|By Gregor Petri||
|August 13, 2016 10:00 AM EDT||
Tune into: Total Security
It took some time but the need for Total Security Management is slowly starting to sink in. With regard to quality it took the western manufacturing industry several decades before it realized that a separate quality department – standing at the end of the production line to check which products did not meet the mandated specs – was a costly and disastrous path to take. And slowly but surely we are seeing similar thinking with regard to cyber and cloud security emerge.
Not that we are taking cloud executives on today’s equivalent of a Japanese factory tour. A quality tour let managers firsthand experience it was everyone’s responsibility to ensure quality and that everyone had the right (and the moral obligation) to personally halt the line when something went wrong. But that may be more because we are not sure yet where the contemporary equivalent of such a tour would need to take our executives. Would it be visiting the hyperscale datacenters of a Google or an Amazon (assuming our executives could get in). Or maybe a visit to the offices of various security start-ups in Silicon Valley and Israel? Or are the cyber control rooms of major telco’s and big accounting firms a better wake up environment? The more courageous may even contemplate a trip to China, Russia or other emerging cyber hotspots, to encounter some of these modern threats in the wild?
I’m not a security expert but to me the similarities between total quality and total security management are very striking. The mantra “Zero Defects” can be easily exchanged for the just as catchy sounding “Zero Breaches” and “Design for Security” is today’s equivalent of “Design for Manufacturing”. With regard to quality it were guru’s like Demming that led the path from expensive and ad hoc quality control at the end of the production line to continuous and iterative quality processes incorporated and embedded into the design and the process.
In the area of security the Jericho Forum already in 2004 pointed out the dangers of merely focusing on perimeter security. In 2013 this forum even deemed itself no longer necessary, in their own words “on the basis of proven success”. Nevertheless it is often still scary what malicious things one can do once inside the firewall of many a company or organization. After complete de-perimeterisation you basically would not need a VPN to reach your applications and be protected from outsiders. Each application would protect itself and decide for each user what he is allowed to do or not do. But with the exception of maybe (web-)email and some SaaS applications, most companies have not come close to setting up the majority of their business applications in a way that they can protect themselves and are no longer dependent on a company perimeter defense.
The advent of micro-services is a good time to re-examine your current security policies. Not only because the security challenges around micro services will typically increase rather than decrease, but also because with the advent of the Internet of Things, security at the source is increasingly mandated and required. Ideally each micro-service will determine itself who does or does not get access to its services and should be able to adequately fence of access attempts by malicious external forces. Also because adding this type of security as an afterthought, on the outside of the service itself, is likely to be cost prohibitive, as many of these external security solutions are at least as pricy as maintaining after the fact quality control , like we did in the days that quality was still a cost instead of a benefit.
With regard to cost, total quality thinking does to reason in terms of an “optimal” rates of defects. A fictional point after which any further reduction of defects will cost more than is economically justifiable. In the end it is namely always cheaper to get things right the first time around, rather than having to return 5%, 0.5% or even 0:05% for repair. Or worse, having to compensate x% of customers for consequential damages (which can easily outweigh the cost of any production improvement). As a result the manufacturing industry no longer measures its defects in percentages but in the initially hard to imagine measure of PPM a.k.a. parts per million. And that iucreasingly in single digits, with a maximum of 1-9 parts per million produced products showing any defect
Now granted, security can be a little bit like health. No matter how healthy you live, you can be unlucky – statistically unexpected but nonetheless very devastating – and get seriously ill. Hence, security is increasingly extending on the one hand from preventive measures to keep out the bad guys, to ongoing monitoring of the current state for anomalies (similar to the active search for signs of a disease in a so-called health pre-scan) and on the other hand by taking measures to reduce the impact of any breaches by counter by beeing able to act appropriately and quickly when something does go wrong. And also for the latter it is necessary that the entire organization is involved with security, it can no longer be delegated to the department at the end of the hall.
Total Madness is the compilation album of the very British Ska revival band Madness. The song “Our House” is about a family that initially is kind of living apart together but that eventually come close together. The song achieved a global cult status in the Netherlands as theme song to the TV hit series “Divorce”.
Without a clear strategy for cost control and an architecture designed with cloud services in mind, costs and operational performance can quickly get out of control. To avoid multiple architectural redesigns requires extensive thought and planning. Boundary (now part of BMC) launched a new public-facing multi-tenant high resolution monitoring service on Amazon AWS two years ago, facing challenges and learning best practices in the early days of the new service.
Mar. 30, 2017 04:00 AM EDT Reads: 3,191
DevOps is often described as a combination of technology and culture. Without both, DevOps isn't complete. However, applying the culture to outdated technology is a recipe for disaster; as response times grow and connections between teams are delayed by technology, the culture will die. A Nutanix Enterprise Cloud has many benefits that provide the needed base for a true DevOps paradigm.
Mar. 30, 2017 01:30 AM EDT Reads: 2,624
The rise of containers and microservices has skyrocketed the rate at which new applications are moved into production environments today. While developers have been deploying containers to speed up the development processes for some time, there still remain challenges with running microservices efficiently. Most existing IT monitoring tools don’t actually maintain visibility into the containers that make up microservices. As those container applications move into production, some IT operations t...
Mar. 30, 2017 01:30 AM EDT Reads: 3,195
DevOps tends to focus on the relationship between Dev and Ops, putting an emphasis on the ops and application infrastructure. But that’s changing with microservices architectures. In her session at DevOps Summit, Lori MacVittie, Evangelist for F5 Networks, will focus on how microservices are changing the underlying architectures needed to scale, secure and deliver applications based on highly distributed (micro) services and why that means an expansion into “the network” for DevOps.
Mar. 30, 2017 01:00 AM EDT Reads: 8,316
Lots of cloud technology predictions and analysis are still dealing with future spending and planning, but there are plenty of real-world cloud use cases and implementations happening now. One approach, taken by stalwart GE, is to use SaaS applications for non-differentiated uses. For them, that means moving functions like HR, finance, taxes and scheduling to SaaS, while spending their software development time and resources on the core apps that make GE better, such as inventory, planning and s...
Mar. 29, 2017 06:45 PM EDT Reads: 964
DevOps is often described as a combination of technology and culture. Without both, DevOps isn't complete. However, applying the culture to outdated technology is a recipe for disaster; as response times grow and connections between teams are delayed by technology, the culture will die. A Nutanix Enterprise Cloud has many benefits that provide the needed base for a true DevOps paradigm. In his Day 3 Keynote at 20th Cloud Expo, Chris Brown, a Solutions Marketing Manager at Nutanix, will explore t...
Mar. 29, 2017 04:00 PM EDT Reads: 3,263
The IT industry is undergoing a significant evolution to keep up with cloud application demand. We see this happening as a mindset shift, from traditional IT teams to more well-rounded, cloud-focused job roles. The IT industry has become so cloud-minded that Gartner predicts that by 2020, this cloud shift will impact more than $1 trillion of global IT spending. This shift, however, has left some IT professionals feeling a little anxious about what lies ahead. The good news is that cloud computin...
Mar. 29, 2017 03:15 PM EDT Reads: 1,643
As Enterprise business moves from Monoliths to Microservices, adoption and successful implementations of Microservices become more evident. The goal of Microservices is to improve software delivery speed and increase system safety as scale increases. Documenting hurdles and problems for the use of Microservices will help consultants, architects and specialists to avoid repeating the same mistakes and learn how and when to use (or not use) Microservices at the enterprise level. The circumstance w...
Mar. 29, 2017 03:00 PM EDT Reads: 4,493
SYS-CON Events announced today that Auditwerx will exhibit at SYS-CON's 20th International Cloud Expo®, which will take place on June 6-8, 2017, at the Javits Center in New York City, NY. Auditwerx specializes in SOC 1, SOC 2, and SOC 3 attestation services throughout the U.S. and Canada. As a division of Carr, Riggs & Ingram (CRI), one of the top 20 largest CPA firms nationally, you can expect the resources, skills, and experience of a much larger firm combined with the accessibility and attent...
Mar. 29, 2017 02:30 PM EDT Reads: 832
SYS-CON Events announced today that HTBase will exhibit at SYS-CON's 20th International Cloud Expo®, which will take place on June 6-8, 2017, at the Javits Center in New York City, NY. HTBase (Gartner 2016 Cool Vendor) delivers a Composable IT infrastructure solution architected for agility and increased efficiency. It turns compute, storage, and fabric into fluid pools of resources that are easily composed and re-composed to meet each application’s needs. With HTBase, companies can quickly prov...
Mar. 29, 2017 02:15 PM EDT Reads: 3,357
Everyone wants to use containers, but monitoring containers is hard. New ephemeral architecture introduces new challenges in how monitoring tools need to monitor and visualize containers, so your team can make sense of everything. In his session at @DevOpsSummit, David Gildeh, co-founder and CEO of Outlyer, will go through the challenges and show there is light at the end of the tunnel if you use the right tools and understand what you need to be monitoring to successfully use containers in your...
Mar. 29, 2017 01:45 PM EDT Reads: 1,999
What if you could build a web application that could support true web-scale traffic without having to ever provision or manage a single server? Sounds magical, and it is! In his session at 20th Cloud Expo, Chris Munns, Senior Developer Advocate for Serverless Applications at Amazon Web Services, will show how to build a serverless website that scales automatically using services like AWS Lambda, Amazon API Gateway, and Amazon S3. We will review several frameworks that can help you build serverle...
Mar. 29, 2017 01:30 PM EDT Reads: 2,322
Buzzword alert: Microservices and IoT at a DevOps conference? What could possibly go wrong? In this Power Panel at DevOps Summit, moderated by Jason Bloomberg, the leading expert on architecting agility for the enterprise and president of Intellyx, panelists peeled away the buzz and discuss the important architectural principles behind implementing IoT solutions for the enterprise. As remote IoT devices and sensors become increasingly intelligent, they become part of our distributed cloud enviro...
Mar. 29, 2017 12:15 PM EDT Reads: 7,999
@DevOpsSummit has been named the ‘Top DevOps Influencer' by iTrend. iTrend processes millions of conversations, tweets, interactions, news articles, press releases, blog posts - and extract meaning form them and analyzes mobile and desktop software platforms used to communicate, various metadata (such as geo location), and automation tools. In overall placement, @DevOpsSummit ranked as the number one ‘DevOps Influencer' followed by @CloudExpo at third, and @MicroservicesE at 24th.
Mar. 29, 2017 10:45 AM EDT Reads: 10,557
By now, every company in the world is on the lookout for the digital disruption that will threaten their existence. In study after study, executives believe that technology has either already disrupted their industry, is in the process of disrupting it or will disrupt it in the near future. As a result, every organization is taking steps to prepare for or mitigate unforeseen disruptions. Yet in almost every industry, the disruption trend continues unabated.
Mar. 29, 2017 09:00 AM EDT Reads: 974
In his General Session at 16th Cloud Expo, David Shacochis, host of The Hybrid IT Files podcast and Vice President at CenturyLink, investigated three key trends of the “gigabit economy" though the story of a Fortune 500 communications company in transformation. Narrating how multi-modal hybrid IT, service automation, and agile delivery all intersect, he will cover the role of storytelling and empathy in achieving strategic alignment between the enterprise and its information technology.
Mar. 29, 2017 08:00 AM EDT Reads: 7,616
While DevOps most critically and famously fosters collaboration, communication, and integration through cultural change, culture is more of an output than an input. In order to actively drive cultural evolution, organizations must make substantial organizational and process changes, and adopt new technologies, to encourage a DevOps culture. Moderated by Andi Mann, panelists discussed how to balance these three pillars of DevOps, where to focus attention (and resources), where organizations might...
Mar. 29, 2017 06:30 AM EDT Reads: 6,314
In his session at 20th Cloud Expo, Scott Davis, CTO of Embotics, will discuss how automation can provide the dynamic management required to cost-effectively deliver microservices and container solutions at scale. He will discuss how flexible automation is the key to effectively bridging and seamlessly coordinating both IT and developer needs for component orchestration across disparate clouds – an increasingly important requirement at today’s multi-cloud enterprise.
Mar. 29, 2017 06:00 AM EDT Reads: 2,920
Microservices are a very exciting architectural approach that many organizations are looking to as a way to accelerate innovation. Microservices promise to allow teams to move away from monolithic "ball of mud" systems, but the reality is that, in the vast majority of organizations, different projects and technologies will continue to be developed at different speeds. How to handle the dependencies between these disparate systems with different iteration cycles? Consider the "canoncial problem" ...
Mar. 29, 2017 06:00 AM EDT Reads: 9,139
The essence of cloud computing is that all consumable IT resources are delivered as services. In his session at 15th Cloud Expo, Yung Chou, Technology Evangelist at Microsoft, demonstrated the concepts and implementations of two important cloud computing deliveries: Infrastructure as a Service (IaaS) and Platform as a Service (PaaS). He discussed from business and technical viewpoints what exactly they are, why we care, how they are different and in what ways, and the strategies for IT to transi...
Mar. 29, 2017 05:00 AM EDT Reads: 6,508