to the company’s unique specifications and scale, then the conversation becomes about performance rather than scope; then the TCO drops and the ROI begins to climb.

Covered: Log management, by itself, won’t cut it. Neither will just web access control or firewall protection. In some cases, it may bring you up to the letter of the law with regard to compliance, but if security is like a house, the door is locked but all the windows are open. If you’re of the 30% who truly are properly secured, then stop reading. But if you are most companies, you really don’t have it covered. The excuse is simply code for I have other fires to put out, and it isn’t a large enough issue for me to raise it up on the priority scale. I should know, I use it as a default setting for most sales calls.

How cloud security overcomes the obstacle. Quick answer is a unified security deployment from the cloud allows you to fill in the gaps of where you currently are lacking. Not consistently monitoring? Check. Not controlling access to certain applications. Check. Not analyzing data and creating escalation alerts in real time? Check. It doesn’t have to be a replacement strategy—get rid of all the investment and hard work you’ve put into a certain systems, solutions, processes and tools. The beauty of the cloud is you can pick and choose the pieces you need easily and have them leverage any existing program. It is scalable, flexible and manageable.

Not attacked: Do you know that for sure? If you are not checking for termites, doesn’t mean your house isn’t infested. Those who think their organizations are too small or too unimportant for hackers to care are only seeing part of the picture. It’s common understanding that it is not an issue of ‘if” anymore, but a measure of “when.” an IT security event will occur. Still not convinced? Hackers are banking on this thought process to use these systems as stepping stones for larger fish. If your system is open and you connect to larger payment systems or applications, you are open to danger. Second, not every danger is some barbarian at the gate. Sometimes the threats (or carelessness) come from within. Again, check the stats. 91%. If you are part of the 9% who hasn’t been touched by an IT security event, I want to know what you’re doing right!

How cloud security overcomes the obstacle. Simply apply one of the free trials of any of the cloud-based SIEM solutions out there that monitor in real time and you will have your eyes opened into how much activity is pinging your system every day. I am fond of telling the story of a significant retailer who had thought they had a pretty good handle on what was going on in their environment. After our SIEM system had been monitoring intrusions and the like for just over a month, the results were starkly different than the client anticipated. It was more than triple the amount of negative activity they thought.

Lack of expertise: Finding the right person to deploy and manage a top notch security program is tough. Stats say (MSP Alliance) that unemployment for pros with these skills is less than 1%. And once you find them, they are expensive to recruit and keep. In fact their salaries have doubled over the past three years.

How cloud security overcomes the obstacle. Security as a service builds in the expertise required to monitor, analyze, and manage a strong security presence. Through this version of outsourcing, you not only save on the hard costs of salary, but the soft costs of training, ramp up, benefits, vacations, etc. Yet  more than the costs, is the propagation of continuous tribal knowledge of orchestrating, manipulating,  analyzing the vast amount of inbound data, and applying the right actions quickly and decisively to keep the IT landscape operating smoothly, in the confines of compliance and strategically viable. In the end, this is one of the most valuable assets cloud security offers.

There’s no longer an excuse to be part of that 70%!

 

Kevin Nikkhoo

www.cloudaccess.com

More Stories By Kevin Nikkhoo

With more than 32 years of experience in information technology, and an extensive and successful entrepreneurial background, Kevin Nikkhoo is the CEO of the dynamic security-as-a-service startup Cloud Access. CloudAccess is at the forefront of the latest evolution of IT asset protection--the cloud.

Kevin holds a Bachelor of Science in Computer Engineering from McGill University, Master of Computer Engineering at California State University, Los Angeles, and an MBA from the University of Southern California with emphasis in entrepreneurial studies.

@CloudExpo Stories
SYS-CON Events announced today that SOA Software, an API management leader, will exhibit at SYS-CON's 15th International Cloud Expo®, which will take place on November 4–6, 2014, at the Santa Clara Convention Center in Santa Clara, CA. SOA Software is a leading provider of API Management and SOA Governance products that equip business to deliver APIs and SOA together to drive their company to meet its business strategy quickly and effectively. SOA Software’s technology helps businesses to accel...
Almost everyone sees the potential of Internet of Things but how can businesses truly unlock that potential. The key will be in the ability to discover business insight in the midst of an ocean of Big Data generated from billions of embedded devices via Systems of Discover. Businesses will also need to ensure that they can sustain that insight by leveraging the cloud for global reach, scale and elasticity.
SYS-CON Events announced today that Utimaco will exhibit at SYS-CON's 15th International Cloud Expo®, which will take place on November 4–6, 2014, at the Santa Clara Convention Center in Santa Clara, CA. Utimaco is a leading manufacturer of hardware based security solutions that provide the root of trust to keep cryptographic keys safe, secure critical digital infrastructures and protect high value data assets. Only Utimaco delivers a general-purpose hardware security module (HSM) as a customiz...
How do APIs and IoT relate? The answer is not as simple as merely adding an API on top of a dumb device, but rather about understanding the architectural patterns for implementing an IoT fabric. There are typically two or three trends: Exposing the device to a management framework Exposing that management framework to a business centric logic • Exposing that business layer and data to end users. This last trend is the IoT stack, which involves a new shift in the separation of what stuff hap...
SYS-CON Events announced today that ElasticBox is holding a Hackathon at DevOps Summit, November 6 from 12 pm -4 pm at the Santa Clara Convention Center in Santa Clara, CA. You can enter as an individual or team of up to 10 developers. A New Star Is Born Every Month! All completed ElasticBoxes will then be sent to a judging panel - 12 winners will be featured on the ElasticBox website in 2015. All entrants will receive five full enterprise licenses for one year + ElasticBox headphones + Elasti...
Once the decision has been made to move part or all of a workload to the cloud, a methodology for selecting that workload needs to be established. How do you move to the cloud? What does the discovery, assessment and planning look like? What workloads make sense? Which cloud model makes sense for each workload? What are the considerations for how to select the right cloud model? And how does that fit in with the overall IT tranformation? In his session at 15th Cloud Expo, John Hatem, head of V...
Cloud services are the newest tool in the arsenal of IT products in the market today. These cloud services integrate process and tools. In order to use these products effectively, organizations must have a good understanding of themselves and their business requirements. In his session at 15th Cloud Expo, Brian Lewis, Principal Architect at Verizon Cloud, will outline key areas of organizational focus, and how to formalize an actionable plan when migrating applications and internal services to...
SAP is delivering break-through innovation combined with fantastic user experience powered by the market-leading in-memory technology, SAP HANA. In his General Session at 15th Cloud Expo, Thorsten Leiduck, VP ISVs & Digital Commerce, SAP, will discuss how SAP and partners provide cloud and hybrid cloud solutions as well as real-time Big Data offerings that help companies of all sizes and industries run better. SAP launched an application challenge to award the most innovative SAP HANA and SAP ...
Ixia develops amazing products so its customers can connect the world. Ixia helps its customers provide an always-on user experience through fast, secure delivery of dynamic connected technologies and services. Through actionable insights that accelerate and secure application and service delivery, Ixia's customers benefit from faster time to market, optimized application performance and higher-quality deployments.
SYS-CON Events announced today that Calm.io has been named “Bronze Sponsor” of DevOps Summit Silicon Valley, which will take place on November 4–6, 2014, at the Santa Clara Convention Center in Santa Clara, CA. Calm.io is a cloud orchestration platform for AWS, vCenter, OpenStack, or bare metal, that runs your CL tools puppet, Chef, shell, git, Jenkins, nagios, and will soon support New Relic and Docker. It can run hosted, or on premise and provides VM automation / expiry, self-service portals,...
In her General Session at 15th Cloud Expo, Anne Plese, Senior Consultant, Cloud Product Marketing, at Verizon Enterprise, will focus on finding the right mix of renting vs. buying Oracle capacity to scale to meet business demands, and offer validated Oracle database TCO models for Oracle development and testing environments. Anne Plese is a marketing and technology enthusiast/realist with over 19+ years in high tech. At Verizon Enterprise, she focuses on driving growth for the Verizon Cloud pla...
SYS-CON Events announced today that Aria Systems, the recurring revenue expert, has been named "Bronze Sponsor" of SYS-CON's 15th International Cloud Expo®, which will take place on November 4-6, 2014, at the Santa Clara Convention Center in Santa Clara, CA. Aria Systems helps leading businesses connect their customers with the products and services they love. Industry leaders like Pitney Bowes, Experian, AAA NCNU, VMware, HootSuite and many others choose Aria to power their recurring revenue bu...
The Internet of Things (IoT) is going to require a new way of thinking and of developing software for speed, security and innovation. This requires IT leaders to balance business as usual while anticipating for the next market and technology trends. Cloud provides the right IT asset portfolio to help today’s IT leaders manage the old and prepare for the new. Today the cloud conversation is evolving from private and public to hybrid. This session will provide use cases and insights to reinforce t...
As Platform as a Service (PaaS) matures as a category, developers should have the ability to use the programming language of their choice to build applications and have access to a wide array of services. Bluemix is IBM's open cloud development platform that enables users to easily build cloud-based, creative mobile and web applications without having to spend large amounts of time and resources on configuring infrastructure and multiple software licenses. In this track, you will learn about the...
Blue Box has closed a $10 million Series B financing. The round was led by a strategic investor and included participation from prior investors including Voyager Capital and Founders Collective, as well as the Blue Box executive team. This round follows a $4.3 million Series A closed in December of 2012 and led by Voyager Capital. In May of this year, the company announced general availability of its private cloud as a service offering, Blue Box Cloud. Since that release, the company has dem...
SYS-CON Events announced today that Verizon has been named "Gold Sponsor" of SYS-CON's 15th International Cloud Expo®, which will take place on November 4-6, 2014, at the Santa Clara Convention Center in Santa Clara, CA. Verizon Enterprise Solutions creates global connections that generate growth, drive business innovation and move society forward. With industry-specific solutions and a full range of global wholesale offerings provided over the company's secure mobility, cloud, strategic network...
SimpleECM is the only platform to offer a powerful combination of enterprise content management (ECM) services, capture solutions, and third-party business services providing simplified integrations and workflow development for solution providers. SimpleECM is opening the market to businesses of all sizes by reinventing the delivery of ECM services. Our APIs make the development of ECM services simple with the use of familiar technologies for a frictionless integration directly into web applicat...
The only place to be June 9-11 is Cloud Expo & @ThingsExpo 2015 East at the Javits Center in New York City. Join us there as delegates from all over the world come to listen to and engage with speakers & sponsors from the leading Cloud Computing, IoT & Big Data companies. Cloud Expo & @ThingsExpo are the leading events covering the booming market of Cloud Computing, IoT & Big Data for the enterprise. Speakers from all over the world will be hand-picked for their ability to explore the economic...
Cloudwick, the leading big data DevOps service and solution provider to the Fortune 1000, announced Big Loop, its multi-vendor operations platform. Cloudwick Big Loop creates greater collaboration between Fortune 1000 IT staff, developers and their database management systems as well as big data vendors. This allows customers to comprehensively manage and oversee their entire infrastructure, which leads to more successful production cluster operations, and scale-out. Cloudwick Big Loop supports ...
To manage complex web services with lots of calls to the cloud, many businesses have invested in Application Performance Management (APM) and Network Performance Management (NPM) tools. Together APM and NPM tools are essential aids in improving a business’s infrastructure required to support an effective web experience… but they are missing a critical component – Internet visibility. Internet connectivity has always played a role in customer access to web presence, but in the past few years use...