Welcome!

@CloudExpo Authors: Elizabeth White, Mike Wood, Rajeev Kozhikkattuthodi, Yeshim Deniz, Liz McMillan

Related Topics: @CloudExpo, Cloud Security, @DevOpsSummit

@CloudExpo: Blog Feed Post

Peeling the Layers of the Cloud Security Onion By @Skytap | @CloudExpo [#Cloud]

To ensure you’re properly assessing a vendor, use an industry standard framework

​Peeling Back the Layers of the Cloud Security Onion

I had the chance to sit down with Lee Slaughter, Skytap's Manager of Information Security, to discuss security in the cloud, the efforts that make up a thorough due diligence when choosing a cloud provider, and how to keep up with external and internal threats to your business.

Noel: Last year, Charles Babcock wrote a piece for InformationWeek on the list of the top 9 worst cloud security threats that was put out by the Cloud Security Alliance. As I read through them, I noticed that the threats were predominantly related to malicious insiders and outsiders, data breaches, denial of service attacks, etc.

One of the listed threats (#8) was "insufficient due diligence." That's...obviously a really important one. What are some of the ways that an organization looking for a cloud services provider can make sure they do their own due diligence, and are there any areas that are often or easier overlooked?

Lee: Due diligence of a cloud vendor should be an extension of the security risk assessment program that is internal to your organization. First, you must scope and classify the vendor's service(s) according to the value of the asset you're looking to outsource. The value of the asset directly correlates to the amount of scrutiny that is placed on the assessment.

For example, you're looking for cloud vendors that could host your SaaS web site. Let's say that this site is mission critical for your organization because it delivers your product to your customers. It's so important that you're requiring a 99.9% uptime on that site, because you can calculate the unbelievable dollar amount that is lost when the site goes down, even for minutes. What assurances can those vendors give you that they can live up to the 99.9% uptime SLA that they signed up to provide?

To ensure you're properly assessing a vendor, use an industry standard framework. You most likely have some sort of standard that you certify or align to, so you can use the same for this purpose. ISO27k or NIST are very commonly used frameworks. Ask your vendor if they certify or align to these, and ensure their security certifications are scoped to protect the things relevant to you and your systems or data that reside in their cloud. If the vendor only aligns to these standards, ask for more details.  Other factors that determine level of scrutiny include the laws and/or regulations that you are obligated to follow. Make sure you're not violating any of these obligations by putting this asset in the cloud.

Noel: This list of threats, like most warnings regarding the cloud, brings up both the good and the bad of "Shadow IT." You've mentioned that "there's a balance between enabling your employees to be happy and agile, and locking things down as much as possible." This seems like another area where a thorough due diligence period has to be taken seriously, but what else have you seen be effective in combatting Shadow IT from getting out of control/visibility.

Lee: Security management/staff require a good understanding of the business and should have enough visibility into the organization to know what product/services will be offered in the future. Questions such as, "Does a law/regulation require us to do this in a certain way?" or "What happens if someone gets unauthorized access to this system?" should be asked. Determine the threshold for control of a system or data based on its value. If the value of an asset is at the top of your scale, then your controls around that system/data should leave no room for shadow IT.

Noel: I think one of the reasons that people fear or are reluctant to embrace cloud technologies is the widespread front page news that hacks/breaches/leaks tend to make. We've seen the impacts that these attacks and/or oversights can have, and a recent study showed that "15% of logins for business apps used by organizations had been breached by hackers." Where would you say the fault often lies in these breaches? The cloud provider is likely quick to be blamed when the app itself was hacked, but what are some other potential, or even likely reasons that should be considered when investigating the security hole or failure?

Lee: As for fault in the 15% of breached logins, that depends. Cloud companies, who have been hacked and login credentials were stolen in usable form, are 100% at fault. By "usable form", I mean credentials that were NOT hashed and salted. Security should be practiced in many layers, often called the "security onion." If a company has a breach in outer area(s), the exposure should be limited. Many companies have what I call the M&M model of security...the hard coating that protects the outside, but nice and soft in the middle...meaning they don't have those necessary internal controls for prevention or detection of a breach.

Other reasons for breached logins would have nothing to do with the vendor at all. Unsuspecting users quite often fall for phishing scams that result in the bad guys getting the login credentials. Additionally, with so many apps and sites that require usernames and passwords, users typically re-use passwords and/or usernames. If one vendor with failing security controls allows an attacker to obtain those credentials, there's a good chance that those same credentials can be used for other apps/sites. This is where a password manager can come in handy to enable the use of different passwords for all of your apps but without having to remember all of them.

Noel: That same study said, "A quarter of all files in cloud storage apps are shared with one or more people outside of the organization." This reminds me of one of the areas of Skytap that I've always thought was really cool - the ability to only share certain data with teams that truly need it.

For instance, not exposing production data and environments with test/QA teams, instead, providing them with relevant mock test data. The production data never even enters the cloud. What ways can security teams ensure that controls are not just established, but monitored and maintained in regards to sensitive data?

Lee: This goes back to the risk assessment I discussed earlier. When certain data or systems are deemed to be of the highest sensitivity, you must rely on the features available through your cloud vendor to ensure you're addressing every possible risk that you identify during the assessment.

To ensure that controls are monitored and continuously improved, you must create a security program around those controls. This requires that you have a series of defined standards and procedures on the right way to do things. A defined, mature, control leaves no room for ambiguity in the steps that are taken to ensure security of data or systems. The controls should be monitored for any deviation of expected outcome and tweaked for improvement as necessary.

Noel: You often hear or read about how hackers are often "one step ahead" of software security, but that seems like somewhat of a negative assumption. How are you, and Skytap's other security-minded pros, utilizing the latest technology or even just forward-thinking strategies to combat this assumption that the cloud will always be risky business?

Lee: I'm actually in that camp as well. Hackers are and will always be one step ahead. Hackers get their foot in the door by tricking users and/or using a vulnerability to gain access. There will ALWAYS be at least one user that clicks that malicious link within an email and there will ALWAYS be zero-day vulnerabilities that are not foreseen or preventable. The security industry is shifting to doing more than the old ways of doing things - harden the outside and buy technology and implement processes for prevention of breaches. The shift is now to how fast can you detect and react to a breach. We all still need to do the things we've been doing, while increasing our focus on incident detection and response.

Want to know more about how Skytap addresses security and compliance? Click here to learn how our extensive security measures make Skytap enterprise-ready!

Read the original blog entry...

More Stories By Skytap Blog

Author: Noel Wurst is the managing content editor at Skytap. Skytap provides SaaS-based dev/test environments to the enterprise. Skytap solution removes the inefficiencies and constraints that companies have within their software development lifecycle. As a result, customers release better software faster. In this blog, we publish engaging, thought provoking stories that revolve around agile enterprise applications and cloud-based development and testing.

@CloudExpo Stories
The Internet giants are fully embracing AI. All the services they offer to their customers are aimed at drawing a map of the world with the data they get. The AIs from these companies are used to build disruptive approaches that cannot be used by established enterprises, which are threatened by these disruptions. However, most leaders underestimate the effect this will have on their businesses. In his session at 21st Cloud Expo, Rene Buest, Director Market Research & Technology Evangelism at Ara...
It is ironic, but perhaps not unexpected, that many organizations who want the benefits of using an Agile approach to deliver software use a waterfall approach to adopting Agile practices: they form plans, they set milestones, and they measure progress by how many teams they have engaged. Old habits die hard, but like most waterfall software projects, most waterfall-style Agile adoption efforts fail to produce the results desired. The problem is that to get the results they want, they have to ch...
Cloud Expo, Inc. has announced today that Andi Mann and Aruna Ravichandran have been named Co-Chairs of @DevOpsSummit at Cloud Expo Silicon Valley which will take place Oct. 31-Nov. 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA. "DevOps is at the intersection of technology and business-optimizing tools, organizations and processes to bring measurable improvements in productivity and profitability," said Aruna Ravichandran, vice president, DevOps product and solutions marketing...
"Loom is applying artificial intelligence and machine learning into the entire log analysis process, from start to finish and at the end you will get a human touch,” explained Sabo Taylor Diab, Vice President, Marketing at Loom Systems, in this SYS-CON.tv interview at 20th Cloud Expo, held June 6-8, 2017, at the Javits Center in New York City, NY.
Wooed by the promise of faster innovation, lower TCO, and greater agility, businesses of every shape and size have embraced the cloud at every layer of the IT stack – from apps to file sharing to infrastructure. The typical organization currently uses more than a dozen sanctioned cloud apps and will shift more than half of all workloads to the cloud by 2018. Such cloud investments have delivered measurable benefits. But they’ve also resulted in some unintended side-effects: complexity and risk. ...
"We are a monitoring company. We work with Salesforce, BBC, and quite a few other big logos. We basically provide monitoring for them, structure for their cloud services and we fit into the DevOps world" explained David Gildeh, Co-founder and CEO of Outlyer, in this SYS-CON.tv interview at DevOps Summit at 20th Cloud Expo, held June 6-8, 2017, at the Javits Center in New York City, NY.
With major technology companies and startups seriously embracing Cloud strategies, now is the perfect time to attend 21st Cloud Expo October 31 - November 2, 2017, at the Santa Clara Convention Center, CA, and June 12-14, 2018, at the Javits Center in New York City, NY, and learn what is going on, contribute to the discussions, and ensure that your enterprise is on the right path to Digital Transformation.
21st International Cloud Expo, taking place October 31 - November 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA, will feature technical sessions from a rock star conference faculty and the leading industry players in the world. Cloud computing is now being embraced by a majority of enterprises of all sizes. Yesterday's debate about public vs. private has transformed into the reality of hybrid cloud: a recent survey shows that 74% of enterprises have a hybrid cloud strategy. Me...
SYS-CON Events announced today that Enzu will exhibit at SYS-CON's 21st Int\ernational Cloud Expo®, which will take place October 31-November 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA. Enzu’s mission is to be the leading provider of enterprise cloud solutions worldwide. Enzu enables online businesses to use its IT infrastructure to their competitive advantage. By offering a suite of proven hosting and management services, Enzu wants companies to focus on the core of their ...
DevOps at Cloud Expo, taking place October 31 - November 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA, is co-located with 21st Cloud Expo and will feature technical sessions from a rock star conference faculty and the leading industry players in the world. The widespread success of cloud computing is driving the DevOps revolution in enterprise IT. Now as never before, development teams must communicate and collaborate in a dynamic, 24/7/365 environment. There is no time to w...
In 2014, Amazon announced a new form of compute called Lambda. We didn't know it at the time, but this represented a fundamental shift in what we expect from cloud computing. Now, all of the major cloud computing vendors want to take part in this disruptive technology. In his session at 20th Cloud Expo, Doug Vanderweide, an instructor at Linux Academy, discussed why major players like AWS, Microsoft Azure, IBM Bluemix, and Google Cloud Platform are all trying to sidestep VMs and containers wit...
With major technology companies and startups seriously embracing Cloud strategies, now is the perfect time to attend 21st Cloud Expo October 31 - November 2, 2017, at the Santa Clara Convention Center, CA, and June 12-14, 2018, at the Javits Center in New York City, NY, and learn what is going on, contribute to the discussions, and ensure that your enterprise is on the right path to Digital Transformation.
Internet of @ThingsExpo, taking place October 31 - November 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA, is co-located with 21st Cloud Expo and will feature technical sessions from a rock star conference faculty and the leading industry players in the world. The Internet of Things (IoT) is the most profound change in personal and enterprise IT since the creation of the Worldwide Web more than 20 years ago. All major researchers estimate there will be tens of billions devic...
Amazon started as an online bookseller 20 years ago. Since then, it has evolved into a technology juggernaut that has disrupted multiple markets and industries and touches many aspects of our lives. It is a relentless technology and business model innovator driving disruption throughout numerous ecosystems. Amazon’s AWS revenues alone are approaching $16B a year making it one of the largest IT companies in the world. With dominant offerings in Cloud, IoT, eCommerce, Big Data, AI, Digital Assista...
The taxi industry never saw Uber coming. Startups are a threat to incumbents like never before, and a major enabler for startups is that they are instantly “cloud ready.” If innovation moves at the pace of IT, then your company is in trouble. Why? Because your data center will not keep up with frenetic pace AWS, Microsoft and Google are rolling out new capabilities. In his session at 20th Cloud Expo, Don Browning, VP of Cloud Architecture at Turner, posited that disruption is inevitable for comp...
SYS-CON Events announced today that Cloud Academy named "Bronze Sponsor" of 21st International Cloud Expo which will take place October 31 - November 2, 2017 at the Santa Clara Convention Center in Santa Clara, CA. Cloud Academy is the industry’s most innovative, vendor-neutral cloud technology training platform. Cloud Academy provides continuous learning solutions for individuals and enterprise teams for Amazon Web Services, Microsoft Azure, Google Cloud Platform, and the most popular cloud com...
For organizations that have amassed large sums of software complexity, taking a microservices approach is the first step toward DevOps and continuous improvement / development. Integrating system-level analysis with microservices makes it easier to change and add functionality to applications at any time without the increase of risk. Before you start big transformation projects or a cloud migration, make sure these changes won’t take down your entire organization.
When growing capacity and power in the data center, the architectural trade-offs between server scale-up vs. scale-out continue to be debated. Both approaches are valid: scale-out adds multiple, smaller servers running in a distributed computing model, while scale-up adds fewer, more powerful servers that are capable of running larger workloads. It’s worth noting that there are additional, unique advantages that scale-up architectures offer. One big advantage is large memory and compute capacity...
"When we talk about cloud without compromise what we're talking about is that when people think about 'I need the flexibility of the cloud' - it's the ability to create applications and run them in a cloud environment that's far more flexible,” explained Matthew Finnie, CTO of Interoute, in this SYS-CON.tv interview at 20th Cloud Expo, held June 6-8, 2017, at the Javits Center in New York City, NY.
No hype cycles or predictions of zillions of things here. IoT is big. You get it. You know your business and have great ideas for a business transformation strategy. What comes next? Time to make it happen. In his session at @ThingsExpo, Jay Mason, Associate Partner at M&S Consulting, presented a step-by-step plan to develop your technology implementation strategy. He discussed the evaluation of communication standards and IoT messaging protocols, data analytics considerations, edge-to-cloud tec...