|By Kevin Nikkhoo||
|December 10, 2012 08:00 AM EST||
A few weeks back I was watching my beloved San Diego Chargers lose in a most embarrassing way on Monday night. And in the waning seconds of blaming the quarterback for such ineffectual 2nd half play, it occurred to me, it wasn’t his fault. It was the coach. It was the lack of planning for the type of attack the Denver Broncos would bring. It was the lack of leadership that should have easily closed the deal. In short, it was sticking to the status quo while everything around was changing.
My second epiphany was that this is a spot-on metaphor for the recent spate of bank hacks being levied by the hacktivist group Izz ad-Din al-Qassam. Not to make light of a serious issue, but the Charger collapse reminded me that the most insidious and effective attacks are not brute force in nature. In fact, most banks (according to compliance mandates) have decent processes to repel these attacks. In this case, the brutish DDoS (denial of service) was a feint to misdirect a smaller DDoS attack launched at the same time…and it was these more subtle attacks that were effective against 8 banks and counting. Continuing the football metaphor, it is like showing the blitz and falling back into tight pass defense resulting in the quarterback throwing an interception.
So the moral of the story is organizations need to evolve their security platforms to provide an agile shifting defense and change with the scenarios.
Now this is not to say the sky is falling, but a reputable IT security report noted a 50% increase in total number of DDoS attacks since Q2 of 2011 and a 10% increase since April. This means it’s time to look at your defensive processes and ensure they transcend compliance code. But moreso, to start anticipating what new threats, compliance requirements and business needs might be coming your way. You can’t be that guy who says “I’ll worry about it when I have to worry about it.” You simply can’t be paralyzed by the status quo. It’s a recipe for throwing 4 interceptions in the second half and squandering a 24 point lead.
We grouse a great deal about the burden of compliance, but they create a wall of protection that would otherwise create greater vulnerabilities. But all the audits, all the bureaucracy…it simply detracts from you being able to do the job you were hired to do. So the question begs, how do we evolve? How can we make security management easier yet stronger. Effective yet efficient. Agile yet layered? Proactive rather than reactive? If these questions are keeping you up at night, then it is time you took a deeper look at security-as-a-service or security managed from the cloud.
If you approach the security issue from the traditional sense of on-premise brick-building, server-stacking, resource-adding development, then yes, there are significantly costs in capital expenditures, human resources, and still not guaranteed that you have the necessary functionality, capability and visibility to anticipate tomorrow’s issues.
By implementing a best-of-breed enterprise you gain a holistic view of what’s happening to your enterprise in real time. And because of the cloud computing advantages, the price point is very affordable (for what you are paying in support and maintenance, you could integrate an entire enterprise solution). You gain capability, you lessen expenses and, if your vendor also practices security as a service, your automated efficiencies come with 7/24/365 review of your logs by a live expert analyst.
But let’s put a real face on potential changes. Take FFIEC standards; very soon they will be more than guidelines. It's highly likely they will become compliance mandates. And they force you to address possible vulnerability gaps in your enterprise. Will you be prepared to meet the shifts in emphasis?
- Layered security:
Most compliance-beholden organizations must recognize that security is not just about implementing virus scan and configuring firewalls. Ways and devices people reach your networks are changing quickly. Beyond log management protocols, you might need to add a SIEM or access management components. But the interpretation of layered security is choosing what is monitored and not relying on just a firewall to beat back possible intrusions, worms, phishing expeditions and user carelessness. You need multiple means, protocols and processes managed centrally.
- Real-time, intelligence based assessment
There’s a saying in security circles: If you’ve noticed it, it’s already too late. The goal is to prevent, alert and remediate. And the only way to do this is through round the clock vigilance. Anything less than 24/7/365 monitoring opens the risk door too wide. It’s a cliché, but we are all acutely aware that hackers don’t sleep. But part of the question is not that monitoring is active, but how is it monitored? What data is collected? If you automate too much, you lose the human expertise; the context and the ability to respond effectively. Cloud-based security can cover a large enterprise or modest SMB with the same watchfulness while integrating the human intelligence assessment. Additionally, it provides additional resources, wider intelligence and greater coverage you don't have to fund.
- Rapid adaptation against evolving threats
By applying a solution that uses real-time forensics including advanced correlations to examine for specific patterns, you create real time operational visibility. By recognizing traffic patterns correlated with a variety of other rules and processes you not only remove the false positive alerts, but can predict where your perimeter is soft and takes the necessary steps to shore them up.
- Protect against ID and personal theft
Passwords are not enough. Time and again this has proven to be the weakest link. However, by instituting a solution that includes multi-credentialing, identity management, provisioning and the like, you can secure access to the most sensitive information. And if you make is easy for the user and minimize the impact of their usage experience, you take another step in maintaining the necessary trust while still ensuring people only see what they are supposed to see.
And all this can be deployed and managed from the cloud. The technology and security of these features has already matured to meet the concept.
These FFIEC guidelines seem very vague, but their meaning is clear: today’s operation needs to change. Not to keep up with the bureaucracy, but to improve the scalability, flexibility and control of an often volatile and fluid IT threatscape. However, don’t mistake this as a suggestion for mega-suite replacement. This should be part of any go-forward initiative that builds on or what is already in place. The cloud provides that agility to maintain an enterprise-powered security solution, yet adapt to the changing needs faster and more completely than most organizations can do on their own.
With that said, the best defense against an aggressive opponent is knowing what play is being called. Your holistic view gives you the ability to predict when the blitzes are coming, from what side, and most important, provide the flexibility to call an audible. One thing is for certain, you just can't stand still anymore; you can't rely on the status quo I just wish the Chargers saw that on Monday.
As an additional note, I participated in the development of a white paper for Fairway Technologies called , “Get Your Head Into The Clouds! Industry Experts Answer Today’s Cloud Computing Questions“ ! Fairway’s collaborative new report not only examines the cloud computing issues that are dominating the industry, but also identifies key challenges behind cloud adoption and implementation, and presents best practices for organizations to develop and implement a sound cloud strategy. Guidance on cloud service brokers, open source cloud, data destruction, cloud bursting, and other topical issues are also discussed.
I recently attended and was a speaker at the 4th International Internet of @ThingsExpo at the Santa Clara Convention Center. I also had the opportunity to attend this event last year and I wrote a blog from that show talking about how the “Enterprise Impact of IoT” was a key theme of last year’s show. I was curious to see if the same theme would still resonate 365 days later and what, if any, changes I would see in the content presented.
Nov. 29, 2015 01:00 AM EST Reads: 433
You may have heard about the pets vs. cattle discussion – a reference to the way application servers are deployed in the cloud native world. If an application server goes down it can simply be dropped from the mix and a new server added in its place. The practice so far has mostly been applied to application deployments. Management software on the other hand is treated in a very special manner. Dedicated resources are set aside to run the management software components and several alerting syst...
Nov. 29, 2015 12:00 AM EST Reads: 196
It's been a busy time for tech's ongoing infatuation with containers. Amazon just announced EC2 Container Registry to simply container management. The new Azure container service taps into Microsoft's partnership with Docker and Mesosphere. You know when there's a standard for containers on the table there's money on the table, too. Everyone is talking containers because they reduce a ton of development-related challenges and make it much easier to move across production and testing environm...
Nov. 28, 2015 08:00 PM EST Reads: 615
The Internet of Things (IoT) is growing rapidly by extending current technologies, products and networks. By 2020, Cisco estimates there will be 50 billion connected devices. Gartner has forecast revenues of over $300 billion, just to IoT suppliers. Now is the time to figure out how you’ll make money – not just create innovative products. With hundreds of new products and companies jumping into the IoT fray every month, there’s no shortage of innovation. Despite this, McKinsey/VisionMobile data...
Nov. 28, 2015 01:00 PM EST Reads: 479
Hiring the wrong candidate can cost a company hundreds of thousands of dollars, and result in lost profit and productivity during the search for a replacement. In fact, the Harvard Business Review has found that as much as 80 percent of turnover is caused by bad hiring decisions. But when your organization has implemented DevOps, the job is about more than just technical chops. It’s also about core behaviors: how they work with others, how they make decisions, and how those decisions translate t...
Nov. 28, 2015 12:45 PM EST Reads: 186
With major technology companies and startups seriously embracing IoT strategies, now is the perfect time to attend @ThingsExpo 2016 in New York and Silicon Valley. Learn what is going on, contribute to the discussions, and ensure that your enterprise is as "IoT-Ready" as it can be! Internet of @ThingsExpo, taking place Nov 3-5, 2015, at the Santa Clara Convention Center in Santa Clara, CA, is co-located with 17th Cloud Expo and will feature technical sessions from a rock star conference faculty ...
Nov. 28, 2015 12:00 PM EST Reads: 553
One of the most important tenets of digital transformation is that it’s customer-driven. In fact, the only reason technology is involved at all is because today’s customers demand technology-based interactions with the companies they do business with. It’s no surprise, therefore, that we at Intellyx agree with Patrick Maes, CTO, ANZ Bank, when he said, “the fundamental element in digital transformation is extreme customer centricity.” So true – but note the insightful twist that Maes adde...
Nov. 28, 2015 12:00 PM EST Reads: 447
Just over a week ago I received a long and loud sustained applause for a presentation I delivered at this year’s Cloud Expo in Santa Clara. I was extremely pleased with the turnout and had some very good conversations with many of the attendees. Over the next few days I had many more meaningful conversations and was not only happy with the results but also learned a few new things. Here is everything I learned in those three days distilled into three short points.
Nov. 28, 2015 12:00 PM EST Reads: 338
In his General Session at DevOps Summit, Asaf Yigal, Co-Founder & VP of Product at Logz.io, explored the value of Kibana 4 for log analysis and provided a hands-on tutorial on how to set up Kibana 4 and get the most out of Apache log files. He examined three use cases: IT operations, business intelligence, and security and compliance. Asaf Yigal is co-founder and VP of Product at log analytics software company Logz.io. In the past, he was co-founder of social-trading platform Currensee, which...
Nov. 28, 2015 12:00 PM EST Reads: 235
DevOps is about increasing efficiency, but nothing is more inefficient than building the same application twice. However, this is a routine occurrence with enterprise applications that need both a rich desktop web interface and strong mobile support. With recent technological advances from Isomorphic Software and others, rich desktop and tuned mobile experiences can now be created with a single codebase – without compromising functionality, performance or usability. In his session at DevOps Su...
Nov. 28, 2015 11:45 AM EST Reads: 407
People want to get going with DevOps or Continuous Delivery, but need a place to start. Others are already on their way, but need some validation of their choices. A few months ago, I published the first volume of DevOps and Continuous Delivery reference architectures which has now been viewed over 50,000 times on SlideShare (it's free to download...no registration required). Three things helped people in the deck: (1) the reference architectures, (2) links to the sources for each architectur...
Nov. 28, 2015 11:30 AM EST Reads: 243
Nov. 28, 2015 11:30 AM EST Reads: 225
As organizations realize the scope of the Internet of Things, gaining key insights from Big Data, through the use of advanced analytics, becomes crucial. However, IoT also creates the need for petabyte scale storage of data from millions of devices. A new type of Storage is required which seamlessly integrates robust data analytics with massive scale. These storage systems will act as “smart systems” provide in-place analytics that speed discovery and enable businesses to quickly derive meaningf...
Nov. 28, 2015 11:15 AM EST Reads: 417
Culture is the most important ingredient of DevOps. The challenge for most organizations is defining and communicating a vision of beneficial DevOps culture for their organizations, and then facilitating the changes needed to achieve that. Often this comes down to an ability to provide true leadership. As a CIO, are your direct reports IT managers or are they IT leaders? The hard truth is that many IT managers have risen through the ranks based on their technical skills, not their leadership ab...
Nov. 28, 2015 10:00 AM EST Reads: 400
Continuous processes around the development and deployment of applications are both impacted by -- and a benefit to -- the Internet of Things trend. To help better understand the relationship between DevOps and a plethora of new end-devices and data please welcome Gary Gruver, consultant, author and a former IT executive who has led many large-scale IT transformation projects, and John Jeremiah, Technology Evangelist at Hewlett Packard Enterprise (HPE), on Twitter at @j_jeremiah. The discussion...
Nov. 28, 2015 05:30 AM EST Reads: 735
Discussions of cloud computing have evolved in recent years from a focus on specific types of cloud, to a world of hybrid cloud, and to a world dominated by the APIs that make today's multi-cloud environments and hybrid clouds possible. In this Power Panel at 17th Cloud Expo, moderated by Conference Chair Roger Strukhoff, panelists addressed the importance of customers being able to use the specific technologies they need, through environments and ecosystems that expose their APIs to make true ...
Nov. 28, 2015 04:00 AM EST Reads: 543
The Internet of Things is clearly many things: data collection and analytics, wearables, Smart Grids and Smart Cities, the Industrial Internet, and more. Cool platforms like Arduino, Raspberry Pi, Intel's Galileo and Edison, and a diverse world of sensors are making the IoT a great toy box for developers in all these areas. In this Power Panel at @ThingsExpo, moderated by Conference Chair Roger Strukhoff, panelists discussed what things are the most important, which will have the most profound...
Nov. 28, 2015 03:30 AM EST Reads: 478
Microservices are a very exciting architectural approach that many organizations are looking to as a way to accelerate innovation. Microservices promise to allow teams to move away from monolithic "ball of mud" systems, but the reality is that, in the vast majority of organizations, different projects and technologies will continue to be developed at different speeds. How to handle the dependencies between these disparate systems with different iteration cycles? Consider the "canoncial problem"...
Nov. 28, 2015 03:00 AM EST Reads: 453
Growth hacking is common for startups to make unheard-of progress in building their business. Career Hacks can help Geek Girls and those who support them (yes, that's you too, Dad!) to excel in this typically male-dominated world. Get ready to learn the facts: Is there a bias against women in the tech / developer communities? Why are women 50% of the workforce, but hold only 24% of the STEM or IT positions? Some beginnings of what to do about it! In her Day 2 Keynote at 17th Cloud Expo, San...
Nov. 28, 2015 02:00 AM EST Reads: 583
In today's enterprise, digital transformation represents organizational change even more so than technology change, as customer preferences and behavior drive end-to-end transformation across lines of business as well as IT. To capitalize on the ubiquitous disruption driving this transformation, companies must be able to innovate at an increasingly rapid pace. Traditional approaches for driving innovation are now woefully inadequate for keeping up with the breadth of disruption and change facin...
Nov. 28, 2015 02:00 AM EST Reads: 493