Welcome!

@CloudExpo Authors: Stackify Blog, Elizabeth White, Liz McMillan, Pat Romanski, Harry Trott

Related Topics: @CloudExpo, Agile Computing, Cloud Security

@CloudExpo: Article

When Compliance Comes Down to Security | @CloudExpo #Cloud #Security

The top three regulations and how you can prepare

In the business world, it's hard to throw a rock without hitting a compliance requirement. All must be obeyed, but some call for a high level of control and auditability. Governing bodies are exerting their authority like never before, increasing the number of auditors and handing out heavy fines - sometimes as much as $1 million.

This has become the new norm, and it isn't likely to turn around any time soon. It's important, then, to be aware of the primary threats that could undermine compliance efforts. The top three such issues are discussed below.

The Challenges of SOX
Public companies in the U.S. as well as foreign companies listed on U.S. exchanges are required by Sarbanes-Oxley (SOX) to assess their internal controls, have that assessment validated by an external auditor and report the assessment to the SEC. Information security professionals need to ensure that their organization complies with requirement in Section 302 and Section 404 of the legislation.

For the financial industry, SOX-404 and internal controls remain the most critical on the compliance horizon. Financial industry compliance challenges include Annual Financial and SSAE-16 audit requirements. However, audits of identity management (logical access) controls continue to result in exceptions. Companies struggle with adherence to privileged access controls - lack of visibility into what, when and how administrators access production environments.

SSH keys are a critical component for ensuring adequate and compliant controls for cardholder data environments. However, many organizations have no visibility into or assume compliance with their SSH key environments until an auditor identifies the issue or exception in their reports. SSH is one of those unseen workhorses in IT infrastructures, which is why it is also referred to as the "dark side" of PCI DSS compliance.

Financial institutions have expanded their business models beyond simply doing payroll, tax, investments, etc. They have taken on additional services to expand their markets and revenue potential. These vary from complete HR services to retirement services to medical payment services and much more. But changing industry business models change the threat landscape and expand the definition of sensitive information. Their protected data definitions now go beyond SSN and DOB to also include credit card data and medical data (protected health information). This increases the complexity of their compliance initiatives and the scrutiny of the audits they start to undergo.

Managing Privileged Access
The privileged and logical access controls within privileged access management (PAM) will continue to be a compliance nightmare. They cause the most audit infractions. One of the main reasons for this is the fact that more companies are outsourcing tech support, and more companies are employing remote workers. Both of these groups must be granted remote access to an organization's production environment and highly sensitive information in order to do their jobs. This access also includes machines talking to other machines in an automated fashion.

Enterprises must grant third-party access to a variety of vendors and contractors, but managing this access often comes as an afterthought in the organization's overall security strategies and postures. The 2014 U.S. State of Cybercrime Survey revealed some dangerous trends on this topic:

  • Seventy percent of enterprises enter into contracts with external vendors without having conducted any security checks
  • Only 44 percent of enterprises put forth the effort to vet the security of third-party providers and others in their IT supply chain

Better security and privacy controls may be supported by third-party and vendor contract agreements, but these actions may not exclude organizations from accountability and responsibility as it relates to a security breach.

HIPAA HITECH
If SOX-404 were a cat, HIPAA/HITECH would be a lion in comparison. Organizations may have to comply with PCI, FISMA, SOX, BASEL III or other regulations, but none of these are a match for the HIPAA/HITECH tidal wave in terms of severity. The U.S. federal government (Health and Human Services, Office for Civil Rights) is more active than ever in enforcing this law and is levying harsher fines with greater frequency for noncompliance.

Regulatory bodies have kept track of the areas that healthcare providers have failed at most often in the past, and auditors are concentrating their firepower in those areas and are levying massive fines for noncompliance. Targeted areas include:

  • Risk analysis and risk management
  • Content and timeliness of breach notifications
  • Notice of privacy practices
  • Individual access
  • Training to policies and procedures
  • Device and media controls
  • Transmission security

As enterprises branch out into new markets, they will need to exercise caution regarding whether those markets are covered by HIPAA and whether they are being compliant to avoid being hit with heavy fines.

Compliance via SSH Security
With so many regulations to keep in mind and so many financial and legal risks, the following best practices can help enterprises improve their SSH environment security - and, therefore, their compliance.

1. No more manual key management
If you insist on manually managing keys, you are relegating your highly skilled IT staff to the mental equivalent of drudgery. A centralized SSH key management system not only ameliorates the issues listed above, it increases your ROI by letting your IT staff tackle more complicated issues.

2. Take control of your SSH key deployment
While most SSH key deployments are straightforward, rotation and removal can be tricky. Control who can add keys to your environment, and deploy, remove and rotate keys in a centralized way. Sometimes a rotated key can create a new vulnerability. This encourages the tendency to leave a key in place long after its original user has moved on. Automate SSH key rotation.

3. Take inventory to understand your environment
You will need to find out how many SSH keys you have, where they are and which users have which keys. Once you understand your environment, you can take steps to tame it.

4. The ability to audit in real time
Lest you end up on the wrong side of a SOX audit, your auditors need to be able to view the source of any breach clearly and perform an audit trail. Make sure your organization has a system in place to provide auditors with exactly the information they need, when they need it.

The Whole Compliance Package
With penalties as high as a million dollars, organizations cannot afford to not be compliant. As they consider compliance risks across their business, they need to honestly assess whether they could survive an audit. Continuous compliance should become the goal, facilitated by security and privacy controls interwoven into day-to-day processes and procedures. When the inevitable breach does occur, having integrated security controls in place will go a long way toward both ensuring compliance with reporting requirements and expedite breach investigations.

More Stories By Fouad Khalil

Fouad Khalil is VP of Compliance at SSH Communication Security with extensive experience in the technology space with more than 25 years spanning disciplines in software development, IT support, program and project management and most recently IT Security and Compliance management. He has come up the technology ladder his entire career from network, system and database administration, software programming, system, software and GUI design, project and product development, solution implementation and much more.

He has been an active member in ISACA, IIA and Infragard for over ten (10) years and an active contributor to ISSA and ISC2 regionally and nationwide. He is CISA and ITIL Foundations certified.

Comments (0)

Share your thoughts on this story.

Add your comment
You must be signed in to add a comment. Sign-in | Register

In accordance with our Comment Policy, we encourage comments that are on topic, relevant and to-the-point. We will remove comments that include profanity, personal attacks, racial slurs, threats of violence, or other inappropriate material that violates our Terms and Conditions, and will block users who make repeated violations. We ask all readers to expect diversity of opinion and to treat one another with dignity and respect.


@CloudExpo Stories
There is only one world-class Cloud event on earth, and that is Cloud Expo – which returns to Silicon Valley for the 21st Cloud Expo at the Santa Clara Convention Center, October 31 - November 2, 2017. Every Global 2000 enterprise in the world is now integrating cloud computing in some form into its IT development and operations. Midsize and small businesses are also migrating to the cloud in increasing numbers. Companies are each developing their unique mix of cloud technologies and service...
SYS-CON Events announced today that Golden Gate University will exhibit at SYS-CON's 21st International Cloud Expo®, which will take place on Oct 31 – Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA. Since 1901, non-profit Golden Gate University (GGU) has been helping adults achieve their professional goals by providing high quality, practice-based undergraduate and graduate educational programs in law, taxation, business and related professions. Many of its courses are taug...
@DevOpsSummit at Cloud Expo taking place Oct 31 - Nov 2, 2017, at the Santa Clara Convention Center, Santa Clara, CA, is co-located with the 21st International Cloud Expo and will feature technical sessions from a rock star conference faculty and the leading industry players in the world. The widespread success of cloud computing is driving the DevOps revolution in enterprise IT. Now as never before, development teams must communicate and collaborate in a dynamic, 24/7/365 environment. There is ...
DevOps at Cloud Expo, taking place October 31 - November 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA, is co-located with 21st Cloud Expo and will feature technical sessions from a rock star conference faculty and the leading industry players in the world. The widespread success of cloud computing is driving the DevOps revolution in enterprise IT. Now as never before, development teams must communicate and collaborate in a dynamic, 24/7/365 environment. There is no time to w...
SYS-CON Events announced today that DXWorldExpo has been named “Global Sponsor” of SYS-CON's 21st International Cloud Expo, which will take place on Oct 31 – Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA. Digital Transformation is the key issue driving the global enterprise IT business. Digital Transformation is most prominent among Global 2000 enterprises and government institutions.
SYS-CON Events announced today that Grape Up will exhibit at SYS-CON's 21st International Cloud Expo®, which will take place on Oct. 31 – Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA. Grape Up is a software company specializing in cloud native application development and professional services related to Cloud Foundry PaaS. With five expert teams that operate in various sectors of the market across the U.S. and Europe, Grape Up works with a variety of customers from emergi...
With Cloud Foundry you can easily deploy and use apps utilizing websocket technology, but not everybody realizes that scaling them out is not that trivial. In his session at 21st Cloud Expo, Roman Swoszowski, CTO and VP, Cloud Foundry Services, at Grape Up, will show you an example of how to deal with this issue. He will demonstrate a cloud-native Spring Boot app running in Cloud Foundry and communicating with clients over websocket protocol that can be easily scaled horizontally and coordinate...
21st International Cloud Expo, taking place October 31 - November 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA, will feature technical sessions from a rock star conference faculty and the leading industry players in the world. Cloud computing is now being embraced by a majority of enterprises of all sizes. Yesterday's debate about public vs. private has transformed into the reality of hybrid cloud: a recent survey shows that 74% of enterprises have a hybrid cloud strategy. Me...
The question before companies today is not whether to become intelligent, it’s a question of how and how fast. The key is to adopt and deploy an intelligent application strategy while simultaneously preparing to scale that intelligence. In her session at 21st Cloud Expo, Sangeeta Chakraborty, Chief Customer Officer at Ayasdi, will provide a tactical framework to become a truly intelligent enterprise, including how to identify the right applications for AI, how to build a Center of Excellence to...
From 2013, NTT Communications has been providing cPaaS service, SkyWay. Its customer’s expectations for leveraging WebRTC technology are not only typical real-time communication use cases such as Web conference, remote education, but also IoT use cases such as remote camera monitoring, smart-glass, and robotic. Because of this, NTT Communications has numerous IoT business use-cases that its customers are developing on top of PaaS. WebRTC will lead IoT businesses to be more innovative and address...
In his session at 20th Cloud Expo, Scott Davis, CTO of Embotics, discussed how automation can provide the dynamic management required to cost-effectively deliver microservices and container solutions at scale. He also discussed how flexible automation is the key to effectively bridging and seamlessly coordinating both IT and developer needs for component orchestration across disparate clouds – an increasingly important requirement at today’s multi-cloud enterprise.
DevOps at Cloud Expo, taking place October 31 - November 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA, is co-located with 21st Cloud Expo and will feature technical sessions from a rock star conference faculty and the leading industry players in the world. The widespread success of cloud computing is driving the DevOps revolution in enterprise IT. Now as never before, development teams must communicate and collaborate in a dynamic, 24/7/365 environment. There is no time to w...
Recently, WebRTC has a lot of eyes from market. The use cases of WebRTC are expanding - video chat, online education, online health care etc. Not only for human-to-human communication, but also IoT use cases such as machine to human use cases can be seen recently. One of the typical use-case is remote camera monitoring. With WebRTC, people can have interoperability and flexibility for deploying monitoring service. However, the benefit of WebRTC for IoT is not only its convenience and interopera...
Vulnerability management is vital for large companies that need to secure containers across thousands of hosts, but many struggle to understand how exposed they are when they discover a new high security vulnerability. In his session at 21st Cloud Expo, John Morello, CTO of Twistlock, will address this pressing concern by introducing the concept of the “Vulnerability Risk Tree API,” which brings all the data together in a simple REST endpoint, allowing companies to easily grasp the severity of t...
Any startup has to have a clear go –to-market strategy from the beginning. Similarly, any data science project has to have a go to production strategy from its first days, so it could go beyond proof-of-concept. Machine learning and artificial intelligence in production would result in hundreds of training pipelines and machine learning models that are continuously revised by teams of data scientists and seamlessly connected with web applications for tenants and users.
Connecting to major cloud service providers is becoming central to doing business. But your cloud provider’s performance is only as good as your connectivity solution. Massive Networks will place you in the driver's seat by exposing how you can extend your LAN from any location to include any cloud platform through an advanced high-performance connection that is secure and dedicated to your business-critical data. In his session at 21st Cloud Expo, Paul Mako, CEO & CIO of Massive Networks, wil...
When shopping for a new data processing platform for IoT solutions, many development teams want to be able to test-drive options before making a choice. Yet when evaluating an IoT solution, it’s simply not feasible to do so at scale with physical devices. Building a sensor simulator is the next best choice; however, generating a realistic simulation at very high TPS with ease of configurability is a formidable challenge. When dealing with multiple application or transport protocols, you would be...
IT organizations are moving to the cloud in hopes to approve efficiency, increase agility and save money. Migrating workloads might seem like a simple task, but what many businesses don’t realize is that application migration criteria differs across organizations, making it difficult for architects to arrive at an accurate TCO number. In his session at 21st Cloud Expo, Joe Kinsella, CTO of CloudHealth Technologies, will offer a systematic approach to understanding the TCO of a cloud application...
"With Digital Experience Monitoring what used to be a simple visit to a web page has exploded into app on phones, data from social media feeds, competitive benchmarking - these are all components that are only available because of some type of digital asset," explained Leo Vasiliou, Director of Web Performance Engineering at Catchpoint Systems, in this SYS-CON.tv interview at DevOps Summit at 20th Cloud Expo, held June 6-8, 2017, at the Javits Center in New York City, NY.
SYS-CON Events announced today that Secure Channels, a cybersecurity firm, will exhibit at SYS-CON's 21st International Cloud Expo®, which will take place on Oct 31 – Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA. Secure Channels, Inc. offers several products and solutions to its many clients, helping them protect critical data from being compromised and access to computer networks from the unauthorized. The company develops comprehensive data encryption security strategie...