Amazon Web Services (AWS) has filed with the US Court of Federal Claims to protest the decision to award the $10 billion-rated JEDI government cloud computing contract to Microsoft, according to reports.

As first reported by the Federal Times, and later confirmed by AWS, chief executive Andy Jassy told employees of plans at an all-hands meeting on November 14, citing potential presidential interference making the contract process ‘very difficult’ for government agencies.

Per the report, Jassy also claimed in the meeting that customers claim AWS is ‘about 24 months ahead of Microsoft’ when it comes to functionality and maturity.

AWS already holds one key card with its continued running of the CIA’s cloud operations, having been at full operational capability since the start of 2015. According to Nextgov, the agency earmarked in April plans for more commercial cloud contracts at a cumulative value approaching $10bn.

Following the decision to award the contract to Microsoft last month, many industry pundits continued to question supposed executive interference, as well as the setup of the Department of Defense (DoD) with regard to single tenant or multi-cloud operations.

At the time, AWS said it was ‘surprised’ about the conclusion and that it ‘remain[ed] deeply committed to continuing to innovate for the new digital battlefield’, but stopped short of confirming whether an appeal would be put in place.

“AWS is uniquely experienced and qualified to provide the critical technology the US military needs, and remains committed to supporting the DoD’s modernisation efforts,” an AWS spokesperson said in a statement. “We also believe it’s critical for our country that the government and its elected leaders administer procurements objectively and in a manner that is free from political influence.

“Numerous aspects of the JEDI evaluation process contained clear deficiencies, errors, and unmistakable bias – and it’s important that these matters be examined and rectified,” the spokesperson added.

Interested in hearing industry leaders discuss subjects like this and sharing their experiences and use-cases? Attend the Cyber Security & Cloud Expo World Series with upcoming events in Silicon Valley, London and Amsterdam to learn more.

Salesforce is moving its Marketing Cloud suite onto Microsoft Azure in an expansion of the companies’ partnership – and a big win for Microsoft.

The move will also see the two companies integrate Sales Cloud and Service Cloud with productivity and collaboration suite Microsoft Teams.

“By bringing together the power of Azure and Microsoft Teams with Salesforce, our aim is to help businesses harness the power of Microsoft Cloud to better serve customers,” said Microsoft CEO Satya Nadella in a statement, while a statement attributed to Salesforce co-CEOs Marc Benioff and Keith Block noted that the company was ‘excited to expand our partnership with Microsoft and bring together the leading CRMs with Azure and Teams to deliver incredible customer experiences.’

Details are thin on the migration plan itself, aside from Salesforce moving Marketing Cloud from its own data centres to Azure in the coming months. The press materials can give away some of the intentions with words such as ‘preferred’ indicating a multi-cloud setup, yet the release simply notes that Salesforce ‘names Microsoft Azure as its public cloud provider for Marketing Cloud.’

Microsoft is by no means the only major cloud provider Salesforce works with. The company has had a longstanding relationship with Google Cloud on the software side, last year receiving a partner award from Google. As far as Amazon Web Services (AWS), the long time cloud infrastructure leader goes, only last week AWS and Salesforce, alongside Genesys and The Linux Foundation, launched the open data-focused Cloud Information Model. The companies also align on integration with Salesforce an advanced member of the AWS Partner Network (APN).

Last month Microsoft noted there was ‘material growth’ in Azure contracts of $10 million or more in what were strong results compared with stuttering figures for AWS and Google. Among the company’s more recent customer wins, alongside the controversial $10bn JEDI government cloud contract last month, are Walt Disney Studios and subsidiary LinkedIn.

Interested in hearing industry leaders discuss subjects like this and sharing their experiences and use-cases? Attend the Cyber Security & Cloud Expo World Series with upcoming events in Silicon Valley, London and Amsterdam to learn more.

Bobby Hellard

Private equity firms are snapping up manufacturing companies at a quick pace, setting off a merger and acquisition gold rush, while leaving multi-cloud manufacturing systems unprotected in a Zero Trust world.

Securing the manufacturing gold rush of 2019

The intensity private equity (PE) firms have for acquiring and aggregating manufacturing businesses is creating an abundance of opportunities for cybercriminals to breach the resulting businesses. For example, merging formerly independent infrastructures often leads to manufacturers maintaining — at least initially — multiple identity repositories such as Active Directory (AD), which contain privileged access credentials, usernames, roles, groups, entitlements, and more. Identity repository sprawl ultimately contributes to maintenance headaches but, more importantly, security blind spots that are being exploited by threat actors regularly.

A contributing factor is a fact that private equity firms rarely have advanced cybersecurity expertise or skills and therefore don’t account for these details in their business integration plans. As a result, they often rely on an outdated “trust but verify” approach, with trusted versus untrusted domains and legacy approaches to identity access management.

The speed PE firms are driving the manufacturing gold rush is creating a sense of urgency to stand up new businesses fast – leaving cybersecurity as an afterthought, if even a consideration at all. Here are several insights from PwC’s Global Industrial Manufacturing Deals Insights, Q2 2019 and Private Equity Trend Report, 2019, Powering Through Uncertainty:

• 39% of all PE investors rate the industrial manufacturing sector as the most attractive for acquiring and rolling up companies into new businesses
• The manufacturing industry saw a 31% increase in deal value from Q1 2019 to Q2 2019 with industrial manufacturing megadeals driving deal value to $27.4B in Q2, 2019, on 562 deals
• Year-to-date North American manufacturing has generated 184 deals worth $15.2B in 2019
•  Worldwide and North American cross-sector manufacturing deal volumes increased by 32% and 30% in Q2, 2019 alone

PE firms are also capitalising on how many family-run manufacturers are in the midst of a generational change in ownership. Company founders are retiring, and their children, nearly all of whom were raised working on the shop floor, are ready to sell. PE firms need to provide more cybersecurity guidance during these transactions to secure companies in transition. Here’s why:

• According to the 2019 Verizon Data Breach Investigation Report, manufacturing has been experiencing an increase in financially-motivated breaches in the past couple of years, whereby most incidents involve Phishing and the use of stolen credentials
• Manufacturing’s most commonly compromised data includes credentials (49%), internal operations data (41%), and company secrets (36%) according to the 2019 Verizon Data Breach Investigation Report
• 50% of manufacturers report experiencing a data breach or cyber-attack over the last 12 months, 11% of which were severe, according to the Sikich M&D Report 2019
• It’s the smaller suppliers in the supply chain or M&A process that hackers are starting to exploit to bring down many of the world’s largest manufacturing companies. Just ask one of the world’s leading shipping providers, A.P. Møller-Maersk

How to secure multi-cloud manufacturing systems in a Zero Trust world

To stop the cybercriminals’ gold rush, merged manufacturing businesses need to take the first step of adopting an approach to secure each acquired company’s identity repositories, whether on-premises or in the cloud. For example, instead of having to reproduce or continue to manage the defined rights and roles for users in each AD, manufacturing conglomerates can better secure their combined businesses using a multi-directory brokering approach.

Multi-directory brokering, such as the solution offered by privileged access management provider Centrify, empowers an organisation to use its existing or preferred identity directory as a single source of truth across the organisation, brokering access based on a single identity rather than having to manage user identities across multiple directories. For example, if an organisation using AD acquires an organisation using a different identity repository or has multiple cloud platforms, it can broker access across the environment no matter where the “master” identity for an individual exists. This is particularly important when it comes to privileged access to critical systems and data, as “identity sprawl” can leave gaping holes to be exploited by bad actors.

Multi-directory brokering is public cloud-agnostic, making it possible to support Windows and Linux instances in one or multiple infrastructure as a service (IaaS) platforms to secure multi-cloud manufacturing systems. The following diagram illustrates how multi-directory brokering scales to support multi-cloud manufacturing systems that often rely on hybrid multi-cloud configurations.

Manufacturers who are the most negatively impacted by the trade wars are redesigning and re-routing their supply chains to eliminate tariffs, so they don‘t have to raise their prices. Multi-cloud manufacturing systems are what they’re relying on to accomplish that. The future of their business will be heavily reliant upon how well they can secure the multi-cloud configurations of their systems. That’s why multi-directory brokering makes so much sense for manufacturers today, especially those looking for an exit strategy with a PE firm.

The PE firms driving the merger and acquisition (M&A) frenzy in specific sectors of manufacturing need to take a closer look at how identity and access management (IAM) is being implemented in the manufacturing conglomerates they are creating. With manufacturing emerging as a hot industry for PE, M&A, and data breaches, it’s time to move beyond replicating Active Directories and legacy approaches to IAM. One of the most important aspects of a successful acquisition is enabling administrators, developers, and operations teams to access systems securely, without massive incremental cost, effort, and complexity.

Conclusion

The manufacturing gold rush for PE firms doesn’t have to be one for cybercriminals as well. PE firms and the manufacturing companies they are snapping up need to pay more attention to cybersecurity during the initial integration phases of combining operations, including how they manage identities and access. Cybercriminals and bad actors both within and outside the merged companies are lying in wait, looking for easy-exploitable gaps to exfiltrate sensitive data for monetary gain, or in an attempt to thwart the new company’s success.

Interested in hearing industry leaders discuss subjects like this and sharing their experiences and use-cases? Attend the Cyber Security & Cloud Expo World Series with upcoming events in Silicon Valley, London and Amsterdam to learn more.

Bobby Hellard

No cloud is created equal – and according to a benchmark analysis of the biggest providers from network intelligence software provider ThousandEyes, performance varies between the hyperscalers with some potentially surprising findings.

The report, ThousandEyes’ 2019-2020 Cloud Performance Benchmark, assessed more than 320 million data points collected from almost 100 global metro locations over the course of a month. The study focused on Amazon Web Services (AWS), Microsoft Azure and Google Cloud Platform (GCP), as well as Alibaba Cloud and IBM Cloud.

The research not only assessed the speed of traffic being delivered by the biggest clouds, but also how it was getting there. ThousandEyes argued GCP and Azure rely heavily on private backbone networks, while AWS and Alibaba rely more heavily on the public internet. Fighting for room amid traffic jams means inevitable performance downturns. Last year’s report argued similar, exploring how AWS’ traffic only comes into its architectural backbone close to the target region.

Connectivity through China was seen as a crucial area of analysis – and the research found that even Alibaba suffered packet loss when crossing the Great Firewall.

Naturally, in some areas Alibaba would have been naturally considered the best of the bunch. Analysing the Singapore regions, customers in China using Alibaba would have a three times quicker service than IBM. Perhaps unsurprisingly, the research also found Alibaba outperformed the rest when it came to China-Hong Kong network speed.

As a result, for enterprises looking – and potentially avoiding – China, the research concluded there were viable options. Regular readers of this publication will be aware of the presence Singapore and Hong Kong can bring; the most recent analysis from the Asia Cloud Computing Association (ACCA) last year found the former had overtaken the latter as the strongest Asia-Pacific cloud nation. China, by contrast, was ranked second from last among 14 nations.

Compared with last year’s report, there are similarities. As can be expected, many of the headline-grabbing elements of reports such as this are to show that the long-term market leader – in this instance of course AWS – is more fallible than may be thought.

The report explored AWS Global Accelerator – Amazon’s fee paying service introduced this time last year for customers to use the AWS private backbone – and found that while performance gains were appreciable, it was not a one-size-fits-all solution.

Ultimately, as cloud workloads continue to become more complex, then the conversation around network and performance becomes more nuanced.

“It is imperative for enterprise IT leaders to understand that cloud architectures are complex and not to rely on network performance and connectivity assumptions or instincts while designing them,” the report concludes. “Enterprises relying heavily on the public cloud or considering a move to the cloud must arm themselves with the right data on an ongoing basis to guide the planning and operational stages.

“Every organisation is different, cloud architectures are highly customised and hence these results must be reviewed through the lens of one’s own business in choosing providers, regions and connectivity approaches.”

You can read the full report here (email required).

Interested in hearing industry leaders discuss subjects like this and sharing their experiences and use-cases? Attend the Cyber Security & Cloud Expo World Series with upcoming events in Silicon Valley, London and Amsterdam to learn more.

Bobby Hellard

At this year’s Microsoft Ignite conference, Microsoft CEO Satya Nadella placed the focus on consistent developer experiences in multi- and hybrid-cloud, alongside the announcements of new initiatives for “cloud-delivered quantum computing.” Nadella, in his keynote speech in Orlando, also emphasized the role of a consistent and reliable management platform across various cloud environments – including AWS and Google Cloud.

For instance, Azure Arc, which was introduced on the first day of Ignite, is “a control panel built for multi-cloud, multi-edge, and for the first time managed data services for where the edge compute is,” stated Nadella.

Before the premier Microsoft Ignite event for IT decision-makers, Microsoft had provided journalists an 87-page document that listed all news items to expect from the conference. But here are the top five announcements you should know about:

Azure Arc – manage resources anywhere

The Azure Arc control panel will let organizations leverage Azure to manage their resources across AWS and Google Cloud. The panel will also work for Linux and Windows Servers, and Kubernetes clusters as well. Furthermore, it will allow users to take limited Azure data services to these platforms. Previously, Azure Stack only worked on a limited set of hardware. Though Arc doesn’t have all Azure services, it will be a single platform for enterprises to manage their resources across a multi-cloud environment and their data centers. Owing to the complexities in hybrid environments, the control panel can be a single tool to keep enterprises in the Azure ecosystem.

Endpoint Manager – modernise device management

Per the keynote speech, Microsoft is set to combine ConfigMgr with Intune services that will allow organizations to manage laptops, PCs, tablets, and phones they issue to their employees, all under the Endpoint Manager. It’s also introducing a plethora of tools as well as recommendations to help companies modernize deployment strategies. Also, ConfigMgr users can now get a license to Intune, which will allow them to move to cloud-based management. Because security remains a significant concern in the BYOD world, managing all devices becomes a massive challenge for the IT department. With the latest offering, you can do away with multiple tools and get a single view of deployments.

Power Virtual Agents – the no-code bot builder

One of the most interesting announcements made at Microsoft Ignite has to be the introduction of Power Virtual Agents – the new ‘no-code/low-code’ tool for building chatbots. The tool uses Azure’s machine learning smarts to let users create chatbots by leveraging a visual interface. It will also allow users to integrate actual code. With the visual, anyone can build a chatbot and the creators will gain a better understanding of the user requirements than a developer who aren’t involved with business groups.

Azure Synapse – limitless analytics

Touted as the “limitless” analytics service, Microsoft introduced Azure Synapse Analytics, which is a combination of big-data analytics and data warehousing. The company said, “The service can use either serverless or provisioned resources to provide a unified experience to ingest, prepare, manage, and serve data for immediate BI and machine learning applications.” However, users can run existing data warehousing workloads with Azure Synapse. Microsoft said that it would be similar to integrating Apache Spark with SQL.

Microsoft 365 – Project Cortex

Microsoft 365 platform is also getting new additions this year. The company introduced Project Cortex, which is a new service in Microsoft 365 that leverages AI to classify all of an enterprise’s content into topics. The latest addition is set to create a network of knowledge that “improves individual productivity and organizational intelligence, helping identify experts on specific topics, and surfacing knowledge through interactive experiences across Microsoft 365.” The new service comes after Microsoft Teams and is now in private view. It is expected to be available in 2020.

Read more: With Azure Arc, Microsoft aims to go beyond traditional hybrid cloud – with Anthos and Outposts for company

Interested in hearing industry leaders discuss subjects like this and sharing their experiences and use-cases? Attend the Cyber Security & Cloud Expo World Series with upcoming events in Silicon Valley, London and Amsterdam to learn more.

Another day, another example of misunderstanding shared responsibility when it comes to cloud security. Or is it?

A new report from identity and access management (IAM) provider Centrify has argued that while many organisations understand the basics of shared responsibility, the increasing complexity of workloads means that confusion occurs when it comes to privileged access.

The study, titled ‘Reducing Risk in Cloud Migrations: Controlling Privileged Access to Hybrid and Multi-Cloud Environments’, polled more than 700 respondents across the UK, US, and Canada. Three in five (60%) respondents said security was the leading challenge when it came to cloud migration generally, while more than half (51%) affirmed they were taking different approaches to securing cloud workloads compared with on-premises.

Yet the responses begin to unravel after this. 60% of those polled said they believed cloud providers were responsible for securing privileged access. This goes to show that while some data may be more privileged than others, it all falls under the same bucket.

Cloud providers, as they frequently note, are responsible for the security of the cloud – infrastructure and uptimes et al – while the onus is on the user for security in the cloud; applications and data. While not being able to cut the cord completely, vendors have gradually taken more proactive steps; none more so than Amazon Web Services, who this time last year launched a new offering to help mitigate against open bucket misunderstandings – which are frequently an open goal for criminals.

For Centrify, the company’s focus on privileged access management (PAM) can be seen in other survey responses. More than two thirds (68%) of those polled said they were not implementing PAM best practices for cloud environments, while more than three quarters (76%) said they use more than one identity directory for their cloud strategy, putting them at risk of ‘identity sprawl’ attacks.

Organisations predominantly saw applying privileged access controls as a way to secure access to cloud service management – cited by 71% – while secure access to cloud workloads and containers was cited by more than half (53%). The report notes how that the more specific the privilege is, the interest diminishes in securing it.

In terms of best practices companies utilise, unsurprisingly the most popular was multi-factor authentication across all privileged access accounts – albeit only cited by 60% of those polled. The remaining factors were used by less than half of respondents, from operating a ‘least privileged access’ model (43%), to privileged session monitoring (38%). It must be noted that many of these questions come down to how many clients have an ‘all-in-one’ security offering, compared with a more bits-and-pieces strategy.

Centrify argues there are five key actions organisations should take; understanding privileged access to cloud environments was the company’s responsibility; reducing risk associated with identity sprawl; enforce a least privilege model; employ a common security model; and modernise your security approach, focusing on cloud-native PAM.

“We know that 80% of data breaches involved privileged access abuse, so it’s critical that organisations understand what they are responsible for when it comes to cloud security, and take a least privilege approach to controlling privileged access to cloud environments,” said Centrify CEO Tim Steinkopf. “Too much access and privilege puts their workloads and data at risk.”

You can read the full report here (email required).

Interested in hearing industry leaders discuss subjects like this and sharing their experiences and use-cases? Attend the Cyber Security & Cloud Expo World Series with upcoming events in Silicon Valley, London and Amsterdam to learn more.

Bobby Hellard