Welcome!

Microservices Expo Authors: Dalibor Siroky, Elizabeth White, Pat Romanski, John Katrick, Liz McMillan

Related Topics: @CloudExpo, Microservices Expo, Cloud Security, @DXWorldExpo, SDN Journal

@CloudExpo: Blog Post

The Extended Enterprise Perimeter By @E_deSouza | @CloudExpo [#Cloud]

The explosive growth of cloud traffic has fundamentally changed the means by which today’s contemporary businesses operate

Redefining the Extended Enterprise Cloud Perimeter with Network-Centric Security

Cloud has become an extension of today's enterprise and the traditional perimeter has long disappeared. Increasing business requirements for agility and flexibility make the cloud-extended enterprise ideal for a workforce that works anywhere, anytime and any place. This is especially true as organizations are increasingly made up of third-party resources, partners and suppliers compared to just employees.

However, traditional security models are not equipped to deal with the fluid nature of data and network flows that extend from the enterprise into a mix of multiple clouds. This not only creates concerns about network resiliency and availability, it puts key business transactions, assets and access to critical work streams at business risk. As organizations continue to embrace cloud models, IT and InfoSec teams need to find a way to reinvent security so that they have seamless visibility across their enterprise and into the different cloud models their businesses are using. This is where adopting a data and network-centric approach is pivotal.

Don't miss Cisco webcast titled 'Is Your Data Center Ready for the Application Economy?', focuses on the latest data center networking technologies, including SDN or ACI, and how customers are using SDN and ACI in their organizations to achieve business agility. The Cisco webcast takes place January 13, 2015, at 9:00 a.m. PST. Register ▸ Here

The explosive growth of cloud traffic has fundamentally changed the means by which today's contemporary businesses operate. In 2013, cloud accounted for 54% of total data center traffic, and, by 2018, cloud will account for 76% of total data center traffic[1]. It has left many IT and Information Security teams struggling to address the risk vectors presented by the cloud as in most cases cloud has been driven by business user demands. Therefore, IT and InfoSec typically have only started to address the cloud-extended enterprise as cloud consumption has reached critical mass.

IT and InfoSec must adapt and consider an alternative means to maintain the confidentiality, integrity and availability of their business services, data and users. Doing so becomes so much more important in a climate where data breaches are targeting both business and personal information and hacktivisim is on the rise[2]. It's clear that traditional perimeter-based security has failed to keep up with the demands of modern enterprises and the techniques and technologies used by attackers have far outpaced traditional security.

Cloud is effectively distributed computing without hierarchical, organizational or geographic constraint. For the ‘extended cloud enterprise' to operate effectively, network policies must extend from the enterprise into the cloud, and contextual access control becomes pivotal as does a data-centric approach in which security policies are tightly aligned to the type of data that is being exchanged.

While there isn't any one formula that will work for all organizations, the following are some key considerations for organizations in the throes of having to re-invent their security to address the needs of the cloud-extended enterprise.

Start first with a data classification model as it will enable security policies to be based on key attributes of the data - whether it is subject to regulation or contains PII, whether it is subject to a industry standards such as PCI or contains intellectual IP or whether it has a near publicly accessible profile. An example of a baseline data classification scheme for the cloud-extended enterprise can be found at Cloud Data Protection Cert[3]. A major component of implementing a data protection scheme is educating business users on why protecting data matters and getting them to map their assets, preferably by digitally tagging, to your organization's scheme.

Many organizations today have not used network diagrams to map data flows, and as a result they lack visibility to where their key information is traversing. Use firewalls that provide multi-tenant edge security that integrates with firewall policies in an Infrastructure as a Service (IaaS) cloud environment. This enables your organization to extend the same network policies into a public cloud environment and have an additional level of control and visibility across the cloud-extended enterprise.

In a SaaS environment, using a cloud web gateway can instill a higher degree of confidence by enforcing consistent threat management across web streams, and more easily identifying and addressing key activities for data loss prevention on data leaving your organization per the classification scheme outlined above.

Data protection measures such as encryption and tokenization are critical protection measures and they should be implemented before migrating data to public cloud environments. Protection measures should be linked to the data attributes of your organization's data classification scheme and when applying encryption, apply in transit and at rest.

Managing user identities becomes more complex in the cloud-extended enterprise, which now needs to factor in the provider's computing resources and personnel. Think of ‘who' (in terms of user context) and ‘what' (in terms of digital assets) with ‘whom' (the CSP) as fundamentals in your cloud extended enterprise security framework. Leverage a centralized identity management framework together with contextual access and compensating controls. Correlate identities with continuous logging and network monitoring for data infiltration, exfiltration and anomalies and other intrusion or extrusion attempts across the enterprise.

Register for Cisco Webcast ▸ Here

Finally, as your organization further extends into the cloud in 2015, consider implementing a cloud security metrics analysis platform for more accurate security decisioning and metrics that can be shared with your executive board on the cloud-extended enterprise. As security teams embrace the cloud-extended enterprise, they have the opportunity to design security that provides greater levels of visibility and trust while accelerating an agile business and the needs of today's business users.

Resources:

  1. Cisco Global Cloud Index: Forecast and Methodology, 2013-201
  2. Worst Security Breaches of the Year 2014
  3. http://clouddataprotection.org/cert/

More Stories By Evelyn de Souza

Recognized as one of the top ten women in cloud (CloudNOW), Evelyn De Souza, chair of the Cloud Security Alliance Data Governance Working Group and a leader at Cisco, is a pioneer in the cloud security space and deals with these issues on a daily basis. According to Evelyn, the network becomes pivotal in redefining cloud security and providing new levels of trust, visibility and resilience.

Comments (0)

Share your thoughts on this story.

Add your comment
You must be signed in to add a comment. Sign-in | Register

In accordance with our Comment Policy, we encourage comments that are on topic, relevant and to-the-point. We will remove comments that include profanity, personal attacks, racial slurs, threats of violence, or other inappropriate material that violates our Terms and Conditions, and will block users who make repeated violations. We ask all readers to expect diversity of opinion and to treat one another with dignity and respect.


@MicroservicesExpo Stories
The nature of test environments is inherently temporary—you set up an environment, run through an automated test suite, and then tear down the environment. If you can reduce the cycle time for this process down to hours or minutes, then you may be able to cut your test environment budgets considerably. The impact of cloud adoption on test environments is a valuable advancement in both cost savings and agility. The on-demand model takes advantage of public cloud APIs requiring only payment for t...
"Codigm is based on the cloud and we are here to explore marketing opportunities in America. Our mission is to make an ecosystem of the SW environment that anyone can understand, learn, teach, and develop the SW on the cloud," explained Sung Tae Ryu, CEO of Codigm, in this SYS-CON.tv interview at 21st Cloud Expo, held Oct 31 – Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA.
High-velocity engineering teams are applying not only continuous delivery processes, but also lessons in experimentation from established leaders like Amazon, Netflix, and Facebook. These companies have made experimentation a foundation for their release processes, allowing them to try out major feature releases and redesigns within smaller groups before making them broadly available. In his session at 21st Cloud Expo, Brian Lucas, Senior Staff Engineer at Optimizely, discussed how by using ne...
Many enterprise and government IT organizations are realizing the benefits of cloud computing by extending IT delivery and management processes across private and public cloud services. But they are often challenged with balancing the need for centralized cloud governance without stifling user-driven innovation. This strategy requires an approach that fundamentally reshapes how IT is delivered today, shifting the focus from infrastructure to services aggregation, and mixing and matching the bes...
"CA has been doing a lot of things in the area of DevOps. Now we have a complete set of tool sets in order to enable customers to go all the way from planning to development to testing down to release into the operations," explained Aruna Ravichandran, Vice President of Global Marketing and Strategy at CA Technologies, in this SYS-CON.tv interview at DevOps Summit at 21st Cloud Expo, held Oct 31 – Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA.
While we understand Agile as a means to accelerate innovation, manage uncertainty and cope with ambiguity, many are inclined to think that it conflicts with the objectives of traditional engineering projects, such as building a highway, skyscraper or power plant. These are plan-driven and predictive projects that seek to avoid any uncertainty. This type of thinking, however, is short-sighted. Agile approaches are valuable in controlling uncertainty because they constrain the complexity that ste...
Cavirin Systems has just announced C2, a SaaS offering designed to bring continuous security assessment and remediation to hybrid environments, containers, and data centers. Cavirin C2 is deployed within Amazon Web Services (AWS) and features a flexible licensing model for easy scalability and clear pay-as-you-go pricing. Although native to AWS, it also supports assessment and remediation of virtual or container instances within Microsoft Azure, Google Cloud Platform (GCP), or on-premise. By dr...
"This all sounds great. But it's just not realistic." This is what a group of five senior IT executives told me during a workshop I held not long ago. We were working through an exercise on the organizational characteristics necessary to successfully execute a digital transformation, and the group was doing their ‘readout.' The executives loved everything we discussed and agreed that if such an environment existed, it would make transformation much easier. They just didn't believe it was reali...
Agile has finally jumped the technology shark, expanding outside the software world. Enterprises are now increasingly adopting Agile practices across their organizations in order to successfully navigate the disruptive waters that threaten to drown them. In our quest for establishing change as a core competency in our organizations, this business-centric notion of Agile is an essential component of Agile Digital Transformation. In the years since the publication of the Agile Manifesto, the conn...
"We're developing a software that is based on the cloud environment and we are providing those services to corporations and the general public," explained Seungmin Kim, CEO/CTO of SM Systems Inc., in this SYS-CON.tv interview at 21st Cloud Expo, held Oct 31 – Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA.
It’s “time to move on from DevOps and continuous delivery.” This was the provocative title of a recent article in ZDNet, in which Kelsey Hightower, staff developer advocate at Google Cloud Platform, suggested that “software shops should have put these concepts into action years ago.” Reading articles like this or listening to talks at most DevOps conferences might make you think that we’re entering a post-DevOps world. But vast numbers of organizations still struggle to start and drive transfo...
The cloud revolution in enterprises has very clearly crossed the phase of proof-of-concepts into a truly mainstream adoption. One of most popular enterprise-wide initiatives currently going on are “cloud migration” programs of some kind or another. Finding business value for these programs is not hard to fathom – they include hyperelasticity in infrastructure consumption, subscription based models, and agility derived from rapid speed of deployment of applications. These factors will continue to...
While some developers care passionately about how data centers and clouds are architected, for most, it is only the end result that matters. To the majority of companies, technology exists to solve a business problem, and only delivers value when it is solving that problem. 2017 brings the mainstream adoption of containers for production workloads. In his session at 21st Cloud Expo, Ben McCormack, VP of Operations at Evernote, discussed how data centers of the future will be managed, how the p...
Enterprises are adopting Kubernetes to accelerate the development and the delivery of cloud-native applications. However, sharing a Kubernetes cluster between members of the same team can be challenging. And, sharing clusters across multiple teams is even harder. Kubernetes offers several constructs to help implement segmentation and isolation. However, these primitives can be complex to understand and apply. As a result, it’s becoming common for enterprises to end up with several clusters. Thi...
Let's do a visualization exercise. Imagine it's December 31, 2018, and you're ringing in the New Year with your friends and family. You think back on everything that you accomplished in the last year: your company's revenue is through the roof thanks to the success of your product, and you were promoted to Lead Developer. 2019 is poised to be an even bigger year for your company because you have the tools and insight to scale as quickly as demand requires. You're a happy human, and it's not just...
DevOps teams have more on their plate than ever. As infrastructure needs grow, so does the time required to ensure that everything's running smoothly. This makes automation crucial - especially in the server and network monitoring world. Server monitoring tools can save teams time by automating server management and providing real-time performance updates. As budgets reset for the New Year, there is no better time to implement a new server monitoring tool (or re-evaluate your current solution)....
We just came off of a review of a product that handles both containers and virtual machines in the same interface. Under the covers, implementation of containers defaults to LXC, though recently Docker support was added. When reading online, or searching for information, increasingly we see “Container Management” products listed as competitors to Docker, when in reality things like Rocket, LXC/LXD, and Virtualization are Dockers competitors. After doing some looking around, we have decided tha...
"Opsani helps the enterprise adopt containers, help them move their infrastructure into this modern world of DevOps, accelerate the delivery of new features into production, and really get them going on the container path," explained Ross Schibler, CEO of Opsani, and Peter Nickolov, CTO of Opsani, in this SYS-CON.tv interview at DevOps Summit at 21st Cloud Expo, held Oct 31 – Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA.
The benefits of automation are well documented; it increases productivity, cuts cost and minimizes errors. It eliminates repetitive manual tasks, freeing us up to be more innovative. By that logic, surely, we should automate everything possible, right? So, is attempting to automate everything a sensible - even feasible - goal? In a word: no. Consider this your short guide as to what to automate and what not to automate.
identify the sources of event storms and performance anomalies will require automated, real-time root-cause analysis. I think Enterprise Management Associates said it well: “The data and metrics collected at instrumentation points across the application ecosystem are essential to performance monitoring and root cause analysis. However, analytics capable of transforming data and metrics into an application-focused report or dashboards are what separates actual application monitoring from relat...