Serveless Architectures brings the ability to independently scale, deploy and heal based on workloads and move away from monolithic designs. From the front-end, middle-ware and back-end layers, serverless workloads potentially have a larger security risk surface due to the many moving pieces. This talk will focus on key areas to consider for securing end to end, from dev to prod. We will discuss patterns for end to end TLS, session management, scaling to absorb attacks and mitigation techniques.
Monthly Archives: May 2018
Danger within: Defending cloud environments against insider threats
According to a recent study by Crowd Research Partners, over 90% of organisations feel vulnerable to insider attacks. This should come as no surprise. Cloud adoption and bring your own device (BYOD) policies have greatly improved businesses’ agility, but have also made sensitive business data much more readily accessible, presenting a significant IT security challenge. This is clearly demonstrated in the recent incidents involving BUPA, Morrisons and the CIA.
Of those questioned by Crowd Research Partners, 53% confirmed that they had experienced an insider attack in the last twelve months; additionally, 27% said that insider attacks have become more commonplace. Both statistics are indicative of the growing threat that insiders pose to data security. Unfortunately, in cloud-based IT environments, organisations often struggle to detect anomalous or careless employee behaviours. As such, many must revise their approaches to data protection. However, before deploying a new security solution, it is important to understand four of the most common insider threats faced by businesses today.
The rogue employee
Often described as malicious insiders, rogue employees are individuals that intentionally set out to steal company data; this may be done out of a desire for vengeance, profit, or even a competitor’s benefit. A high profile example can be found with the 2015 case of a Mercedes engineer that stole highly sensitive data in order to give it to his new employer, Ferrari.
Unfortunately, insiders with malicious intent have an upper hand when it comes to data theft – they have legitimate credentials that will bypass the majority of their organisations’ security features. If such an individual holds a senior or administrative role, she or he may even have unfettered access to an organisation’s most sensitive data
The third-party employee
Third parties are frequently overlooked when organisations are planning their security strategies. These insiders often act as fully integrated members of an organisation, even when working from distant locations. Some may also have in-depth familiarity with internal processes and controls, making them just as knowledgeable about security procedures as an internal employee.
The hacked account
Compromised credentials are a significant danger for the enterprise. With usernames and passwords in hand, outside parties can enter corporate networks through legitimate means and evade security systems. An example of this can be found with the global accountancy firm Deloitte. Recently, hackers compromised the organisation’s global email server using a stolen admin account, granting them unfettered access throughout the entire system for months before their activities were discovered.
As this example shows, breaches involving credential compromise can take a great deal of time to identify and remediate. From an IT perspective, it can appear as though account hijackers are simply regular users going about their normal job duties, making it difficult to detect credential compromise.
The careless worker
While disgruntled workers clearly pose a serious threat to organisational security, a less obvious threat rests with happy, but careless employees. These individuals may inadvertently compromise security by using unsecured public Wi-Fi, losing organisational credentials, clicking on suspicious email links, sharing sensitive information with unauthorised parties, or being followed into the office through an access-controlled door. Each of these mishaps offers criminals an opportunity to breach the enterprise.
What can organisations do?
The unpredictable nature of insider threats means that a proactive, multi-faceted solution is the best form of defence. Below are four different approaches to security which, when combined, create robust protections around cloud-based environments.
Automation: Reactive tools that rely upon humans to manually analyse threats are incapable of protecting data in the high-speed era of the cloud. As such, automated security solutions are vital for businesses today. These kinds of tools employ machine learning so that they can identify malicious or suspicious behaviours as they take place; for example, when a user suddenly downloads an unusually large amount of data or accesses sensitive information outside of normal working hours. These tools use an analytical, real-time approach in order to uncover threatening behaviour and take corrective actions as needed.
Identity and access management (IAM): To defend against insider threats, it is imperative that organisations verify users’ identities and grant data access to appropriate parties only. Relying upon basic passwords is no longer an adequate strategy for protecting corporate information. Instead, companies need to leverage multi-factor authentication (MFA) and require a second form of verification – like an SMS token sent via email or text message. Other helpful capabilities include contextual access control, which governs data access by factors like job function and geographic location, as well as session management, which automatically logs inactive users out of corporate applications in order to prevent account hijacking.
Data loss prevention (DLP): Cloud DLP is a dynamic tool that securely enables employees to work wherever they want and whenever they want – from the devices of their choosing. A typical cloud DLP offering should include watermarking (tracking), file encryption, redaction, and other features that help ensure that sensitive data never gets into the wrong hands.
Training: While technology can be a powerful way to improve data security, another effective tool is far simpler. Regular employee training s can raise awareness of security best practices and help keep data protection top of mind for workers. By consistently discussing the importance of security and the consequences of failing to uphold security protocols, the threats of data theft and data leakage can be minimised.
Conclusion
The growing adoption of cloud has greatly improved the agility of many modern businesses. However, it has also given rise to new security concerns – like the insider threats detailed above. Fortunately, by understanding modern threats and deploying appropriate security solutions, many of these risks can be mitigated and even eliminated. In this way, organisations around the world can confidently step into future and secure their use of the cloud.
Logan Vadivelu Joins @CloudEXPO Faculty | @IBMcloud @LV1999 #AI #Cognitive #MachineLearning #DigitalTransformation
Enterprises are striving to become digital businesses for differentiated innovation and customer-centricity. Traditionally, they focused on digitizing processes and paper workflow. To be a disruptor and compete against new players, they need to gain insight into business data and innovate at scale. Cloud and cognitive technologies can help them leverage hidden data in SAP/ERP systems to fuel their businesses to accelerate digital transformation success.
How resellers can make a difference in enabling organisations’ cloud transformations
Resellers and channel partners can do more to guide organisations into a cloudy future by leveraging IaaS and PaaS solutions, according to a new report from Ingram Micro.
The study, which surveyed 250 UK-based cloud end users as well as 50 resellers, found Azure was the most popular IaaS solution sold by resellers, followed by Amazon S3 and Google Compute Engine – while Azure is significantly ahead on the PaaS side.
The paper’s hypothesis is simple. As organsiations’ cloud desires are often set back by security concerns, pricing, or a general lack of knowledge around the technology’s capabilities, resellers should have a role to play in smoothing the edges. But the resellers are not holding up their end of the bargain.
“Perceptions remain that procuring a cloud solution directly from a developer is a better option, but the fact that end users still have reservations about the technology in general demonstrates that further evolution is required in the way cloud products and services are offered,” the report opens. “With the tailored services and expertise they provide, resellers have the power to be central to this transformation.”
Azure is a product option for 68% of those polled on the IaaS side and for 88% of respondents on PaaS. Amazon S3 for IaaS was cited by 57% and EC2 by 56% for PaaS respectively, while Google Compute Engine and App Engine both scored the same (52%).
Yet only 8% of cloud end users said they worked exclusively in the channel for procurement. For comparison, half of respondents said they bought cloud directly from the developer. Three in five (59%) who do say it’s cheaper, while more than half (54%) cited support as key. The report notes that these figures are not overwhelming – so it is an area where channel partners can step in.
“Resellers need to reassure end users that they can match the price offered the developer,” the report notes. “In many cases, this is about changing the perception that working purely with developers represents the best value option. If resellers make their pricing structures and the ways in which they add value clear, and review these on a regular basis to make sure they remain competitive, this gap between developers and the channel will begin to close.”
Competitive pricing was cited by 74% of those polled as the most appealing element to a cloud solution, behind only security (83%) and ahead of scalability (68%). But more than a dozen options, including payments, business intelligence, and data warehousing and big data analytics, were cited by respondents. Here, the report argues, resellers’ expertise can again come to the fore.
“If partners are to effectively grow their presence in the cloud marketplace, it is essential that they build their offerings around a solution that is highly available, secure, scalable, and more importantly enables the business to be more agile within its operation,” said Apay Obang-Oyway, Ingram Micro UK&I director of cloud and software.
“The options are vast and the hyperscale nature of many offerings means that they can be leveraged to suit a wide range of business requirements,” added Obang-Oyway. “This represents a huge business opportunity for the channel, and explains why resellers typically offer solutions from a variety of providers.
“This need to be flexible and agile is exactly why these top three solutions seem to be most prevalent within end users.”
You can read the full report here (registration required).
Gary Melling Joins @CloudEXPO Faculty | @CIQNorbert #AI #MachineLearning #ArtificialIntelligence #DigitalTransformation
Disruption, Innovation, Artificial Intelligence and Machine Learning, Leadership and Management hear these words all day every day… lofty goals but how do we make it real? Add to that, that simply put, people don’t like change. But what if we could implement and utilize these enterprise tools in a fast and “Non-Disruptive” way, enabling us to glean insights about our business, identify and reduce exposure, risk and liability, and secure business continuity?
It’s not too late for resellers yet to embrace cloud
1 May, 2018
With the new year behind us, businesses are finalising their investment strategies for the year ahead, including confirming their IT spend. As is always the case at this time of year, we can expect both businesses and the channel to be inundated with marketing from vendors pushing new technologies like the cloud, IoT and AI, and making bold claims about how these technologies are going to revolutionise their industry.
While it’s an exciting time for any business that wants to stay ahead, seemingly disruptive technology integrations can be off-putting. For many organisations, the last thing they want is disruption and upheaval that might distract them from doing business.
Building a 2018 IT strategy that’s right for both the businesses and the channel
That doesn’t mean that the best approach for channel organisations and their customers is to simply stick to tried and tested, outdated technology and ignore the digital revolution that is going on around us.
There’s no denying that migrating to cloud communications provides a number of business benefits, such as increasing productivity, as well as helping businesses to meet the demands of the increasingly flexible workforce. Aside from enabling remote workers to seamlessly work from anywhere, anytime and on any device, a fully integrated cloud communications solution also empowers a business to be more nimble and reactive to changing demands. In particular, this allows organisations to deliver a greater customer experience to differentiate from the competition or simply stay in the game.
Simply overlooking any form of modernisation is a guaranteed way to get left behind, but it’s possible to future-proof businesses without taking a huge leap that’s as confusing for the reseller as it is for the business.
In many cases, channel partners are getting a hard-coded message: “You’re either in the cloud or you’re not”. Yet the reality is much more measured. There are many opportunities to move into the cloud gradually with the right providers and the right strategy, and to educate customers about the right options for them along the way.
There’s no one size fits all approach to cloud
Organisations of different sizes and levels of IT maturity, or even different sectors require tailored cloud strategies. On a basic level, smaller organisations tend to have fewer barriers when it comes to moving to the cloud.
In contrast, large corporations are often faced with a more daunting task, which can involve moving on-premise implementations to cloud solutions within their overall corporate IT environment. On top of this, these businesses often have to deal with strict security requirements, regulation, or bricks-and-mortar infrastructure. In these cases, a public cloud solution may never be appropriate and a private or hybrid cloud solution is likely to be more suitable.
The speed at which an organisation wants to transition to the cloud, as well as the spread of the enterprise, will also influence the type of cloud strategy that fits the business. Those that operate globally have to ensure that this transition is smooth and consistent across locations. Hybrid cloud enables them to create a private cloud infrastructure, regionalising their implementation and serving a specified set of premises and remote workers within each country or regional entity.
The key point to remember is that the transition to cloud is an ongoing journey for many businesses, not an overnight switch. Resellers can take this same measured approach to offering cloud solutions. Their customers aren’t going to immediately throw their on-premise platforms out of the window, so resellers who are yet to embrace cloud still have an opportunity to be part of this journey with them.
Planning for success in 2018
The reality is that the priorities of the channel and their customers are in many cases aligned when it comes to cloud – while they are aware that the benefits of cloud cannot be ignored forever, they are understandably resistant to anything that will be overtly disruptive to their operations. Consequently, it’s important that a measured approach is taken on both sides – to ensure that the technology investment fits with the individual business’ needs and supports the business’ sustainability and growth.
It’s widely acknowledged that migrating to cloud communications is a powerful tool in breaking down borders, cutting costs and raising productivity – cloud adoption in the UK is now at 88%, according to the Cloud Industry Forum. As we head into 2018, there’s a real opportunity for the channel to work with clients to provide the support they need and advise them on their individual cloud journey.
Jeremy Butt is senior vice president EMEA at Mitel
Image: Shutterstock
Jon Leach Joins @CloudEXPO Faculty | @Proquantify #CloudNative #Serverless #AWS #DevOps #DigitalTransformation
If your cloud deployment is on AWS with predictable workloads, Reserved Instances (RIs) can provide your business substantial savings compared to pay-as-you-go, on-demand services alone. Continuous monitoring of cloud usage and active management of Elastic Compute Cloud (EC2), Relational Database Service (RDS) and ElastiCache through RIs will optimize performance. Learn how you can purchase and apply the right Reserved Instances for optimum utilization and increased ROI.
How to Optimize TCP | @DevOpsSummit @Catchpoint #DX #DevOps #WebPerf
TCP (Transmission Control Protocol) is a common and reliable transmission protocol on the Internet. TCP was introduced in the 70s by Stanford University for US Defense to establish connectivity between distributed systems to maintain a backup of defense information. At the time, TCP was introduced to communicate amongst a selected set of devices for a smaller dataset over shorter distances. As the Internet evolved, however, the number of applications and users, and the types of data accessed and stored also evolved. The original intent of TCP was to communicate data in the form of text across computers; today’s data transfer is more complex including high pixel images, audio files, and video delivery.
Fitbit and Google announce cloud collaboration to boost digital health and wellbeing
1 May, 2018
Fitbit has announced plans to use Google’s Cloud Healthcare API to better connect user data with medical records, in a bid to provide enhanced levels of personalised patient care whilst at the same time broadening its own reach in the digital health and wearables space.
The wearable fitness tracker manufacturer hopes to connect its devices to the electronic medical records (EMR) systems used by doctors and hospitals, with the aim of enabling healthcare practitioners to get health data straight from the patients’ device.
“Over the past decade, we have built an incredible foundation as the leading wearables brand, helping millions of people around the world make lasting behavior changes that improve their health and wellness through fun and engaging experiences,” said James Park, co-founder and CEO of Fitbit.
“Working with Google gives us an opportunity to transform how we scale our business, allowing us to reach more people around the world faster, while also enhancing the experience we offer to our users and the healthcare system. This collaboration will accelerate the pace of innovation to define the next generation of healthcare and wearables.”
In addition, the two companies hope the collaboration will enable better management – by a patient and medical professionals working together using the information available – of chronic healthcare issues such as diabetes and hypertension by making use of the cloud-based healthcare API and Fitbit’s Twine Health.
Google’s cloud data storage platform is largely certified as complying with the federal Health Insurance Portability and Accountability Act (HIPPA), which regulates the use of medical records, which frees Fitbit from having to build its own system that complies with the law.
“At Google, our vision is to transform the way health information is organized and made useful,” added Gregory Moore MD, PhD, vice president, Healthcare, Google Cloud.
“By enabling Fitbit to connect and manage key health and fitness data using our Google Cloud Healthcare API, we are getting one step closer to this goal. Together, we have the opportunity to deliver up-to-date information to providers, enhancing their ability to follow and manage the health of their patients and guide their treatment.”
Following news of the deal, Fitbit’s shares rose five percent to close at $5,55 on Monday.
DevOps and Cloud Craftsmanship | @DevOpsSummit @CAinc #CloudNative #AI #Serverless #Agile #DevOps
Five years ago development was seen as a dead-end career, now it’s anything but – with an explosion in mobile and IoT initiatives increasing the demand for skilled engineers. But apart from having a ready supply of great coders, what constitutes true ‘DevOps Royalty’? It’ll be the ability to craft resilient architectures, supportability, security everywhere across the software lifecycle. In his keynote at @DevOpsSummit at 20th Cloud Expo, Jeffrey Scheaffer, GM and SVP, Continuous Delivery Business Unit at CA Technologies, will share his vision about the true ‘DevOps Royalty’ and how it will take a new breed of digital cloud craftsman, architecting new platforms with a new set of tools to achieve it. He will also present a number of important insights and findings from a recent cloud and DevOps study – outlining the synergies high performance teams are exploiting to gain significant business advantage.