Welcome!

AJAX & REA Authors: Liz McMillan, Elizabeth White, David H Deans, Pat Romanski, Scott Hirsch

Related Topics: Cloud Expo, Java, SOA & WOA, Virtualization, Web 2.0, Security

Cloud Expo: Article

Deploying Cloud Security for Shifting and Evolving Defenses

Cloud offers agile and flexible defenses that consider situational context and real time management

A few weeks back I was watching my beloved San Diego Chargers lose in a most embarrassing way on Monday night. And in the waning seconds of blaming the quarterback for such ineffectual 2nd half play, it occurred to me, it wasn’t his fault.  It was the coach. It was the lack of planning for the type of attack the Denver Broncos would bring. It was the lack of leadership that should have easily closed the deal. In short, it was sticking to the status quo while everything around was changing.

My second epiphany was that this is a spot-on metaphor for the recent spate of bank hacks being levied by the hacktivist group Izz ad-Din al-Qassam. Not to make light of a serious issue, but the Charger collapse reminded me that the most insidious and effective attacks are not brute force in nature. In fact, most banks (according to compliance mandates) have decent processes to repel these attacks. In this case, the brutish DDoS (denial of service) was a feint to misdirect a smaller DDoS attack launched at the same time…and it was these more subtle attacks that were effective against 8 banks and counting. Continuing the football metaphor, it is like showing the blitz and falling back into tight pass defense resulting in the quarterback throwing an interception.

So the moral of the story is organizations need to evolve their security platforms to provide an agile shifting defense and change with the scenarios.

Now this is not to say the sky is falling, but a reputable IT security report noted a 50% increase in total number of DDoS attacks since Q2 of 2011 and a 10% increase since April. This means it’s time to look at your defensive processes and ensure they transcend compliance code. But moreso, to start anticipating what new threats, compliance requirements and business needs might be coming your way. You can’t be that guy who says “I’ll worry about it when I have to worry about it.” You simply can’t be paralyzed by the status quo. It’s a recipe for throwing 4 interceptions in the second half and squandering a 24 point lead.

We grouse a great deal about the burden of compliance, but they create a wall of protection that would otherwise create greater vulnerabilities. But all the audits, all the bureaucracy…it simply detracts from you being able to do the job you were hired to do. So the question begs, how do we evolve? How can we make security management easier yet stronger. Effective yet efficient. Agile yet layered? Proactive rather than reactive? If these questions are keeping you up at night, then it is time you took a deeper look at security-as-a-service or security managed from the cloud.

If you approach the security issue from the traditional sense of on-premise brick-building, server-stacking, resource-adding development, then yes, there are significantly costs in capital expenditures, human resources, and still not guaranteed that you have the necessary functionality, capability and visibility to anticipate tomorrow’s issues.

However…

By implementing a best-of-breed enterprise you gain a holistic view of what’s happening to your enterprise in real time. And because of the cloud computing advantages, the price point is very affordable (for what you are paying in support and maintenance, you could integrate an entire enterprise solution). You gain capability, you lessen expenses and, if your vendor also practices security as a service, your automated efficiencies come with 7/24/365 review of your logs by a live expert analyst.

But let’s put a real face on potential changes. Take FFIEC standards; very soon they will be more than guidelines. It's highly likely they will become compliance mandates. And they force you to address possible vulnerability gaps in your enterprise. Will you be prepared to meet the shifts in emphasis?

  • Layered security:

Most compliance-beholden organizations must recognize that security is not just about implementing virus scan and configuring firewalls. Ways and devices people reach your networks are changing quickly. Beyond log management protocols, you might need to add a SIEM or access management components. But the interpretation of layered security is choosing what is monitored and not relying on just a firewall to beat back possible intrusions, worms, phishing expeditions and user carelessness. You need multiple means, protocols and processes managed centrally.

  • Real-time, intelligence based assessment

There’s a saying in security circles: If you’ve noticed it, it’s already too late. The goal is to prevent, alert and remediate. And the only way to do this is through round the clock vigilance. Anything less than 24/7/365 monitoring opens the risk door too wide. It’s a cliché, but we are all acutely aware that hackers don’t sleep. But part of the question is not that monitoring is active, but how is it monitored? What data is collected? If you automate too much, you lose the human expertise; the context and the ability to respond effectively. Cloud-based security can cover a large enterprise or modest SMB with the same watchfulness while integrating the human intelligence assessment. Additionally, it provides additional resources, wider intelligence and greater coverage you don't have to fund.

  • Rapid adaptation against evolving threats

By applying a solution that uses real-time forensics including advanced correlations to examine for specific patterns, you create real time operational visibility. By recognizing traffic patterns correlated with a variety of other rules and processes you not only remove the false positive alerts, but can predict where your perimeter is soft and takes the necessary steps to shore them up.

  • Protect against ID and personal theft

Passwords are not enough. Time and again this has proven to be the weakest link. However, by instituting a solution that includes multi-credentialing, identity management, provisioning and the like, you can secure access to the most sensitive information. And if you make is easy for the user and minimize the impact of their usage experience, you take another step in maintaining the necessary trust while still ensuring people only see what they are supposed to see.

And all this can be deployed and managed from the cloud. The technology and security of these features has already matured to meet the concept.

These FFIEC guidelines seem very vague, but their meaning is clear: today’s operation needs to change. Not to keep up with the bureaucracy, but to improve the scalability, flexibility and control of an often volatile and fluid IT threatscape. However, don’t mistake this as a suggestion for mega-suite replacement. This should be part of any go-forward initiative that builds on or what is already in place. The cloud provides that agility to maintain an enterprise-powered security solution, yet adapt to the changing needs faster and more completely than most organizations can do on their own.

With that said, the best defense against an aggressive opponent is knowing what play is being called. Your holistic view gives you the ability to predict when the blitzes are coming, from what side, and most important, provide the flexibility to call an audible. One thing is for certain, you just can't stand still anymore; you can't rely on the status quo I just wish the Chargers saw that on Monday.

As an additional note, I participated in the development of a white paper for Fairway Technologies called , Get Your Head Into The Clouds! Industry Experts Answer Today’s Cloud Computing Questions ! Fairway’s collaborative new report not only examines the cloud computing issues that are dominating the industry, but also identifies key challenges behind cloud adoption and implementation, and presents best practices for organizations to develop and implement a sound cloud strategy. Guidance on cloud service brokers, open source cloud, data destruction, cloud bursting, and other topical issues are also discussed.

More Stories By Kevin Nikkhoo

With more than 32 years of experience in information technology, and an extensive and successful entrepreneurial background, Kevin Nikkhoo is the CEO of the dynamic security-as-a-service startup Cloud Access. CloudAccess is at the forefront of the latest evolution of IT asset protection--the cloud.

Kevin holds a Bachelor of Science in Computer Engineering from McGill University, Master of Computer Engineering at California State University, Los Angeles, and an MBA from the University of Southern California with emphasis in entrepreneurial studies.

@CloudExpo Stories
The definition of IoT is not new, in fact it’s been around for over a decade. What has changed is the public's awareness that the technology we use on a daily basis has caught up on the vision of an always on, always connected world. If you look into the details of what comprises the IoT, you’ll see that it includes everything from cloud computing, Big Data analytics, “Things,” Web communication, applications, network, storage, etc. It is essentially including everything connected online from ha...
We are all here because we are sold on the transformative promise of The Cloud. But what good is all of this ephemeral, on-demand infrastructure if your usage doesn't actually improve the agility and speed of your business? How must Operations adapt in order to avoid stifling your Cloud initiative? In his session at DevOps Summit, Damon Edwards, co-founder and managing partner of the DTO Solutions, will highlight the successful organizational, process, and tooling patterns of high-performing c...
Software-driven innovation is becoming a primary approach to how businesses create and deliver new value to customers. A survey of 400 business and IT executives by the IBM Institute for Business Value showed businesses that are more effective at software delivery are also more profitable than their peers nearly 70 percent of the time (1). DevOps provides a way for businesses to remain competitive, applying lean and agile principles to software development to speed the delivery of software that ...
Docker offers a new, lightweight approach to application portability. Applications are shipped using a common container format and managed with a high-level API. Their processes run within isolated namespaces that abstract the operating environment independently of the distribution, versions, network setup, and other details of this environment. This "containerization" has often been nicknamed "the new virtualization." But containers are more than lightweight virtual machines. Beyond their small...
The move in recent years to cloud computing services and architectures has added significant pace to the application development and deployment environment. When enterprise IT can spin up large computing instances in just minutes, developers can also design and deploy in small time frames that were unimaginable a few years ago. The consequent move toward lean, agile, and fast development leads to the need for the development and operations sides to work very closely together. Thus, DevOps become...
Cloud Expo 2014 TV commercials will feature @ThingsExpo, which was launched in June, 2014 at New York City's Javits Center as the largest 'Internet of Things' event in the world.

ARMONK, N.Y., Nov. 20, 2014 /PRNewswire/ --  IBM (NYSE: IBM) today announced that it is bringing a greater level of control, security and flexibility to cloud-based application development and delivery with a single-tenant version of Bluemix, IBM's

An entirely new security model is needed for the Internet of Things, or is it? Can we save some old and tested controls for this new and different environment? In his session at @ThingsExpo, New York's at the Javits Center, Davi Ottenheimer, EMC Senior Director of Trust, reviewed hands-on lessons with IoT devices and reveal a new risk balance you might not expect. Davi Ottenheimer, EMC Senior Director of Trust, has more than nineteen years' experience managing global security operations and asse...
The major cloud platforms defy a simple, side-by-side analysis. Each of the major IaaS public-cloud platforms offers their own unique strengths and functionality. Options for on-site private cloud are diverse as well, and must be designed and deployed while taking existing legacy architecture and infrastructure into account. Then the reality is that most enterprises are embarking on a hybrid cloud strategy and programs. In this Power Panel at 15th Cloud Expo (http://www.CloudComputingExpo.com...
Explosive growth in connected devices. Enormous amounts of data for collection and analysis. Critical use of data for split-second decision making and actionable information. All three are factors in making the Internet of Things a reality. Yet, any one factor would have an IT organization pondering its infrastructure strategy. How should your organization enhance its IT framework to enable an Internet of Things implementation? In his session at Internet of @ThingsExpo, James Kirkland, Chief Ar...
Leysin American School is an exclusive, private boarding school located in Leysin, Switzerland. Leysin selected an OpenStack-powered, private cloud as a service to manage multiple applications and provide development environments for students across the institution. Seeking to meet rigid data sovereignty and data integrity requirements while offering flexible, on-demand cloud resources to users, Leysin identified OpenStack as the clear choice to round out the school's cloud strategy. Additional...
Technology is enabling a new approach to collecting and using data. This approach, commonly referred to as the "Internet of Things" (IoT), enables businesses to use real-time data from all sorts of things including machines, devices and sensors to make better decisions, improve customer service, and lower the risk in the creation of new revenue opportunities. In his General Session at Internet of @ThingsExpo, Dave Wagstaff, Vice President and Chief Architect at BSQUARE Corporation, discuss the ...
The security devil is always in the details of the attack: the ones you've endured, the ones you prepare yourself to fend off, and the ones that, you fear, will catch you completely unaware and defenseless. The Internet of Things (IoT) is nothing if not an endless proliferation of details. It's the vision of a world in which continuous Internet connectivity and addressability is embedded into a growing range of human artifacts, into the natural world, and even into our smartphones, appliances, a...
"BSQUARE is in the business of selling software solutions for smart connected devices. It's obvious that IoT has moved from being a technology to being a fundamental part of business, and in the last 18 months people have said let's figure out how to do it and let's put some focus on it, " explained Dave Wagstaff, VP & Chief Architect, at BSQUARE Corporation, in this SYS-CON.tv interview at @ThingsExpo, held Nov 4-6, 2014, at the Santa Clara Convention Center in Santa Clara, CA.
The 4th International DevOps Summit, co-located with16th International Cloud Expo – being held June 9-11, 2015, at the Javits Center in New York City, NY – announces that its Call for Papers is now open. Born out of proven success in agile development, cloud computing, and process automation, DevOps is a macro trend you cannot afford to miss. From showcase success stories from early adopters and web-scale businesses, DevOps is expanding to organizations of all sizes, including the world's large...
Verizon Enterprise Solutions is simplifying the cloud-purchasing experience for its clients, with the launch of Verizon Cloud Marketplace, a key foundational component of the company's robust ecosystem of enterprise-class technologies. The online storefront will initially feature pre-built cloud-based services from AppDynamics, Hitachi Data Systems, Juniper Networks, PfSense and Tervela. Available globally to enterprises using Verizon Cloud, Verizon Cloud Marketplace provides a one-stop shop fo...
"Our premise is Docker is not enough. That's not a bad thing - we actually love Docker. At ActiveState all our products are based on open source technology and Docker is an up-and-coming piece of open source technology," explained Bart Copeland, President & CEO of ActiveState Software, in this SYS-CON.tv interview at DevOps Summit at Cloud Expo®, held Nov 4-6, 2014, at the Santa Clara Convention Center in Santa Clara, CA.
DevOps Summit 2015 New York, co-located with the 16th International Cloud Expo - to be held June 9-11, 2015, at the Javits Center in New York City, NY - announces that it is now accepting Keynote Proposals. The widespread success of cloud computing is driving the DevOps revolution in enterprise IT. Now as never before, development teams must communicate and collaborate in a dynamic, 24/7/365 environment. There is no time to wait for long development cycles that produce software that is obsolete...
What do a firewall and a fortress have in common? They are no longer strong enough to protect the valuables housed inside. Like the walls of an old fortress, the cracks in the firewall are allowing the bad guys to slip in - unannounced and unnoticed. By the time these thieves get in, the damage is already done and the network is already compromised. Intellectual property is easily slipped out the back door leaving no trace of forced entry. If we want to reign in on these cybercriminals, it's hig...
Infor has announced a new feature Infor CloudSuite™ Aerospace & Defense (A&D) to aid compliance with International Traffic in Arms Regulations (ITAR). The ITAR function will serve as a complementary function for new or existing Infor CloudSuite A&D customers, to facilitate compliance for Infor customers that are creating a US defense article or performing a US defense service and wish to benefit from cloud-services. The ITAR regulation serves to manage handling and access requirements for dat...