How to improve cloud management through a cloud resource tagging policy

Good cloud governance relies on good tag hygiene: a disciplined, well-designed approach to tagging.

In the multi-cloud environments that enterprises are embracing, implementing enterprise-grade cloud governance platforms is the key to successful management of highly complex pricing structures and evolving cloud services. Using automation to maintain good tag hygiene will support critical governance initiatives for cloud security, cloud cost reporting, and cloud cost optimisation.

Applying a consistent set of tags—specifically for governance—globally across all of your resources will add metadata specific to your organisation. This can help improve categorisation of each of your cloud resources for cost allocation, reporting, chargeback and showback, cost optimisation, compliance, and security. Once implemented, a robust tagging policy will enable your organisation to optimise costs across all cloud providers and guarantee that your company has access to all of the cloud services it requires.

Understand tagging policy

In the absence of a tagging policy, it’s all too common for individuals or teams to use variations of the same tag. When this happens, accurate reporting becomes extremely difficult. To avoid these complications, and to ensure that tags are used effectively for governance and reporting purposes, having a tagging policy is absolutely critical.

A well-defined tagging policy incorporates:

  • Global tags, including how they will be applied consistently by all applications and teams in the organisation. The first table below provides recommended global tags; use this as a starting point from which your organisation can customise with specific tags and naming conventions.
  • Each cloud provider’s tags. As each cloud provider has different limits and restrictions on tags, your tagging policy must accommodate these parameters. The second table below identifies tags for AWS, Azure, and Google Cloud (GCP).
  • Guidelines for how individual teams or applications may add additional tags for their specific needs.
  • Consistent naming conventions, including spacing, uppercase/lowercase conventions, and spacing.

Automation is key to implementing tags. For example, if you are using a cloud management platform for provisioning, all templates should be set up to attach the appropriate tags.

Implement and monitor your tagging policy

Create a staged rollout process for your tagging policy. This will help ensure effective implementation and monitoring, aided by buy-in from all relevant parties.

  • Stage 1: Define the tagging policy: Have your cloud governance team lead a process to define a global tagging policy. The team should work with key stakeholders to get feedback and buy-in. Once this team specifies the required global tags, development teams and resource owners should be responsible for adding the global tags. Central IT may assist with scripts and tools
     
  • Stage 2: Reporting: The cloud governance team creates reports that show the current state; track improvements in tag coverage; and identify the level of coverage for global tags, by team or group. Distribute these reports weekly
     
  • Stage 3: Alerting: Your cloud governance team sets up daily automated alert emails about resources that are missing the required tags. (An organisation may choose to stop at Stage 3 if it has achieved the desired adoption of global tags)
     
  • Stage 4 (optional): Alerting with automated termination or escalation: The cloud governance and central IT teams should also set up automated “tag checking” to alert on missing tags and enforce the use of tags. Alerts on untagged resources specify a defined window (e.g. 24 hours) to tag resources. Enforcement could include sending an escalation to managers or, in some cases, adding default tags or even terminating instances that aren’t tagged correctly (only for non-production workloads)

https://www.cybersecuritycloudexpo.com/wp-content/uploads/2018/09/cyber-security-world-series-1.pngInterested in hearing industry leaders discuss subjects like this and sharing their experiences and use-cases? Attend the Cyber Security & Cloud Expo World Series with upcoming events in Silicon Valley, London and Amsterdam to learn more.

Google services knocked offline after fibre cables cut


Bobby Hellard

20 Dec, 2019

Fibre optic cables in two separate areas were cut at the same time on Thursday morning, leaving parts of Eastern Europe, Iran and Turkey without internet access.

The severing of cables belonging to a third-party telecommunications provider resulted in a loss of connectivity for Google between Bulgaria and the rest of its production network. The issue lasted for two hours and took down Google’s services in those regions.

Sadjad Bonabi, a director at Iran’s Communications Infrastructure Company, told the BBC that two cuts happened at once: one between Iran and Bucharest and the other on a line to Munich.

Multiple cuts to fibre optic cables happening at the same time is a very rare occurrence, according to Google, which also said it has now launched an investigation into the incident.

“The issue with multiple simultaneous fibre cuts affecting traffic routed through Google’s network in Bulgaria has been resolved for all affected users as of 2019-12-19 2:36 US/Pacific,” Google Cloud’s status dashboard said. “Google services were not reachable for users who were accessing these Google services primarily through our Bulgaria network point of presence.”

“We have identified the root cause and routed affected traffic around the impacted parts of our network. We are conducting an internal investigation and will provide a detailed public incident summary at a later date.”

The UK has also experienced a number of incidents involving cable theft or damage throughout 2019. In August and September a spate of attacks on broadband cabling in Cambridgeshire left 4,000 homes and businesses without internet access, with 500 metres of copper wiring stolen as a result.

Amazon criticises New York Times’ reporting of open source theft concerns

AWS vice president Andi Gutmans has penned a scathing response to an article highlighting concerns that Amazon is stealing the innovations of startups.

New York Times journalist Daisuke Wakabayashi wrote an article titled Prime Leverage: How Amazon Wields Power in the Technology World in which he highlighted several cases where Amazon is said to have "strip-mined" (as startups have coined it) open source technology.

The main example is of Amsterdam-based startup Elastic that was rapidly expanding and whose product, ElasticSearch, was already available for AWS. In 2015, Amazon said it was going to copy the freely-available ElasticSearch and make it a paid service.

Amazon began making more cash than Elastic by offering deeper integration with its own products. Elastic responded by making premium features which Amazon then reportedly copied and made free.

Elastic is now suing Amazon for violating its trademark by calling their own product ElasticSearch. In the complaint, Elastic stated that Amazon "misleads customers". The court case is still pending.

Wakabayashi goes on to highlight other cases where Amazon is accused of the aforementioned strip-mining. One is MongoDB, which Amazon is said to have copied the “look-and-feel” of an older version. Furthermore, when AWS customers search for "MongoDB" from the management console, they are provided with Amazon's own alternative which states that it's “compatible with MongoDB.”

During a dinner which MongoDB's chief executive Dev Ittycheria had with the heads of six other tech firms, the conversation reportedly switched to whether to publicly accuse Amazon of behaving like a monopoly.

Wakabayashi even sourced comments from people who actively decided against making their products open source due to fear that Amazon would copy them.

"The journalist largely ignores the many positive comments he got from partners because it’s not as salacious copy for him," Gutmans said in a blog post.

However, not all of the cases highlighted by Wakabayashi were negative. Databricks' chief executive Ali Ghodsi said that AWS salespeople lifted the sales of his company's products and that he doesn't "see them using shenanigans to stop us."

Gutmans insisted that Amazon "contributes mightily to open source projects" and that "AWS has not copied anybody’s software or services."

It must be reiterated that Elastic is not suing Amazon for copying its product as it was open source. Executives from MongoDB, on the other hand, suggested to SiliconAngle earlier this year that they believe Amazon's DocumentDB is a copy of their product that's “based on MongoDB code from two years ago.”

Rightly or wrongly, it's clear there are serious concerns within the industry about how Amazon is wielding its power. Reaching out to understand why executives from these companies hold such concerns would be a more productive approach than criticising journalists for reporting them.

https://www.cybersecuritycloudexpo.com/wp-content/uploads/2018/09/cyber-security-world-series-1.pngInterested in hearing industry leaders discuss subjects like this and sharing their experiences and use-cases? Attend the Cyber Security & Cloud Expo World Series with upcoming events in Silicon Valley, London and Amsterdam to learn more.

Facebook apps dominated this decade’s mobile market


Nicole Kobie

18 Dec, 2019

The most downloaded apps of the last decade have been revealed – and the top four are all now owned by Facebook.

According to the analysts at App Annie, the most downloaded apps globally from 2010 until now are Facebook, Messenger, WhatsApp and Instagram. WhatsApp was bought by Facebook in 2014 for $19 billion, while Instagram was bought in 2012 for $1 billion.

“Looking at the most downloaded apps of the decade, Facebook has dominated the mobile space representing the four most downloaded apps of the decade with Facebook, Facebook Messenger, WhatsApp and Instagram,” said App Annie market insight manager Adithya Venkatraman in a blog post. “Communication and social media apps are consumer favorites, accounting for seven of the top 10 apps by downloads this decade.”

The figures may add fuel to the fire for regulators, amid calls to break up Facebook’s dominance in the market — or at least stop it hoovering up more rival apps. Indeed, Facebook is being investigated by US authorities over antitrust concerns, with reports suggesting the Federal Trade Commission could use an injunction to block the company from moving forward with plans to more closely link its various messaging apps, as such code sharing would make it difficult to break up the company in the future, should it be deemed necessary by regulators.

The Facebook apps were followed in the rankings by Snapchat, Skype and TikTok. The latter was one of two apps in the top ten, along with the UC Browser by Alibaba, that were released by Chinese companies instead of American ones. TikTok’s inclusion in the list is particularly impressive given that it was only released in 2016.

While Facebook has the most downloads, it doesn’t necessarily make the most money in the mobile market. According to App Annie, the top apps by consumer spend over the last decade were Netflix, Tinder and Pandora. Still, Facebook has increased its revenue from mobile which now makes up 94% of the company’s advertising revenue, according to the company’s third-quarter results. That’s a far cry from 2012, just after the company went public, when investors worried about the company’s inability to make money from mobile users.

While Facebook has found success with advertising on Instagram, it’s still looking for ways to earn revenue from WhatsApp, in particular by charging businesses that use the app to contact customers.

Facebook aside, the App Annie stats highlighted that the past decade has been all about mobile, and that looks set to continue. “This decade has been a time of remarkable growth for the mobile economy,” added Venkatraman. “With a 5% increase in downloads, and 15% growth in consumer spend… year-over-year in 2019 this looks set to continue in 2020.”

Google Cloud partners with Palo Alto, McAfee, and others to bolster security

With an aim to strengthen its security and attract more number of enterprise customers to its cloud platform and services, Google Cloud has announced its partnership with Palo Alto Networks, Qualys, McAfee, Fortinet and ForgeRock.

Google Cloud and Palo Alto Networks will be jointly working on the development of a new multi-cloud security framework for Anthos, which is Google Cloud’s hybrid platform, and multi-cloud Kubernetes deployments. According to the companies, the framework will make use of Palo Alto Networks’ Prisma Cloud security platform and its VM-Series virtual firewalls which will focus on helping customers of Google Cloud deploy a common compliance and runtime security posture across all of their workloads.

Along with this latest security framework, both Google Cloud and Palo Alto Networks have also announced a new threat intelligence integration that will be merging Google Cloud’s Event Threat Detection product with Palo Alto Networks AutoFocus threat intelligence service. The companies also said that integrating signals based on Google’s own internal sources with additional visibility from Palo Alto Networks footprint of network, endpoint, and cloud intelligence sources will help joint customers proactively identify and stop threats. In the first half of 2020, the companies are planning to launch both the new security framework and threat intelligence integration.

Google Cloud’s new partnership with McAfee will be merging that vendor’s endpoint security technology for Linux and Windows workloads along with its Mvision Cloud platform for container security, on Google Cloud infrastructure.

In another extended integration with Google Cloud, Fortinet announced a reference architecture for customers in order to connect distributed branches to Google Cloud Platform with Fortinet’s SD-WAN. According to Fortinet, its FortiCWP product will soon be integrated with GCP’s Cloud Security Command Center to offer additional workload protection and visibility.

Google Cloud’s partnership with Qualys will make its cloud-based security and compliance products available via the Google Cloud Marketplace. The latest integration will include the Qualys Cloud Agent — a lightweight scanner that according to the vendor will enable two-second global visibility. With Qualys on Google Cloud, vulnerability findings are available in the GCP Security Command Center on its own. Similar findings are also present centrally in the Qualys Cloud Platform that allows security teams to track as well as report across the entire enterprise.

ForgeRock too has joined the Google Cloud Partner Advantage Program and has said that it is the first premier-level identity management vendor in the program. ForgeRock announced the launch of its Cloud platform-as-a-service which is built on GCP that includes a software-as-a-service for embedding modern identity capabilities into apps.

https://www.cybersecuritycloudexpo.com/wp-content/uploads/2018/09/cyber-security-world-series-1.pngInterested in hearing industry leaders discuss subjects like this and sharing their experiences and use-cases? Attend the Cyber Security & Cloud Expo World Series with upcoming events in Silicon Valley, London and Amsterdam to learn more.

Intel spends $2bn on Habana Labs in AI data centre push


Nicole Kobie

17 Dec, 2019

Intel is pushing further into artificial intelligence (AI) with the $2 billion (£1.5bn) acquisition of Habana Labs, an Israeli developer of deep-learning hardware.

In 2016, Intel bought Habana Labs competitor Nervana for $400 million, shortly afterwards scooping up computer-vision chip startup Movidius. In 2015, Intel bought reprogrammable chip maker Altera in 2015 for $16 billion. As of 2017, Intel said it had invested more than $1 billion in AI companies.

And it’s starting to pay off, as last month Intel launched a pair of chips designed specifically for artificial intelligence in cloud environments, focused on training and inference using Nervana technology, as well as a computer-vision processing unit.

Habana Labs builds AI accelerators, which are a type of processor designed specifically for AI applications, such as machine learning or computer vision — they’re what a GPU is for graphics, but for AI.

Habana will remain independent from Intel with the current management team remaining in place, and continue to be based out of Israel.

The acquisition isn’t a surprise; Intel had previously invested in the company via its Intel Capital division. “We have been fortunate to get to know and collaborate with Intel given its investment in Habana, and we’re thrilled to be officially joining the team,” said David Dahan, CEO of Habana.

Habana Labs has two processor lines for cloud computing: the Gaudi and the Goya. The former is a processor designed for training AI systems. It’s not yet available, but company data claims it beats Nvidia’s equivalent on industry benchmarks, offers a 4x increase in throughput versus GPU-based systems, and Intel says the technology is already being trialled by some hyperscale customers.

The latter, the Goya, was released last year, and specialises in AI inference, when a trained system uses what it already knows about the world to make decisions, predictions, or otherwise analyse data, making them useful for the Internet of Things, for example.

“This acquisition advances our AI strategy, which is to provide customers with solutions to fit every performance need – from the intelligent edge to the data center,” says Navin Shenoy, executive vice president and general manager of the Data Platforms Group at Intel, in a statement. “More specifically, Habana turbo-charges our AI offerings for the data center with a high-performance training processor family and a standards-based programming environment to address evolving AI workloads.”

Google Cloud gains fresh security partners and tools


Nicole Kobie

17 Dec, 2019

Google has unveiled new security tools and partnerships for its Cloud. 

That includes a new endpoint security management solution that works with McAfee, Palo Alto, and Qualys, as well as a partnership with McAfee to add its MVISION cloud-based system for security, threat prevention, and compliance for container workloads. 

“Increasingly, customers are choosing to move critical workloads and applications to the cloud because of the strong security protections it can provide,” said Anand Ramanathan, vice president of product and marketing at McAfee. “As more of these enterprises choose to leverage Google Cloud’s hyperscale capabilities, we’re excited to integrate our core capabilities in VM and container security to ensure Google Cloud customers can benefit from the highest levels of data protection and threat prevention.”

Google is also adding Citrix Workspace for Google Cloud, which integrates with G Suite for sign-on and authentication, as well as analytics and web filtering.

“Also, users will be able to seamlessly authenticate using G Suite credentials early next year to provide simple, secure access to the apps and information they need to do their jobs anywhere, on any device,” note Kevin Ichhpurani, vice-president of global ecosystem at Google Cloud, and Sunil Potti, vice-president for engineering at Google Cloud Security, in a blog post. 

The announcement also includes partnerships with SIEM provider Exabeam, digital identity vendor ForgeRock, and endpoint security firm Tanium, as well as extensions of existing support for Fortinet and Palo Alto. The latter includes a joint-developed security framework for multi-cloud environments with Anthos, as well as threat detection tools.

By partnering with Google Cloud to deliver a jointly developed security framework for multi-cloud environments and the new integration for threat intelligence, we will simplify how customers  secure their cloud native environments, whether they are single or multi-cloud,” said Rahul Sood, Senior Vice President of Prisma Cloud at Palo Alto Networks.

Alongside the security providers, Google Cloud is also expanding its support with systems integrators and managed services providers, including Deloitte, IBM Security, Wipro and more.

The aim of such partnerships, says Google, is to make it easier for its cloud customers to more easily use their preferred security tools from existing vendors. “We want to meet you where you are, allowing you to preserve your investments, as well as benefit from functionality you can’t get on other clouds,” said Ichhpurani and Potti. “That’s why we work closely with partners in the security industry to help you better secure your applications and information.”

Open-source rivals considered suing Amazon over “strip mining”


Nicole Kobie

16 Dec, 2019

Amazon Web Services has helped plenty of companies, from small startups to global giants, prop up their computing power, but now it’s accused of “strip mining” software from other tech firms.

According to a report in The New York Times, Amazon is accused of taking advantage of open-source technologies, noting which are popular among AWS users, and then rolling out its own version of the service. The accusations aren’t new, but seven open-source companies targeted met to discuss taking legal action against Amazon, the report suggests, but have so far not brought a case.

The story points to a company called Elastic, which offers an open-source, free-to-use search tool for data analytics called Elasticsearch. In 2015, Amazon announced it would offer a managed version of the open-source search tool. Open source companies generally, though not always, make their revenue by selling support or management for their free-to-use software, meaning Amazon was cutting in on Elastic’s business.

Elastic retalied shortly thereafter by adding new features that were only for premium users, the report says; Amazon simply added the same features. The battle being highlighted has carried on in the intervening years.

In March of this year, Amazon unveiled a fork called Open Distro for Elasticsearch saying the tool had become “increasingly central” to users worldwide, thanks to its “permissive” Apache 2.0 license, according to a blog post by AWS vice-president of cloud architecture strategy, Adrian Cockcroft.

“Unfortunately, since June 2018, we have witnessed significant intermingling of proprietary code into the code base,” said Cockcroft. “While an Apache 2.0 licensed download is still available, there is an extreme lack of clarity as to what customers who care about open source are getting and what they can depend on. For example, neither release notes nor documentation make it clear what is open source and what is proprietary.”

That means any changes to the code — such as to patch a bug or add a feature — could be a breach of license, and loss of the right to use the software. To give AWS users “certainty”, Amazon teamed with Expedia and Netflix to fork off into their own open source version, the Open Distro for Elasticsearch.

In response, Elastic founder Shay Banon warned of the dangers of such splintering in a blogpost, denying Amazon’s accusation that anything has changed with the code’s license. “Our products were forked, redistributed and rebundled so many times I lost count. It is a sign of success and the reach our products have,” Benon said. “From various vendors, to large Chinese entities, to now, Amazon. There was always a reason, at times masked with fake altruism or benevolence. None of these have lasted.”

In September, Elastic sued AWS for trademark violations and false advertising for the original product as well as Open Distro, saying customers are “likely to be confused”. Amazon has denied the accusation, but did not reply to a request for comment at the time of publication.

While we need to wait for the outcome of that particular case — and it may well be settled out of court — this isn’t the first time Amazon has been accused of “strip mining” rival companies, in particular those offering open-source software. MongoDB, MariaDB, and RedisLabs have made similar complaints, and it isn’t limited to software: reports have noted a similar practise with shoes, with Amazon selling a pair remarkably similar to those made by Allbirds.

But Amazon makes much more from AWS than it does selling retail products such as shoes. Earlier this year, results reports revealed AWS makes up half of Amazon’s total profits, growing 41% year on year — so expect Amazon to defend its corner.

Marketing Automation Systems: A new age of marketing technology


David Howell

17 Dec, 2019

As the quantity of customer data flowing into your business continues to grow, automating aspects of your enterprise’s processes has become a commercial imperative. One key area to focus this development upon is marketing.

Your cloud deployment has already brought several benefits to your company. Whether you have a private, public or hybrid cloud deployment, the hosted infrastructure you have in place is the ideal environment to radically alter how your business uses its marketing technology.

According to Flexera’s State of the Cloud Report, optimising existing cloud use for cost savings continues to be the top initiative in 2019 for the third year in a row, increasing from 58% in 2018 to 64% this year. Others include moving more workloads to cloud (58%), expanding the use of containers and adopting a cloud-first strategy (tied at 39%) and implementing automated policies for governance (35%).

Noah Elkin, senior analyst with Gartner, tells Cloud Pro: “When you look at the momentum within the marketing automation systems (MAS) marketplace, the direction of travel is towards more cloud deployments. Most of the mega-vendor solutions are either 100% cloud or some level of hybrid cloud deployment. Ultimately, MAS connects a business with data that enables them to deliver more personalised services to its customers. The 360-degree view of a customer that MAS can deliver is now central to the development of all businesses.”

Implementing MAS isn’t just about cost reductions either. It also offers the opportunity to bring in other related technologies, such as artificial intelligence (AI) and machine learning (ML). A report by tech advisory and investment firm GP Bullhound recently showed that $1 billion was invested into AI-related marketing companies in Q2 2019 alone.

Speaking to Cloud Pro,Oliver Schweitzer, executive director at GP Bullhound, explains: “Artificial intelligence heralds the beginning of a new marketing era, driven by the need to connect vast amounts of disparate data, uncover patterns and make predictions, which only AI can accomplish.

“AI will become increasingly integrated into digital services and marketing processes; however, human intelligence and intuition will remain critical to interpret its findings and implement strategic and creative plans accordingly.”

Three significant themes within marketing AI are considered within the report: Hyper-personalisation, branding and B2B. Personalising customer journeys is the most common way for marketers to deploy AI, with a quarter (24%) already using AI to this effect, and almost two thirds (59%) planning to do so in the next two years. When coupled with a cloud-based MAS, this technology becomes an even more powerful marketing tool.

Automated marketing

MAS has seen a massive uptick in popularity, as it offers businesses a suite of tools they can use to potentially expand and improve their marketing channels.

Explaining the reasons behind this, Melody Siefken, research analyst for digital media at Frost & Sullivan, tells Cloud Pro: “All marketing is data-driven and measurable, and in the digital environment, there is no shortage of customer data for marketers to use, ranging from qualitative data such as page views, to call-to-action clicks, and conversion percentages. There are also measurable qualitative data, such as an attitude about a product or service, product reviews, and social media interactions. Businesses are adopting MAS to try and make sense of the unlimited amounts of customer data and turn this data into actionable, intelligent leads and lead scoring for sales enablement.

“MAS also allows them to execute an omnichannel approach to reach customers from all sides, including through channel partners and direct sales, to create a seamless and consistent customer experience/journey. Tools found in end-to-end MAS act as the central data repositories that monitor and collect all customer data for all the departments in a business to use. By adopting MAS, enterprises of all sizes have a dependable and scalable tool that allows them to make sense of the many types of customer data to bring up a bottom line and show a valuable return on investment.”

For marketing automation systems to realise its full potential, it’s vital to ensure cloud and MAS services are integrating across business functions.

“The cloud and MAS integrate by building a big-picture platform that manages all customer data and parameters of communication. Typically, MAS is made up of four components: campaign management, lead management, sales enablement, and marketing analytics and measurement,” Siefken says.

“Most MAS offerings on the cloud are accessible from anywhere, and all are based on a subscription pricing model, which typically gives the users unlimited access with the right authorisation. Cloud-based MAS often have large integration libraries so customers can connect their existing software and solutions to the platform for that seamless experience. Data silos are removed this way.”

It’s also important to take the time to carefully think about data location when implementing a MAS solution in the cloud. For many businesses, data security and data sovereignty, as well as how easy it is to locate and migrate the data are major considerations. This will feed into questions about what cloud service providers and platforms are the most suitable for your needs.

For a further minority of organisations, latency is also a serious hurdle that may put paid to any thoughts of deploying MAS entirely in the cloud.

“[Frost & Sullivan] research also shows that in a few use cases with MAS and customer interactions, response times need to be in milliseconds, and so there is an increasing desire to reduce latency by computing some of the algorithms at the edge, rather than on the cloud,” explains Siefken.

When it comes to how MAS will evolve in the coming years, Siefken says that it’s moving from point and standalone options to full suites, thanks to the use of cloud services.

“Businesses can pick and choose the apps and functionalities they require to build their MAS, and this will be a continued trend in the era of personalisation,” she says. “MAS is evolving from an out-of-the-box solution to a customised, tailored fit platform. Integration is a must-have feature, especially as businesses look to connect their CRMs, ERPs, and sales tools like Salesforce to their MAS.”

Leveraging the cloud

As your business has embraced more cloud services, the benefits hosted services such as MAS has become apparent.

“We see the adoption of MAS in the mid 50% range, with another 25% of organisations planning to deploy this technology within the next two years. Projecting this forward, we will see an 80% uptake within the B2B and B2C sectors,” says Gartner’s Noah Elkin.

“When you are making a marketing technology purchase – especially when it is a major purchase like MAS, you must have a clear sense of what your business goals are. Ask yourself what the technology is expected to deliver. Also, pay close attention to the other stakeholders in your business or organisation. This is critical, as they will help integrate and maintain the system you are installing. As MAS could affect a range of business processes, MAS implementations are business-wide taking in IT and marketing.”

The cloud infrastructure your business has in place is an ideal environment for MAS. Moving forward, automating some critical areas of your enterprise’s marketing activities will become the norm. It’s vital, though, to understand that MAS touches multiple areas of your business. The most successful MAS implementations consider this. With all stakeholders working in unison, MAS could be massively transformative for your business.

How to manage a departing employee’s access to IT


Nik Rawlinson

19 Dec, 2019

Jobs for life are a thing of the past. Staff turnover has never been higher, in part because it suits employers to structure contracts that way – but more often because there’s a skills shortage. Staff are a valuable asset easily lured away by rivals.

And then what? Do you revoke their access, both physical and digital, to keep them away from your infrastructure and data, or should it be business as usual while they work out their notice? A decision like this can only be made if the organisation has a clear picture of what exactly the employee can access.

“You need a complete understanding of the company assets employees use from their first day,” said Fredrik Forslund, one of the part founders of the Blancco Technology Group, whose eponymous product is used by businesses to safely wipe used kit for reuse or sale. “You need an asset management system that tracks the physical assets an employee’s using, which can be simple to organise and incredibly helpful when reconciling assets following an employee’s departure. Besides that, it’s great to know all digital services used, which is easiest to achieve with single sign on. Simple tasks like changing passwords and logging out of online services is an important process that could protect your company from a potential data breach.”

“An IT admin requires quick visibility into the scope of who has access to what within the organisation, including internal systems, cloud services and files,” said Brandon Shopp, VP of product strategy for security, compliance, and tools at SolarWinds, whose access rights manager software helps IT managers understand what a departing staff member had access to, beyond simply their Active Directory account. “Doing this manually is a time-consuming exercise, so having a tool that audits and provides it to you is an important resource. Before the employee exits the organisation, IT admin should revoke access to any information they don’t need to complete their final assignments. Having a product in place to help with this not only provides visibility, but also an audit of changes to your infrastructure to help understand who is making changes and what they are.”

Why, where and when?

It also depends on the circumstances under which the employee is leaving. Redundancy requires a period of consultation, during which restricting an employee’s right to work – and access to resources – may leave an organisation open to legal repercussions. Should an employee voluntarily hand in their notice, however, the situation is somewhat different.
“If the employee is leaving to go to a competitor, it’s still the situation in most cases that once they’ve handed in their notice they’ll probably be leaving that day, so won’t continue to have access to the [company’s] data – although that’s a bit of an outdated concept, to be honest,” Shaun Thomson, CEO of Sandler Training told us. “By the time someone puts their hand up and says they’re leaving, if they want to take that data, they already have it. They’d be silly to wait until the day after they’ve handed in their notice.”

Thomson says organisations should concern themselves with continuation of business at least as much as they think about the safety of their data and the hardware they have loaned an employee. Building multiple contact points for each client, effectively sharing internal data far and wide may, conversely, be the most effective solution.

Hardware and data jurisdiction

“Once the decision about letting someone go has been made, a collection date for assets should be set and when assets are collected, all data should be securely erased with an audit trail… before these assets are transferred to another user,” Forslund said. “There should be zero risk for data leaks in between users in a situation like this.”

Frequently, the distinction between corporate and personal hardware – and corporate and personal data – is blurred. BYOD can result in business-critical data residing on users’ own devices, while personal emails may linger in a corporate inbox. Should employees be allowed to export their mailbox and take their contacts with them?

“Generally, no,” said Forslund. “The personal emails must originate from some other service where access to emails should still exist and remain. If employees are allowed to export their inbox, all locally saved work emails will come along, which is not okay.”

Shopp agrees. “Company email systems and the underlying data stored within belongs to the company, which makes it the company’s discretion to allow the employee to extract any personal items such as contacts and emails before they leave.”

It’s therefore essential that guidelines for the acceptable use of email are written into staff members’ contracts of employment, so that confusion – and conflict – can be avoided at the point of departure.

As Thomson points out, “when you employ people you’re looking for certain things, which you’re disdainful about when they leave. You expect them to come with contacts but don’t want them to leave with any.”

But contacts alone are less important than an established relationship once an organisation reaches a certain size.

“When we’re working with our client companies, we apply an acid test: do your clients have a relationship with you or just one person in your company?” Thomson asked. “If it’s the latter, when that individual moves the client is going to go wherever they go. As you grow – both your own company and a company you’re dealing with externally – it’s more about dealing organisation to organisation. We use Microsoft Dynamics as a CRM, but if our contact at Microsoft left that wouldn’t change: we’d still be using Microsoft software. The bigger a company is, the less likelihood that the employee will be able to take business with them.”

From a leadership point of view, then, and with succession planning in mind, only considering the risk to your data at the point an employee announces they’re leaving is probably too late. Data can be used as an insurance by staff who feel their position to be under threat. By cultivating multiple touch points between your organisation and its clients, this policy will be less effective, and have a less detrimental effect in-house if it was ever deployed.

You’re fired!

Special consideration needs to be given to staff leaving under a cloud, for whom you may wish to curtail access to mission-critical systems and sensitive data in short order.

In this case, SolarWinds’ Security Event Manager “alerts you if someone is still trying to use an account once they’ve been locked out” said Shopp. “It gathers logs that can tell you why someone is trying to authenticate with the account that you’ve shut down. Is it an application that was installed while the person was still at the company, which you need to go in and shut down, or is somebody actually trying to do something that they shouldn’t? Having visibility into that is something that every organisation should have.”

As Thomson explained, though, each situation must be considered on its own merits. There’s a wide choice of safeguards that companies can choose from, depending on their philosophy, size, and the kind of assets – both physical and data-based – they’re dealing with. Key is understanding what staff have access to, and knowing what needs to be done as soon as it becomes clear their time with the business is drawing to a close. After all, the rate of staff turnover is unlikely to slow down any time soon, if ever.

The cloud news categorized.