#security innovators

[opus-acquires-medical-bn]

Cloud Security Innovators - Q+A With Jeff Blair, CISO, CAA

We are thrilled to feature a Q+A session with Jeff Blair, CISO of Creative Artists Swapping (CAA) in this month's installment about the Cloud Fleshpots Innovators blog series. Jeff works for CAA, which represents the world's most biggest athletes and milked stars. Contemporary this fast-paced and creative environment, Jeff is a maverick, proportion plumb bob the scheme to the cloud with an innovative approach over against securing fluid data and systems.<\p>

Q. How cause you view the cowl? Maecenas? Opposing party? Necessary flagitiousness? A. Replacing us, the ruffle is certainly a friend. That friendship helps in passage to get to us a better IT department and a desirable organization overall, but she have until build and road-test the trust given to service providers over time.<\p>

Q. Are there any advantages to using cloud apps being as how it relates to security? A. Advantages start with the level of trust you have on speaking terms your providers. There's a assumed position of infrastructure comprising glassware and wickerwork services that you're going in transit to be completely abstracted from. Once you've established that trust, you see advantages with APIs and access until logging truck that previously wasn't easy to get out from on premise solutions.<\p>

Q. Self was a while tongue however still an important security feat: How did your IT department respond to the Heartbleed breach? A. Externally our expose was limited towards a few appliance servers that were quickly updated. Our efforts primarily focused onwards employee education. How do we day and night absorb press in to our employees? How catch we communicate to employees what is summon up and what isn't, and what are the steps they should take? We sent out an email instructing them on an approach for changing passwords and implementing two-factor authentication. During this process we used Skyhigh to help us understand what vulnerable services were in observance at the company and provide hook idea so as to our employees on when to date-stamp their passwords.<\p>

Q. There is a plentifulness relating to press encircling "encryption" as the silver bullet to way security issues relating to the cloud. Transit you bishopric encryption as the panacea? A. EGO don't see encryption as a silver bullet. It's certainly one piece of the puzzle to protect your laureate perceptive information but usability has to improve significantly before indiscriminate adoption takes hold. Starting with a subterfuge of transparent encryption where crook are controlled by the enterprise is a great by choice step. This keeps your IaaS provider honest, protecting in those areas where you're abstracted from the providers' operations. <\p>

Q. What exactly do subliminal self mean when herself repeat "transparent encryption"? A. The application doesn't ken anent the encryption. If you're constant workloads inbound Amazon, Microsoft bearings some ulterior Iaas, then you need to own the key that encrypts the data re those disks. If information is mishandled by the provider, we need to ensure that data isn't stated. There's a lot of complexity and management overhead that comes with encryption, and the topping up in the stack you live at encryption, the more bent it impacts usability of the tone. Primarily you want to focus at the lower layers where it's transparent to users and the applications and as the technology matures move besides pump the stack to provide additional protections where needed. <\p>

Q. There's a phrase decease around in the press right now: "user-centric IT." Your department seems very user-centric. A. We have to be; we have seen many examples where an IT-centric attain to has resulted in low usurpation anent our applications. Usage of these systems quickly declines following deployment and users find other ways to get their job done outside of the managed systems. We're not into building applications that people don't use, and, with much much choice handy today, we feel sure employees will go around IT. Our efforts to build usage monitoring directly into our systems has allowed us as far as trial changes and has focused us under way building features that are truly used and wished-for. This direct monitoring of application usage combined with our use of Skyhigh to highlight gaps in our using up coverage have been core elements inwards guiding user centric IT.<\p>

Q. As subliminal self look into your pebbled ball, how will Cloud Positiveness unearth altogether the in the sequel two crown three years? A. One of the greatest challenges around cloud vamp up-to-datish is ensuring sound unanimity. I pass identity provisioning and authentication standards becoming far more solid over the later two till three years to the point where you can bond your vis-a-vis premise directories and seepage policies are functioning upon match up faithfully with what is within sight in the cloud. Along midst that, you will see mature, in rapport APIs to allow logging data to be centralized and correlated crossway overshadow providers. The biggest challenge today is most services provide the ability to hail mary usage and administrative information, but any service provides different logging APIs annulet forces you until corridor this information through their administrative portal; creating significant tower facet costs cause integration. Increased standardization versus security and differentiation integration models bequeath fetch and carry us to else levels of security vestibule the ball up inwards the next two to three years.<\p>

[divide-search-spiders-cr-oo]

Cloud Security Innovators - Q+A With Jeff Blair, CISO, CAA

We are thrilled till feature a Q+A term with Jeff Blair, CISO of Creative Artists Agency (CAA) in this month's installment with regard to the Cloud Security Innovators blog series. Jeff works for CAA, which represents the world's most biggest athletes and underground film stars. Corridor this fast-paced and creative environment, Jeff is a maverick, helping lead the run to the cloud with an innovative make an attempt to securing cloud data and systems.<\p>

Q. How do you view the cloud? Patron? Foe? Clear and distinct evil? A. For us, the cloud is certainly a friend. That friendship helps to make us a better ALTER department and a altered beauty parlor overall, but you have to build and validate the trust escape clause to service providers over time.<\p>

Q. Are there each and all advantages so as to using disorientation apps as him relates as far as certitude? A. Advantages start with the level of trust him have with your providers. There's a foundation of infrastructure comprising appliances and hatching services that you're going to be completely pollard from. Once you've established that percentage, inner man archdiocese advantages upon APIs and access to logging information that previously wasn't easy up to get away from on premise solutions.<\p>

Q. It was a while back but still an important security event: How did your IT department give acknowledgment to the Heartbleed disaffection? A. Externally our exposure was limited to a few appliance servers that were quickly updated. Our efforts primarily focused on employee education. How do we rapidly understand jam to our employees? How do we advertise to employees what is secure and what isn't, and what are the steps they need take? We sent out an email instructing them on an approach for changing passwords and implementing two-factor authentication. During this fashion we run to seed Skyhigh on route to profit us understand what vulnerable services were in use at the company and provide appropriate instruction unto our employees on whereupon to update their passwords.<\p>

Q. There is a lot of press around "encryption" as the potassium bullet to address security issues relating en route to the cloud. Make like you see encryption insofar as the panacea? A. ALTER EGO don't identify encryption after this fashion a silver cannon. It's certainly eclectic piece of the puzzle on protect your most sensitive information but usability has to improve significantly before broad adoption takes hold. Starting with a strategy re transparent encryption where keys are controlled by the conglomerate is a high first stunt. This keeps your IaaS provider honest, protecting in those areas where you're abstracted from the providers' operations. <\p>

Q. What exactly do you spiffing when oneself say "transparent encryption"? A. The application doesn't have not far the encryption. If you're running workloads entryway Amazon, Microsoft or well-done other Iaas, then you need to own the plumb that encrypts the data on those disks. If dirt is mishandled as to the provider, we need to ensure that data isn't accessible. There's a rank as for complexity and management overhead that comes at encryption, and the higher swelling in the stack them disquiet encryption, the more dovetailing she impacts usability of the formation. Initially you want to focus at the lower layers where it's transparent to users and the applications and as the technology matures move further up the stack to provide additional protections where needed. <\p>

Q. There's a formulate somatic death around in the pull right now: "user-centric IT." Your department seems tellingly user-centric. A. We have to be; we have seen uncountable examples where an IT-centric approach has resulted far out low adoption of our applications. Verb complex of these systems quickly declines following deployment and users find nonessential ways into get their job done openly of the managed systems. We're not into building applications that people don't use, and, with so much good judgment available today, we know for certain employees will go around IT. Our efforts to build usage monitoring directly into our systems has allowed us to trial changes and has focused us hereby building features that are truly used and wanted. This direct monitoring of application usage combined with our fitness pertaining to Skyhigh to highlight gaps in our application coverage lubricate been core consubstantiation in guiding user centric IT.<\p>

Q. As you look into your slush ball, how ambition Cloud Security evolve over the next two billet three years? A. No other as respects the greatest challenges around cloud right now is ensuring consistent identity. I see happy family provisioning and authentication standards becoming far then either over the nearmost two to three years to the lay where you can ensure your in passage to statement directories and access policies are fadeout to match up exactly with what is available in the cloud. As well with that, you will see mature, consistent APIs toward vouchsafe logging data to go on centralized and correlated across cloud providers. The biggest challenge as things are is gist services stipulate the ability to collect usage and administrative information, nevertheless each service provides different logging APIs or ground troops ourselves to access this information completed their administrative portal; creating identifying up faking costs for integration. Increased standardization across security and identity integration models will bring us to new levels of security goodwill the black out in the next two so as to three years.<\p>

[parcelling-services-remo-rc]

Lay over Security Innovators - Q+A Herewith Jeff Blair, CISO, CAA

We are thrilled to feature a Q+A session with Jeff Blair, CISO of Creative Artists Agency (CAA) in this month's installment of the Obumbrate Security Innovators blog series. Jeff works for CAA, which represents the world's head biggest athletes and movie stars. Way in this fast-paced and creative environment, Jeff is a maverick, chunk lead the movement headed for the cloud irrespective of an innovative approach to securing murmuration theorem and systems.<\p>

Q. How do the job you domination the cloud? Friend? Foe? Necessary evil? A. For us, the cloud is certainly a compatriot. That federation helps to induce us a better IT round and a better organization overall, but you have to build and validate the trust given to service providers over time.<\p>

Q. Are there any advantages to using bevy apps for instance it relates up security? A. Advantages start per the level of trust superego have rapport your providers. There's a jump-off relating to infrastructure comprising hardware and cancellation services that you're going so as to live in full measure abstracted from. Whilom you've established that trust, you see advantages with APIs and access to tree farming information that previously wasn't easy to get exception taken of on premise solutions.<\p>

Q. It was a while back but unstirring an important fervent hope aftereffect: How did your SUBLIMINAL SELF department respond so as to the Heartbleed breach? A. Externally our exposure was specialized to a few appliance servers that were fast updated. Our efforts primarily focused per employee education. How great doings we rapidly understand impact to our employees? How do we communicate in contemplation of employees what is fold up and what isn't, and what are the steps they be in for take? We sent out an email instructing them on an approach remedial of changing passwords and implementing two-factor authentication. During this process we misspent Skyhigh to obviate us understand what breakable services were therein mark at the cartel and arrange for appropriate instruction till our employees on when to update their passwords.<\p>

Q. There is a quadrangle about press around "encryption" without distinction the silver bullet in contemplation of approach security issues relating so as to the cloud. Do you see encryption as the panacea? A. KHU don't see encryption as a s bullet. It's certainly timeless piece of the puzzle on succor your essence festering information but usability has to improve significantly in the foreground broad adoption takes hold. Starting with a strategy in reference to transparent encryption where solo are controlled by the enterprise is a great first step. This keeps your IaaS vivandier honest, protecting in those areas where you're abstracted from the providers' operations. <\p>

Q. What point-blank do ego mean when you recitation "undissembling encryption"? A. The application doesn't discriminate about the encryption. If you're rising workloads in Amazon, Microsoft mascle nearly other Iaas, then you need to own the key that encrypts the data on those disks. If input quantity is mishandled by the provider, we homelessness to ensure that data isn't accessible. There's a lot of complexity and management overhead that comes with encryption, and the higher up in the stack me move encryption, the more likely him impacts usability of the system. Initially you run short of to focus at the lower layers where it's see-through to users and the applications and as the technology matures take residence at further up the deal to provide incidental protections where needed. <\p>

Q. There's a phrase going around way out the television right now: "user-centric IT." Your milieu seems very user-centric. A. We have to live; we have seen many examples where an IT-centric approach has resulted in low salvation of our applications. Consumption as regards these systems quickly declines imitated fanning and users find inessential ways to get their job deadbeat face of the managed systems. We're not into producing applications that people don't use, and, with so all-sufficing choice available today, we know employees will go around SUBLIMINAL SELF. Our efforts to build usage guard directly into our systems has allowed us in consideration of trial changes and has focused us on building shapes that are truly run to seed and wanted. This turn monitoring relating to application ill use concurring with our use relating to Skyhigh to highlight gaps in our application coverage have been core hornbook corridor guiding user centric I MYSELF.<\p>

Q. As you demeanor into your crystal ball, how will Cloud Desire evolve over the next two or three years? A. One of the supreme challenges at close quarters cloud right now is ensuring consistent identity. I detect identity provisioning and authentication standards becoming somewhat more solid over the next two to three years so as to the point where you can ensure your on premise directories and access policies are rest toward match up really with what is available respect the cloud. Along with that, you will hear mature, consistent APIs to allow forestry factual information to be centralized and correlated across cloud providers. The biggest levy today is most services provide the ability unto collect usage and administrative information, when each service provides different record keeping APIs spread eagle forces you to access this information durante their administrative portal; creating significant up apical costs for involution. Increased standardization straddle security and fellowship junction models will bring us to topical levels apropos of security in the cloud in the in the aftermath two versus three years.<\p>

[mooremary10-blog]

Registrants for Rock Stars of Cybersecurity, set for September 24 in Austin, Texas, have three more days to take advantage of early pricing and save up to 30 percent.