Welcome!

Microservices Expo Authors: Liz McMillan, Flint Brenton, Jason Bloomberg, Elizabeth White, Yeshim Deniz

Related Topics: Microservices Expo, Java IoT, Agile Computing, Cloud Security

Microservices Expo: Blog Post

Casting Light on Shadow IT and ID

Watching vulnerability cracks in your network widen via unauthorized application usage

It's not a new term or concept. You probably recognize that it’s happening within your own organization. Shadow IT is the appropriation and use of IT assets and applications without organizational approval.  And it happens more than you know. Sally the sales rep gets a label template design application, Marco from HR downloads software that manages inbound resumes. Kelsey in marketing signs up for a WordPress page and social media accounts. All too often, employees are not going through corporate channels to get what they need to achieve their goals.

And every time they do, the vulnerability cracks in your network widen.

Now on top of the obvious issues with unauthorized applications is the creation of Shadow Identities. For all of these applications there are user names and passwords. Across an enterprise that could mean thousands and thousands of identities. And, because some are even using their personal commercial mail accounts to create these new IDs, you now have your corporate data going out through an external service with which you have no control.

The world of SaaS has exacerbated the security problem, but the cloud also provides the solution.

To understand how to best approach the quandary, you must realize that traditional concepts of IT are out of date.  At one time you just built a wall around everything. However, with SaaS, mobile users, customers, partners, the perimeter has been erased—you simply can’t open an LDAP query from your directory and plug in applications to your enterprise infrastructure.

Identity Management is the new Network Perimeter. And identity management from the cloud centralizes, ordains, and automates your corporate policies. The idea is when you can’t pull your curtain of protection around where the data resides, your only point of control is identity credentialing and authorization. You create the rules for access and entrance and then pass the user along to the specific resource.

In any organization this can mean dozens of applications for a variety of departments and niche users.  This means managing potentially thousands of passwords...and that’s not a place most IT professionals wish to spend their time. But rather than belabor the problem, let’s highlight the solution broken down by type:

Data has two general directions: inbound and outbound. The key is to create federated relationships. You need to ensure that those who you invite to access or add data to your network are properly vetted. And these can be broken into two very general categories: high and low risk. Lower risk would include partners and customers because you can automatically provision them to see just a small part of your network. Customers don’t need to access production, they simply want to process an order or maybe query the help desk…and that’s all they should be given.  For something like this all you really need is cloud identity management to control the reach and scope of their access. The same holds true with partners like VARs or suppliers.

Then there are higher risk transactions. These are usually driven by your mobile users and internal employees. They obviously need more access to things like payroll or benefit packages. For these, in the scope of identity management, you would be best served by using a multi-factor authorization.

It is obviously more complex than a 750 word blog can delve into but, the ability to automatically provision and deprovision, to manage countless passwords, to federate access to your data is easily handled by cloud-based security. If the goal is to rethink how IT works in order to make it more cost-effective and asset protective, then IT departments must evolve from a developer of stacks to brokers and facilitators of service. The mission is still to keep the data safe, but you are now analyzing where you once were building. You are now acquiring and integrating in concert with enterprise business needs and goals.  When that is the case, then security-as-a-service must be a consideration for your enterprise.

Now let’s also consider outbound data. Federation is not only important. It is the driving need to ensure the safety of this nebulous enterprise perimeter. Your users are accessing third-party applications like salesforce.com or ADP, Webex, SharePoint, etc and you must provide the access in support of business needs.  Whereas much of inbound can be federated using cloud-based identity management as a baseline, anything outbound must be SAML-aware.  You need to insist on SAML-based federation before you approve any outside program. If not, you better think twice about including it as an option.

If there is one takeaway from this, it is that unless you decide to evolve with the changing demands of business, your architecture will be compromised by an expanding creep of Shadow IT and their accompanying Shadow Identities. If you realize that now your data can be anywhere, you must centralize the access to that data. By taking full advantage of cloud-based security, you not only benefit from the cost-efficiencies, but your gain all the built-in federations and integrated resources, as well as best-of-breed password management and single-sign on.  Then there are the compliance and reporting needs and how a strong security-as-a-service offering effectively addresses that pressing requirement…but we’ll leave that for another day.

Kevin Nikkhoo
www.cloudaccess.com

More Stories By Kevin Nikkhoo

With more than 32 years of experience in information technology, and an extensive and successful entrepreneurial background, Kevin Nikkhoo is the CEO of the dynamic security-as-a-service startup Cloud Access. CloudAccess is at the forefront of the latest evolution of IT asset protection--the cloud.

Kevin holds a Bachelor of Science in Computer Engineering from McGill University, Master of Computer Engineering at California State University, Los Angeles, and an MBA from the University of Southern California with emphasis in entrepreneurial studies.

@MicroservicesExpo Stories
All organizations that did not originate this moment have a pre-existing culture as well as legacy technology and processes that can be more or less amenable to DevOps implementation. That organizational culture is influenced by the personalities and management styles of Executive Management, the wider culture in which the organization is situated, and the personalities of key team members at all levels of the organization. This culture and entrenched interests usually throw a wrench in the work...
Don’t go chasing waterfall … development, that is. According to a recent post by Madison Moore on Medium featuring insights from several software delivery industry leaders, waterfall is – while still popular – not the best way to win in the marketplace. With methodologies like Agile, DevOps and Continuous Delivery becoming ever more prominent over the past 15 years or so, waterfall is old news. Or, is it? Moore cites a recent study by Gartner: “According to Gartner’s IT Key Metrics Data report, ...
Many organizations are now looking to DevOps maturity models to gauge their DevOps adoption and compare their maturity to their peers. However, as enterprise organizations rush to adopt DevOps, moving past experimentation to embrace it at scale, they are in danger of falling into the trap that they have fallen into time and time again. Unfortunately, we've seen this movie before, and we know how it ends: badly.
In his session at Cloud Expo, Alan Winters, U.S. Head of Business Development at MobiDev, presented a success story of an entrepreneur who has both suffered through and benefited from offshore development across multiple businesses: The smart choice, or how to select the right offshore development partner Warning signs, or how to minimize chances of making the wrong choice Collaboration, or how to establish the most effective work processes Budget control, or how to maximize project result...
In his keynote at 19th Cloud Expo, Sheng Liang, co-founder and CEO of Rancher Labs, discussed the technological advances and new business opportunities created by the rapid adoption of containers. With the success of Amazon Web Services (AWS) and various open source technologies used to build private clouds, cloud computing has become an essential component of IT strategy. However, users continue to face challenges in implementing clouds, as older technologies evolve and newer ones like Docker c...
For organizations that have amassed large sums of software complexity, taking a microservices approach is the first step toward DevOps and continuous improvement / development. Integrating system-level analysis with microservices makes it easier to change and add functionality to applications at any time without the increase of risk. Before you start big transformation projects or a cloud migration, make sure these changes won’t take down your entire organization.
Without a clear strategy for cost control and an architecture designed with cloud services in mind, costs and operational performance can quickly get out of control. To avoid multiple architectural redesigns requires extensive thought and planning. Boundary (now part of BMC) launched a new public-facing multi-tenant high resolution monitoring service on Amazon AWS two years ago, facing challenges and learning best practices in the early days of the new service.
You often hear the two titles of "DevOps" and "Immutable Infrastructure" used independently. In his session at DevOps Summit, John Willis, Technical Evangelist for Docker, covered the union between the two topics and why this is important. He provided an overview of Immutable Infrastructure then showed how an Immutable Continuous Delivery pipeline can be applied as a best practice for "DevOps." He ended the session with some interesting case study examples.
Both SaaS vendors and SaaS buyers are going “all-in” to hyperscale IaaS platforms such as AWS, which is disrupting the SaaS value proposition. Why should the enterprise SaaS consumer pay for the SaaS service if their data is resident in adjacent AWS S3 buckets? If both SaaS sellers and buyers are using the same cloud tools, automation and pay-per-transaction model offered by IaaS platforms, then why not host the “shrink-wrapped” software in the customers’ cloud? Further, serverless computing, cl...
"We view the cloud not as a specific technology but as a way of doing business and that way of doing business is transforming the way software, infrastructure and services are being delivered to business," explained Matthew Rosen, CEO and Director at Fusion, in this SYS-CON.tv interview at 18th Cloud Expo (http://www.CloudComputingExpo.com), held June 7-9 at the Javits Center in New York City, NY.
Without lifecycle traceability and visibility across the tool chain, stakeholders from Planning-to-Ops have limited insight and answers to who, what, when, why and how across the DevOps lifecycle. This impacts the ability to deliver high quality software at the needed velocity to drive positive business outcomes. In his general session at @DevOpsSummit at 19th Cloud Expo, Eric Robertson, General Manager at CollabNet, will discuss how customers are able to achieve a level of transparency that e...
We all know that end users experience the internet primarily with mobile devices. From an app development perspective, we know that successfully responding to the needs of mobile customers depends on rapid DevOps – failing fast, in short, until the right solution evolves in your customers' relationship to your business. Whether you’re decomposing an SOA monolith, or developing a new application cloud natively, it’s not a question of using microservices - not doing so will be a path to eventual ...
"DivvyCloud as a company set out to help customers automate solutions to the most common cloud problems," noted Jeremy Snyder, VP of Business Development at DivvyCloud, in this SYS-CON.tv interview at 20th Cloud Expo, held June 6-8, 2017, at the Javits Center in New York City, NY.
We all know that end users experience the Internet primarily with mobile devices. From an app development perspective, we know that successfully responding to the needs of mobile customers depends on rapid DevOps – failing fast, in short, until the right solution evolves in your customers' relationship to your business. Whether you’re decomposing an SOA monolith, or developing a new application cloud natively, it’s not a question of using microservices – not doing so will be a path to eventual b...
"This all sounds great. But it's just not realistic." This is what a group of five senior IT executives told me during a workshop I held not long ago. We were working through an exercise on the organizational characteristics necessary to successfully execute a digital transformation, and the group was doing their ‘readout.' The executives loved everything we discussed and agreed that if such an environment existed, it would make transformation much easier. They just didn't believe it was reali...
"Opsani helps the enterprise adopt containers, help them move their infrastructure into this modern world of DevOps, accelerate the delivery of new features into production, and really get them going on the container path," explained Ross Schibler, CEO of Opsani, and Peter Nickolov, CTO of Opsani, in this SYS-CON.tv interview at DevOps Summit at 21st Cloud Expo, held Oct 31 – Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA.
Most companies are adopting or evaluating container technology - Docker in particular - to speed up application deployment, drive down cost, ease management and make application delivery more flexible overall. As with most new architectures, this dream takes a lot of work to become a reality. Even when you do get your application componentized enough and packaged properly, there are still challenges for DevOps teams to making the shift to continuous delivery and achieving that reduction in cost ...
Your homes and cars can be automated and self-serviced. Why can't your storage? From simply asking questions to analyze and troubleshoot your infrastructure, to provisioning storage with snapshots, recovery and replication, your wildest sci-fi dream has come true. In his session at @DevOpsSummit at 20th Cloud Expo, Dan Florea, Director of Product Management at Tintri, provided a ChatOps demo where you can talk to your storage and manage it from anywhere, through Slack and similar services with...
"I focus on what we are calling CAST Highlight, which is our SaaS application portfolio analysis tool. It is an extremely lightweight tool that can integrate with pretty much any build process right now," explained Andrew Siegmund, Application Migration Specialist for CAST, in this SYS-CON.tv interview at 21st Cloud Expo, held Oct 31 – Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA.
Explosive growth in connected devices. Enormous amounts of data for collection and analysis. Critical use of data for split-second decision making and actionable information. All three are factors in making the Internet of Things a reality. Yet, any one factor would have an IT organization pondering its infrastructure strategy. How should your organization enhance its IT framework to enable an Internet of Things implementation? In his session at @ThingsExpo, James Kirkland, Red Hat's Chief Archi...