Welcome!

Microservices Expo Authors: LeanTaaS Blog, Derek Weeks, Don MacVittie, Karthick Viswanathan, Gopala Krishna Behara

Related Topics: Microservices Expo, Java IoT, Agile Computing, Cloud Security

Microservices Expo: Blog Post

Casting Light on Shadow IT and ID

Watching vulnerability cracks in your network widen via unauthorized application usage

It's not a new term or concept. You probably recognize that it’s happening within your own organization. Shadow IT is the appropriation and use of IT assets and applications without organizational approval.  And it happens more than you know. Sally the sales rep gets a label template design application, Marco from HR downloads software that manages inbound resumes. Kelsey in marketing signs up for a WordPress page and social media accounts. All too often, employees are not going through corporate channels to get what they need to achieve their goals.

And every time they do, the vulnerability cracks in your network widen.

Now on top of the obvious issues with unauthorized applications is the creation of Shadow Identities. For all of these applications there are user names and passwords. Across an enterprise that could mean thousands and thousands of identities. And, because some are even using their personal commercial mail accounts to create these new IDs, you now have your corporate data going out through an external service with which you have no control.

The world of SaaS has exacerbated the security problem, but the cloud also provides the solution.

To understand how to best approach the quandary, you must realize that traditional concepts of IT are out of date.  At one time you just built a wall around everything. However, with SaaS, mobile users, customers, partners, the perimeter has been erased—you simply can’t open an LDAP query from your directory and plug in applications to your enterprise infrastructure.

Identity Management is the new Network Perimeter. And identity management from the cloud centralizes, ordains, and automates your corporate policies. The idea is when you can’t pull your curtain of protection around where the data resides, your only point of control is identity credentialing and authorization. You create the rules for access and entrance and then pass the user along to the specific resource.

In any organization this can mean dozens of applications for a variety of departments and niche users.  This means managing potentially thousands of passwords...and that’s not a place most IT professionals wish to spend their time. But rather than belabor the problem, let’s highlight the solution broken down by type:

Data has two general directions: inbound and outbound. The key is to create federated relationships. You need to ensure that those who you invite to access or add data to your network are properly vetted. And these can be broken into two very general categories: high and low risk. Lower risk would include partners and customers because you can automatically provision them to see just a small part of your network. Customers don’t need to access production, they simply want to process an order or maybe query the help desk…and that’s all they should be given.  For something like this all you really need is cloud identity management to control the reach and scope of their access. The same holds true with partners like VARs or suppliers.

Then there are higher risk transactions. These are usually driven by your mobile users and internal employees. They obviously need more access to things like payroll or benefit packages. For these, in the scope of identity management, you would be best served by using a multi-factor authorization.

It is obviously more complex than a 750 word blog can delve into but, the ability to automatically provision and deprovision, to manage countless passwords, to federate access to your data is easily handled by cloud-based security. If the goal is to rethink how IT works in order to make it more cost-effective and asset protective, then IT departments must evolve from a developer of stacks to brokers and facilitators of service. The mission is still to keep the data safe, but you are now analyzing where you once were building. You are now acquiring and integrating in concert with enterprise business needs and goals.  When that is the case, then security-as-a-service must be a consideration for your enterprise.

Now let’s also consider outbound data. Federation is not only important. It is the driving need to ensure the safety of this nebulous enterprise perimeter. Your users are accessing third-party applications like salesforce.com or ADP, Webex, SharePoint, etc and you must provide the access in support of business needs.  Whereas much of inbound can be federated using cloud-based identity management as a baseline, anything outbound must be SAML-aware.  You need to insist on SAML-based federation before you approve any outside program. If not, you better think twice about including it as an option.

If there is one takeaway from this, it is that unless you decide to evolve with the changing demands of business, your architecture will be compromised by an expanding creep of Shadow IT and their accompanying Shadow Identities. If you realize that now your data can be anywhere, you must centralize the access to that data. By taking full advantage of cloud-based security, you not only benefit from the cost-efficiencies, but your gain all the built-in federations and integrated resources, as well as best-of-breed password management and single-sign on.  Then there are the compliance and reporting needs and how a strong security-as-a-service offering effectively addresses that pressing requirement…but we’ll leave that for another day.

Kevin Nikkhoo
www.cloudaccess.com

More Stories By Kevin Nikkhoo

With more than 32 years of experience in information technology, and an extensive and successful entrepreneurial background, Kevin Nikkhoo is the CEO of the dynamic security-as-a-service startup Cloud Access. CloudAccess is at the forefront of the latest evolution of IT asset protection--the cloud.

Kevin holds a Bachelor of Science in Computer Engineering from McGill University, Master of Computer Engineering at California State University, Los Angeles, and an MBA from the University of Southern California with emphasis in entrepreneurial studies.

@MicroservicesExpo Stories
The notion of improving operational efficiency is conspicuously absent from the healthcare debate - neither Obamacare nor the newly proposed GOP plan discusses the impact that a step-function improvement in efficiency could have on access to healthcare (through more capacity), quality of healthcare services (through reduced wait times for patients) or cost (through better utilization of scarce, expensive assets).
Some people are directors, managers, and administrators. Others are disrupters. Eddie Webb (@edwardawebb) is an IT Disrupter for Software Development Platforms at Liberty Mutual and was a presenter at the 2016 All Day DevOps conference. His talk, Organically DevOps: Building Quality and Security into the Software Supply Chain at Liberty Mutual, looked at Liberty Mutual's transformation to Continuous Integration, Continuous Delivery, and DevOps. For a large, heavily regulated industry, this task...
Our work, both with clients and with tools, has lead us to wonder how it is that organizations are handling compliance issues in the cloud. The big cloud vendors offer compliance for their infrastructure, but the shared responsibility model requires that you take certain steps to meet compliance requirements. Which lead us to start poking around a little more. We wanted to get a picture of what was available, and how it was being used. There is a lot of fluidity in this space, as in all things c...
Gone are the days when application development was the daunting task of the highly skilled developers backed with strong IT skills, low code application development has democratized app development and empowered a new generation of citizen developers. There was a time when app development was in the domain of people with complex coding and technical skills. We called these people by various names like programmers, coders, techies, and they usually worked in a world oblivious of the everyday pri...
The goal of Microservices is to improve software delivery speed and increase system safety as scale increases. Microservices being modular these are faster to change and enables an evolutionary architecture where systems can change, as the business needs change. Microservices can scale elastically and by being service oriented can enable APIs natively. Microservices also reduce implementation and release cycle time and enables continuous delivery. This paper provides a logical overview of the Mi...
The “Digital Era” is forcing us to engage with new methods to build, operate and maintain applications. This transformation also implies an evolution to more and more intelligent applications to better engage with the customers, while creating significant market differentiators. In both cases, the cloud has become a key enabler to embrace this digital revolution. So, moving to the cloud is no longer the question; the new questions are HOW and WHEN. To make this equation even more complex, most ...
Some journey to cloud on a mission, others, a deadline. Change management is useful when migrating to public, private or hybrid cloud environments in either case. For most, stakeholder engagement peaks during the planning and post migration phases of a project. Legacy engagements are fairly direct: projects follow a linear progression of activities (the “waterfall” approach) – change managers and application coders work from the same functional and technical requirements. Enablement and develo...
Admiral Calcote - also known as Lee Calcote (@lcalcote) or the Ginger Geek to his friends - gave a presentation entitled Characterizing and Contrasting Container Orchestrators at the 2016 All Day DevOps conference. Okay, he isn't really an admiral - nor does anyone call him that - but he used the title admiral to describe what container orchestrators do, relating it to an admiral directing a fleet of container ships. You could also say that they are like the conductor of an orchestra, directing...
The past few years have brought a sea change in the way applications are architected, developed, and consumed—increasing both the complexity of testing and the business impact of software failures. How can software testing professionals keep pace with modern application delivery, given the trends that impact both architectures (cloud, microservices, and APIs) and processes (DevOps, agile, and continuous delivery)? This is where continuous testing comes in. D
Modern software design has fundamentally changed how we manage applications, causing many to turn to containers as the new virtual machine for resource management. As container adoption grows beyond stateless applications to stateful workloads, the need for persistent storage is foundational - something customers routinely cite as a top pain point. In his session at @DevOpsSummit at 21st Cloud Expo, Bill Borsari, Head of Systems Engineering at Datera, explored how organizations can reap the bene...
The dynamic nature of the cloud means that change is a constant when it comes to modern cloud-based infrastructure. Delivering modern applications to end users, therefore, is a constantly shifting challenge. Delivery automation helps IT Ops teams ensure that apps are providing an optimal end user experience over hybrid-cloud and multi-cloud environments, no matter what the current state of the infrastructure is. To employ a delivery automation strategy that reflects your business rules, making r...
Gaining visibility in today’s sprawling cloud infrastructure is complex and laborious, involving drilling down into tools offered by various cloud services providers. Enterprise IT organizations need smarter and effective tools at their disposal in order to address this pertinent problem. Gaining a 360 - degree view of the cloud costs requires collection and analysis of the cost data across all cloud infrastructures used inside an enterprise.
SYS-CON Events announced today that Synametrics Technologies will exhibit at SYS-CON's 22nd International Cloud Expo®, which will take place on June 5-7, 2018, at the Javits Center in New York, NY. Synametrics Technologies is a privately held company based in Plainsboro, New Jersey that has been providing solutions for the developer community since 1997. Based on the success of its initial product offerings such as WinSQL, Xeams, SynaMan and Syncrify, Synametrics continues to create and hone in...
Kubernetes is an open source system for automating deployment, scaling, and management of containerized applications. Kubernetes was originally built by Google, leveraging years of experience with managing container workloads, and is now a Cloud Native Compute Foundation (CNCF) project. Kubernetes has been widely adopted by the community, supported on all major public and private cloud providers, and is gaining rapid adoption in enterprises. However, Kubernetes may seem intimidating and complex ...
You know you need the cloud, but you’re hesitant to simply dump everything at Amazon since you know that not all workloads are suitable for cloud. You know that you want the kind of ease of use and scalability that you get with public cloud, but your applications are architected in a way that makes the public cloud a non-starter. You’re looking at private cloud solutions based on hyperconverged infrastructure, but you’re concerned with the limits inherent in those technologies.
For DevOps teams, the concepts behind service-oriented architecture (SOA) are nothing new. A style of software design initially made popular in the 1990s, SOA was an alternative to a monolithic application; essentially a collection of coarse-grained components that communicated with each other. Communication would involve either simple data passing or two or more services coordinating some activity. SOA served as a valid approach to solving many architectural problems faced by businesses, as app...
Many IT organizations have come to learn that leveraging cloud infrastructure is not just unavoidable, it’s one of the most effective paths for IT organizations to become more responsive to business needs. Yet with the cloud comes new challenges, including minimizing downtime, decreasing the cost of operations, and preventing employee burnout to name a few. As companies migrate their processes and procedures to their new reality of a cloud-based infrastructure, an incident management solution...
Cloud Governance means many things to many people. Heck, just the word cloud means different things depending on who you are talking to. While definitions can vary, controlling access to cloud resources is invariably a central piece of any governance program. Enterprise cloud computing has transformed IT. Cloud computing decreases time-to-market, improves agility by allowing businesses to adapt quickly to changing market demands, and, ultimately, drives down costs.
Recent survey done across top 500 fortune companies shows almost 70% of the CIO have either heard about IAC from their infrastructure head or they are on their way to implement IAC. Yet if you look under the hood while some level of automation has been done, most of the infrastructure is still managed in much tradition/legacy way. So, what is Infrastructure as Code? how do you determine if your IT infrastructure is truly automated?
Every few years, a disruptive force comes along that prompts us to reframe our understanding of what something means, or how it works. For years, the notion of what a computer is and how you make one went pretty much unchallenged. Then virtualization came along, followed by cloud computing, and most recently containers. Suddenly the old rules no longer seemed to apply, or at least they didn’t always apply. These disruptors made us reconsider our IT worldview.