Thoughts From the Cloud @cloudaccesssecurity-blog - Tumblr Blog

Posts

They say the whole is greater than the sum of its parts. And that is the core of unified security;take the most important parts of a security program (SIEM, Log Archiving and Monitoring, Identity and Access Management and Single Sign On),& centralize and combine their capabilities to generate real time answers to the most important enterprise IT questions - See more at: http://www.cloudaccess.com <

CloudAccess is honored to be included in NetworkWorld‘s list of products of the week. CloudIAM was included as part of the September 16, 2013 presentation.

The only cloud-managed multi-tenant enterprise-class security offering currently on the market that promotes seamless out-of-the-box integration between identity management, access management and single-sign-on. Provides functionality to securely administer identity creation, maintain real-time provisioning/deprovisioning, streamline compliance reporting and enforce access control.

- See more at: http://www.cloudaccess.com/featured_articles/networkworld-names-cloudaccess-idaas-sso-product-of-the-week/#!

In a recent article, I discuss a new strategy that encourages organizations to expand existing on-premise identity management capabilities and access management controls by utilizing the agility of an IDaaS solution to augment permissions, rights and workflow for cloud-based apps.

The idea is that by recognizing the budget and resource hurdles in continually adding and updating new apps to an already dense and expensive system, the cloud creates a seamless and streamline means to keep up with all the compounding variables (user types, SaaS and web applications and access preferences). This is not a parallel security strategy, but one that integrates with the incumbent process. An IDaaS augmentation provides a cost-effective, ready-to-deploy, enterprise-class option to consolidate these variables and improve operational efficiencies, strengthen compliance and enhance access control.

Security is as much about transference as it is about blocking-integrated identity and access management can be more effective when properly synchronized

Many hackers see law firms as soft targets. In fact BusinessWeek sees them as an easier access back door to their clients confidential information. Law firms are not bound by the same compliance issues to which their clients must adhere...but they often contain information just as sensitive and in need of protection. Typically, law firms are late adopters of new technology--especially those affecting infrastructure. Why? Law firms zero in on their core competencies and that doesn't leave enough resources to address IT. Cloud security address risks for firms w/ strict budgets & limited resources

This blog attempts to explain the differences between Identity Management and Access management using the famous Star Trek episode of Mirror Mirror. There are many who do not differentiate between ID and AM (especially from the cloud). They solve similar but separate issues (one is administrative, one is applicative), but both serve as a cornerstone of an integrated cloud-based security initiative.

Making Compliance Easier: Mapping Requirements to an Integrated Cloud Security Platform

Regulatory compliance remains a critical and strategic business need for most companies. And, the issues are clear. The layers of IT security necessary to address the myriad of audits, reports and processes are typically expensive. The expense is not limited to the technology applications and solutions, but to personnel, consulting, expertise retention, and resources. These requirements tax operational resources, reduce the ability to focus on core competencies or force reassessment on IT asset prioritization. - See more at: http://www.cloudaccess.com/featured_articles/making-compliance-easier-a-new-white-paper/#sthash.nEZfs3HR.dpuf

Identity-As-A-Service (IDaaS) is more important than ever

Conspiracy theorists and other concerned citizens will insist the government is watching every keystroke, keeping a record of every website, transaction, text and email. Shades of 1984’s Big Brother, right? These last few weeks, the news has been brimming with revelations of data surveillance and monitoring by the government (not to mention data harvesting corporations like Google, Yahoo, Facebook etc…). Everyone is sensitive as to what is being looked at, stored, and analyzed for hazily defined purposes. Privacy is no longer as private as you think; and hasn’t been for many years.

Politics, ethics and debates over 4th amendment interpretation aside (as they serve no useful purpose in this analysis), a question was asked on one the security forums that in light of these alleged breaches of trust, whether cloud security-and more specifically, identity-as-a-service (IDaaS) is still a feasible and trustworthy option?

Short answer: of course it is. In fact, I will contend it is more important than ever.

Privacy and identity protection, in this case, are like apples and oranges. The concept that confidential corporate information or trade secrets could be at risk may be valid, but not because cloud-based security functions are either in collusion with data collectors or of less veracity than an on-premise deployment. Security, especially surrounding identity, is about context through correlation. IDaaS provides this in a more egalitarian way than the on-premise variety. If privacy advocates are yelling that the sky is falling, identities serviced from the cloud have little to do with the current state of distrust. Why? Because it’s about process and not where a server with identity data happens to reside.

Identity as a service is component of a larger layered security strategy. Its primary responsibility is administrative in terms of creating user credentials and assigning them to certain buckets of permission. This provisioning is based on the role of user serves within an organization. Departments or divisions see one sliver, partners see another, customers another—each only is permitted to access just what they need. IDaaS also manages password and their synchronization across the enterprise as well as coordinates the federated connections between certain applications. It is Access Management (SaaS and web single sign on, multi-factor authorization) that enforces the rules set forth in identity management.

In terms of infrastructure, all the collection and correlation happens in the cloud. But so does so much of any company’s business process and activities. Insulating all the functions within a network firewall is no longer a feasible. Not only is it expensive, complex and requires a certain degree of expertise resources, but in the grander scheme, based on the habits and needs of a variable and interactive workforce, this bunker approach is unsustainable and counter-productive towards a modern commercial model. This is true even for larger organizations with considerable capital resources. But think of it like a person with a cache of gold. There are two options…he can hide it under his bed, hire armed guards at his door, and deploy an army of laser-wielding dachshunds…or he can make a deposit at the bank. Yes, the money is out of his sight, but he still retains control and gets the added value of the bank’s steel vault.

But you say, how can you personally assure the security of data (and by extension, privacy) if its custody lie in the cloud? First, don’t mistake cloud security for security in the cloud. Major difference…one is a solution set whose sole purpose is to make certain enterprise class security is actively protecting assets based on a client’s business needs (this is the slot IDaaS falls into). The other is an application that happens to use the cloud to collect and apply data. And it is the former that takes great strides to ensure the latter does not leak data and denies access to those who are not supposed to see such things.

As I mentioned, it starts and ends with context and correlation. For example, a partner company wants to place an order for 1000 of your eWidgets. They of course could call your rep and give their order over the phone (hello 1991!). The rep can walk the order over to S/R and then Accounting to put the invoice in the mail. Or they could log onto your website with a unique user name and password to an order form off the ERP. This of course integrates with automated shipping and payment options…etc. But let’s stick to Identity. First, using IDaaS the partner password opens the door to only a sliver of the information/functionality they need. This is based off authorizations which are created when their account is created (or modified by a trusted administrator). Their role is provisioned based on your decision of their need. But how do you know the intent of that partner…they are outside your network control. Are their firewalls secure? Do they take security as seriously as you? For this example, let’s say not. Someone has stolen their username. If they don’t have the password; simple, no access. If after 3 failed log ins, your escalated security locks them out and sends an alert to IT. But this is a fired employee or a good hacker…they have a password. However based on several multi-authentications or other tell-tale intrusion signs you can tell its not a valid login–wrong IP address; orders coming in the middle of the night; user is located in Beijing. Each element on its own might not be alarming, but correlated together, provides context (situational awareness based on adaptive risk). The point is, privacy of data is not relevant based on whether your “walls” are made of cloud or otherwise—they work based on your process and how well it is unified and layered. IDaaS is simply a tool within a layer of other tools. If they don’t share information, risk escalates.

Risk is endemic in every industry. And no system is foolproof; cloud or otherwise. To those who still believe cloud security and security from the cloud are still mired in the Wild West—proceed at your own risk—are misinformed. If you want to build that bunker, I hope you have the cash and resources to do so, and I wish you well…especially if it helps you sleep better at night. However, the use of IDaaS or any other cloud security tool to manage the credentialing and authorization is not only feasible in terms of easy manageability and affordability, but creates the necessary hurdle to prevent identity leakage. And it is more important than ever because it is a solution set available to wider group of organizations that either could not afford an enterprise solution or have the manpower to deploy and consistently sustain an initiative. Identity Management, in and of itself, is not the answer to thwart issues about privacy, but it is a needed and important piece of the puzzle to lessen the vulnerability gap…especially if Big Brother (or certain countries with questionable agendas) are watching.

#identity management #infosec #cybersecurity #cloud computing

7 Causes of Security Paralysis & Cloud-based Cures

Over and over again we are pummeled with statistics on how risk is growing in disproportion to security readiness.

91% of companies have experienced at least one IT security event from an external source.

90% of all cyber crime costs are those caused by web attacks, malicious code and malicious insiders.

40% reported rogue cloud issues (shadow IT) experienced the exposure of confidential information as a result

34% share passwords with their co-workers for applications like FedEx, Twitter, Staples, LinkedIn.

These are real stats from studies by like Gartner, Forrester, Ponemon, Kaspersky, Eschelon and others. But there’s one stat that really curls my hair (what little of it is left)

Due to complexity, over 70% of organizations still not adequately securing critical systems.

Wow. It’s a staggering number. But it got me to thinking why. What is causing this universal security paralysis? Now I’m not proclaiming securipocolypse, but knowing what we now about the realities and fragility of an IT environment, I am a bit taken aback at the size of the issue.

I’ve broken it down into seven “excuses.” But rather than bemoaning the problem, I want to rebut those excuses by promoting cloud-based answers.

It’s expensive

It’s time consuming

It’s resource heavy

There’s perceived imbalance in the risk/reward quotient

We’ve got it covered

We haven’t been attacked/complacency

Expertise difficult to retain

Cost: There is no doubt many companies think that a fully integrated security program is going to force it to open its wallet. It is predominantly this reason alone that so many companies ”get by” with what they have—be it malware or firewall protection, an email sniffer, or based on compliance requirements, whatever is the smallest investment to get the alphabet soup of agencies off their back.

How cloud security overcomes the obstacle. It’s simple, really. More bang for the buck. Using the ability to apply operation expenses over capital ones is a significant savings in itself. No expensive servers to buy, no software to maintain and watch depreciate, etc… More importantly is the realization that a company can incorporate a fully capable enterprise juggernaut for pennies on the dollar they would otherwise spend to manage on-premises. Most of us are already aware of the justifying benefits that cloud-based applications provide. I’ve gone on record before stating that for the amount a mid-size company currently pays in support and maintenance for their on-premise initiative, they can easily deploy a robust, fully integrated, fully-capable suite of enterprise-class security solutions from the cloud. The stumbling block here is the proof that such a deployment can adequately meet the specific needs of the unique company. However by applying the 80/20 rule, by covering 80 percent of a company’s needs, it is more than likely well ahead of anything they are currently doing. Now on top of all that is all the professional services and consulting costs that ostensibly go away, or at least are tremendously reduced when managing from the cloud.

Time: There’s just never enough of it. Every IT pro I talk to wears many hats. They are installers, monitors, coders, patchers, reporters, developers, and a hundred other chapeau descriptors. And security in the modern enterprise needs to be a fully dedicated concern. Sure there are some companies that can afford this, but most can’t…it’s just another line of job description.

How cloud security overcomes the obstacle. Being proactive takes time. By applying security as a service, you remove any additional headcount. You can take the time that was dedicated to certain security functions and reprioritize them for core business functions. Also the fact that so many of the cloud security functions are automated—from self-service password management to HIPAA/PCI compliance reporting to role-based provisioning to correlated alert escalation— give rise to a surplus of available resources.

Resources. In many companies this is the premium currency. And, in many companies resources are spread devastatingly thin. Whether we are talking human resources, financial resources, spatial resources, application/functional resources or knowledge resources, the ability to weigh and deploy the right amount of assets towards an issue, directly effects its successful management. In every company resources are finite and typically require hard decisions where best to position assets to ensure the smooth running of an enterprise. This is especially true when applied to security.

How cloud security overcomes the obstacle. Security managed from the cloud relieves a great deal of the resource overload. It provides the additional capabilities at a lesser cost. With this expanded functionality and potential, one can create greater awareness and better visibility across a larger scope of information. So not only are you expending less resources to secure many aspects of your enterprise, but it’s ability to divine things faster and clearer provides a unique advantage to control a greater scope of the IT environment. By leveraging and unifying these resources, you now know things that would have remained invisible. Therefore you gain the ability to make better decisions faster—giving you the ability to best marshal resources (minimizing costs and maximizing efficiencies) where they need to be.

Risk/Reward Imbalance. The expense of security does not necessarily pay for itself. It’s a cost center, right? But security must be perceived as more than a purchase of some software and the manpower to run reports. There are other factors to consider. The balance sheet doesn’t show the lost business because of lack of trust or poor security reputation. It doesn’t show the savings as it prevents proprietary secrets like sales databases walking away to the competition when an angry employee can gain access weeks after termination. It doesn’t show the fines and lost time when compliance isn’t met. But the big question is not that you apply a security measure or not. That point is moot, you simply have to. However the question CSOs and CIOs struggle with is how much? Where is the tipping point between peace of mind and overkill?

How cloud security overcomes the obstacle. The biggest reason for the risk-reward imbalance is typically the reasons noted already. It’s costly, it takes a certain percentage of manpower, and it’s complex. But if cloud-based security capabilities remove those obstacles, the balance starts tipping more heavily toward reward. If an organization can deploy a fully-integrated, unified security platform for what it is paying now for its current bits and pieces, AND have it properly monitored and analyzed without adding headcount, AND have it deployed to the company’s unique specifications and scale, then the conversation becomes about performance rather than scope; then the TCO drops and the ROI begins to climb.

Covered: Log management, by itself, won’t cut it. Neither will just web access control or firewall protection. In some cases, it may bring you up to the letter of the law with regard to compliance, but if security is like a house, the door is locked but all the windows are open. If you’re of the 30% who truly are properly secured, then stop reading. But if you are most companies, you really don’t have it covered. The excuse is simply code for I have other fires to put out, and it isn’t a large enough issue for me to raise it up on the priority scale. I should know, I use it as a default setting for most sales calls.

How cloud security overcomes the obstacle. Quick answer is a unified security deployment from the cloud allows you to fill in the gaps of where you currently are lacking. Not consistently monitoring? Check. Not controlling access to certain applications. Check. Not analyzing data and creating escalation alerts in real time? Check. It doesn’t have to be a replacement strategy—get rid of all the investment and hard work you’ve put into a certain systems, solutions, processes and tools. The beauty of the cloud is you can pick and choose the pieces you need easily and have them leverage any existing program. It is scalable, flexible and manageable.

Not attacked: Do you know that for sure? If you are not checking for termites, doesn’t mean your house isn’t infested. Those who think their organizations are too small or too unimportant for hackers to care are only seeing part of the picture. It’s common understanding that it is not an issue of ‘if” anymore, but a measure of “when.” an IT security event will occur. Still not convinced? Hackers are banking on this thought process to use these systems as stepping stones for larger fish. If your system is open and you connect to larger payment systems or applications, you are open to danger. Second, not every danger is some barbarian at the gate. Sometimes the threats (or carelessness) come from within. Again, check the stats. 91%. If you are part of the 9% who hasn’t been touched by an IT security event, I want to know what you’re doing right!

How cloud security overcomes the obstacle. Simply apply a 30-day free trial of any of the cloud-based SIEM solutions out there that monitor in real time and you will have your eyes opened into how much activity is pinging your system every day. I am fond of telling the story of a significant retailer who had thought they had a pretty good handle on what was going on in their environment. After our SIEM system had been monitoring intrusions and the like for just over a month, the results were starkly different than the client anticipated. It was more than triple the amount of negative activity they thought.

Lack of expertise: Finding the right person to deploy and manage a top notch security program is tough. Stats say (MSP Alliance) that unemployment for pros with these skills is less than 1%. And once you find them, they are expensive to recruit and keep. In fact their salaries have doubled over the past three years.

How cloud security overcomes the obstacle. Security-as-a-service builds in the expertise required to monitor, analyze, and manage a strong security presence. Through this version of outsourcing, you not only save on the hard costs of salary, but the soft costs of training, ramp up, benefits, vacations, etc. Yet more than the costs, is the propagation of continuous tribal knowledge of orchestrating, manipulating, analyzing the vast amount of inbound data, and applying the right actions quickly and decisively to keep the IT landscape operating smoothly, in the confines of compliance and strategically viable. In the end, this is one of the most valuable assets cloud-based security offers.

There’s no longer an excuse to be part of that 70%!

Kevin Nikkhoo

www.cloudaccess.com

You're Invite: One Click...From Directory to Cloud Webinar

Effectively managing individual online user identities while controlling their specific application and data access privileges continue to be a challenge for IT administrators. CloudAccess, a leader in cloud-based security solutions is hosting a complimentary webinar that address best practices to overcome the issues of complexity, expense and available resources. The 45-minute presentation, titled "One Click...From Directory to Cloud," and scheduled for May 22nd and 28 at 11:00am PDT, boldly asks the question, "What if you could add a user from any directory or database and it shows up automatically in Google Apps, salesforce.com, any SaaS or legacy application?" Accomplishing this has long been a difficult, but necessary goal for companies needing to protect assets using identity and access management. “Because every user has a unique relationship to a company’s IT environment, it is mission critical to develop process and technology best practices to streamline and fully integrate the separate functions and capabilities,” said CloudAccess CEO Kevin Nikkhoo. “We want to share how the cloud is the best platform on which to base that initiative.We want to prove something that many CIO's and CTOs think too good to be true.” For many companies identity and access management are separate solutions that regulate who is allowed on a network and what applications, web portals or data they are permitted to use. This includes managing passwords, accountability monitoring and reporting, user provisioning, and encrypting data. Several industries require these components to meet regulatory compliance (HIPAA, PCI, SOX, etc) and privacy laws. “Compliance is not only important for industry standards, but maintaining trust between employees, customers and other online users. It’s important to discover and deploy best practices that mitigate the burden, limit the man hours, reduce the capital expenditures,” Nikkhoo said. “But most importantly, it is to secure the privacy of sensitive assets and protect the IT enterprise from hackers, data leaks and other costly security issues.” For many, this technology (identity and access management) is not new, but the seamless integration between the capabilities managed and deployed from the cloud is unique. There are cloud-based solutions and solutions that monitor the cloud, but in most current initiatives, one or both of the solutions are on-premise. The demonstration portion of the webinar will focus on a completely cloud-driven solution and its enterprise capabilities. Additionally, the presentation will include a best practice that is not limited to controlling federated SaaS applications (SAML). It is expanded through a wide-ranging identity gateway that allows the control over any web or legacy application, and any website asset. According to Nikkhoo, the ability to deploy and manage these rules processes in the cloud is the key to reducing man hours, compliance burdens and, most of all, capital expenses. “A strong cloud strategy is the central best practice for a company looking to maintain a secure edge,” he said. To register for the webinar, visit the CloudAccess registration site www.cloudaccess.com/webinar-registration-0. Seating is limited. All attendees will receive the white paper Regaining IT Control. For more information about security-as-a-service managed from the cloud, please contact CloudAccess at 877-550-2568 or visit the website www.cloudaccess.com.

Erasing the Identity Blind Spot

Security is not an all-or nothing proposition. And that’s part of the problem. It creates blind spots; gaps in vulnerability. Partly because of the inherent complacency that after a company institutes a new security initiative that hackers will be held at bay, or the employees won’t be tempted to make off with a database or a hundred other internal or external threats.

I have long promoted that security is as much about planning and process as it is about the various solutions that are deployed to protect networks, data, and other assets.

Security is no longer a wall. Stick up a firewall and your customer/user data won’t get leaked. Actually it’s more like a sandwich. And good security initiatives are like a good Dagwood sandwich–layered and integrated. But even the best sandwiches have holes (if they didn’t, you’d be eating a brick).

So, just as you wouldn’t eat the bread, then eat the meat, then the cheese, and then dip your fingers in the mustard, you shouldn’t deploy firewalls in parallel with intrusion detection, identity management, access management, etc… The key term here is in “parallel.” As part of your strategic planning, you must recognize that although each has a certain and important function, if they are simply working in parallel and not collaboratively, you are creating significant blind spots.

To illustrate I want to focus on a typical internal threat of unregulated user access. What happens when employees use web access to process corporate data, including on their own devices? This issue is more than just updating sales call results via salesforce.com or logging in to social media to post about an upcoming promotion. It’s about control and maintaining the control of the IT environment.

With so much data shared beyond the traditional firewall, identity management (credentialing and authorization) is a good starting point, but if you simply allow users a means to enter the castle, what they do once inside still creates risk. Strong identity management not only provides the credentialing gatekeeper (user name, passwords), but must apply use roles-based provisioning to further segment users. In earlier blogs I’ve discussed how not all users are created equal and therefore should not be allowed generic universal access. To further mix my metaphors, think of it like a hotel. Only guests are allowed passed a certain point-and each has access to their own personal space. But only certain guests are allowed into premium areas such as spas or penthouse rooms. The same is true for users and the assets on your extended network.

READ THE REST AT bit.ly/Y9lc6x

CloudAccess unveils integrated version of identity & access management. It is currently the only product on the market that presents a fully-integrated enterprise ID /access management solution from a multi-tenant cloud. The features are comparable to several established on-premise brands.

Our blog is moving!

Join us at our new address under the CloudAccess domain!

http://www.cloudaccess.com/blog/

All…

View Post

Can your company afford to lose $400 million?

Of course not. But that’s the dollar figure companies stand to lose in terms of consumer trust when…

View Post

The Secret Sauce of User Provisioning

If you want the secret to user provisioning and de-provisioning in an enterprise setting, I’ll give…

View Post

Cloud-based SIEM frees that one hand tied behind your back

Have you ever been asked to fight the state boxing champion with one hand tied behind your back? Or…

View Post

A de-provisioning proverb: When a door closes, just make sure you don’t leave the window open

Earlier this week I attended a local cloud developers group, and I met a gentleman who consults…

View Post

Trending Blogs

Recently Viewed Blogs

Thoughts From the Cloud