DevOps and microservices are permeating software engineering teams broadly, whether these teams are in pure software shops but happen to run a business, such Uber and Airbnb, or in companies that rely heavily on software to run more traditional business, such as financial firms or high-end manufacturers. Microservices and DevOps have created software development and therefore business speed and agility benefits, but they have also created problems; specifically, they have created software security issues.

read more

Leading cloud-centric IT organizations are establishing core capabilities to improve productivity, control costs and provide a highly responsive end-user experience. Key steps along this journey include creating an end-user cloud services catalog, automating workflows and provisioning, and implementing IT showback and chargeback. In his session at 19th Cloud Expo, Mark Jamensky, executive vice president of Products at Embotics, walked attendees through an in-depth case study of enterprise IT management products provider Serena Software and its journey to enhancing ITaaS and IT cost visibility capabilities. The session shared best practices, lessons learned and key technologies used along the way.

read more

(c)iStock.com/alashi

Imagine an IT security team as a navy crew at sea. A torpedo blasts the ship’s side below the water line. As the water floods in, they can’t even see the hole, let alone fix it. Instead, everyone turns to the pumps to keep the ship afloat.

This is the state of many security programs today. Despite a plethora of point solutions, security teams lack visibility into what they’re trying to protect, their most pressing risks and the security tools at their disposal. Thus security teams operate in constant reactionary mode, while a strategic, proactive security program remains elusive.

The growing popularity of virtual networks further complicates visibility issues. Virtual machines are spun up at a moment’s notice, and security groups and tags are assigned – but not necessarily in line with broader security policies. Network security teams may have no access to management consoles and limited insight as to how changing network architectures affect their attack surface.

But with comprehensive network modeling extending into virtual networks, network security engineers can gain the needed visibility to unify security and compliance processes across their hybrid hardware and virtual environments.

Verifying access

A major challenge to policy and access verification in hybrid environments is complexity. The mixture of physical, virtual and cloud networks with their various security groups and tags, as well as traditional ACLs, makes manual comparison and analysis almost impossible. But by normalising this data and combining hybrid network policies, network access can be analysed end to end and visualised within the model.

Microsegmentation challenges

Historically, data centres have been protected by perimeter security technologies analysing north-south traffic –traffic into and out of the data centre. Traditional data centre designs assume that all east-west traffic – traveling within the data centre – occurs in trusted, well-protected zones. Recent data breaches, however, have shown that this assumption is no longer valid. Microsegmentation is capable of dividing east-west traffic within the data centre into smaller, more protected zones; but without security visibility into how microsegmentation is implemented, it’s difficult to verify policy is adhered to across the network.

By combining and modeling north-south and east-west policies network security teams can gain end-to-end access visibility throughout their hybrid network. Model-driven visibility also provides a more realistic view of applied policy at the host level rather than verifying access only at “chokepoints” or gateways to the virtual network.

Vulnerability detection in virtual networks

One added benefit of modeling virtual and cloud environments is scanless vulnerability detection. Security analytics applied to the model can deduce vulnerabilities using product configuration and version information. This can significantly decrease reliance on active or third-party scans which are harder to operate on virtual and cloud networks. Incorporating vulnerability intelligence gives a fuller picture of how these networks impact overall risk.

Visualisation

By unifying hybrid IT environments in one model and normalising their data, organisations can break down the barriers that traditionally existed between physical, virtual and cloud networks for comprehensive, streamlined security management.

This information can be further distilled into a simple picture of the organisation’s unique attack surface. Using attack surface visualisations, CISOs to “in-the-trenches” security practitioners to board members can quickly see the interconnectedness of their IT infrastructure and where their most critical security exposures lurk. Attack surface visibility gives an intuitive and deeply analytical tool to make fast, informed decisions regarding incident response, operations and security investments. It provides a common language and reference to stop reacting to symptoms and start treating root causes of security issues, creating a proactive, holistic security program.

(c)iStock.com/alashi

Imagine an IT security team as a navy crew at sea. A torpedo blasts the ship’s side below the water line. As the water floods in, they can’t even see the hole, let alone fix it. Instead, everyone turns to the pumps to keep the ship afloat.

This is the state of many security programs today. Despite a plethora of point solutions, security teams lack visibility into what they’re trying to protect, their most pressing risks and the security tools at their disposal. Thus security teams operate in constant reactionary mode, while a strategic, proactive security program remains elusive.

The growing popularity of virtual networks further complicates visibility issues. Virtual machines are spun up at a moment’s notice, and security groups and tags are assigned – but not necessarily in line with broader security policies. Network security teams may have no access to management consoles and limited insight as to how changing network architectures affect their attack surface.

But with comprehensive network modeling extending into virtual networks, network security engineers can gain the needed visibility to unify security and compliance processes across their hybrid hardware and virtual environments.

Verifying access

A major challenge to policy and access verification in hybrid environments is complexity. The mixture of physical, virtual and cloud networks with their various security groups and tags, as well as traditional ACLs, makes manual comparison and analysis almost impossible. But by normalising this data and combining hybrid network policies, network access can be analysed end to end and visualised within the model.

Microsegmentation challenges

Historically, data centres have been protected by perimeter security technologies analysing north-south traffic –traffic into and out of the data centre. Traditional data centre designs assume that all east-west traffic – traveling within the data centre – occurs in trusted, well-protected zones. Recent data breaches, however, have shown that this assumption is no longer valid. Microsegmentation is capable of dividing east-west traffic within the data centre into smaller, more protected zones; but without security visibility into how microsegmentation is implemented, it’s difficult to verify policy is adhered to across the network.

By combining and modeling north-south and east-west policies network security teams can gain end-to-end access visibility throughout their hybrid network. Model-driven visibility also provides a more realistic view of applied policy at the host level rather than verifying access only at “chokepoints” or gateways to the virtual network.

Vulnerability detection in virtual networks

One added benefit of modeling virtual and cloud environments is scanless vulnerability detection. Security analytics applied to the model can deduce vulnerabilities using product configuration and version information. This can significantly decrease reliance on active or third-party scans which are harder to operate on virtual and cloud networks. Incorporating vulnerability intelligence gives a fuller picture of how these networks impact overall risk.

Visualisation

By unifying hybrid IT environments in one model and normalising their data, organisations can break down the barriers that traditionally existed between physical, virtual and cloud networks for comprehensive, streamlined security management.

This information can be further distilled into a simple picture of the organisation’s unique attack surface. Using attack surface visualisations, CISOs to “in-the-trenches” security practitioners to board members can quickly see the interconnectedness of their IT infrastructure and where their most critical security exposures lurk. Attack surface visibility gives an intuitive and deeply analytical tool to make fast, informed decisions regarding incident response, operations and security investments. It provides a common language and reference to stop reacting to symptoms and start treating root causes of security issues, creating a proactive, holistic security program.

(c)iStock.com/VisualCommunications

How do you see what isn’t physically there?  It is emerging as a major problem facing enterprises, as cloud increasingly becomes the new normal.

On-premise networks and physical data centres are disappearing fast, with core business applications and processes being migrated to cloud architectures. The latest Cisco Global Cloud Index states that by 2020, 92% of workloads will be processed in public and private cloud data centres, and just 8% in physical data centres.

The rapid move to cloud is understandable since it is so alluring:  they are elastic, cost less to operate and manage, and is scalable, enhancing business agility.  But in engineering there is no such thing as getting something for nothing.  You always have to give something up in order to gain something.  The trick, of course, is getting something you value greatly while giving up something that does not mean as much to you.  For cloud migration, these benefits are being realised at the expense of visibility and insight into those cloud environments. 

When we surveyed a range of businesses on their virtualisation practices, just 37% monitored their virtualised environments with the same rigor as their physical networks.  So there is a big visibility gap when it comes to the cloud.  While that may seem like a good trade-off today, it may feel different if and when things go wrong.   Most organisations cannot take that chance, so they need to bridge the visibility gap quickly.  They need it for better control, to maintain security no matter where their data goes, and of course to ensure reliability of their core business applications. 

It would seem like addressing this visibility gap could be fixed easily by inserting virtual network taps into the virtualised environment and sending the traffic to their monitoring, analytics, and security tools.  Unfortunately, doing this would quickly flood these tools with data, because internal East-West traffic in virtual data centres typically represents 80% of the total traffic.  It would be like connecting a lawn sprinkler to a fire hydrant.  Identifying and extracting only relevant traffic is key, but how can you do that efficiently?  More so, how can your virtual taps handle scaling up and down as virtual machines emerge and dissolve? Let’s take a closer look at the key requirements for visibility and monitoring in virtual environments.

Expanding your (visibility) horizon

There are four key points to consider when deploying virtual taps so you end up with meaningful, granular access to critical application traffic on virtualised networks. 

Horizontal scale: Cloud environments are attractive because they can scale up and down rapidly as user demands and workloads change. When placing the virtual taps in the virtual network, you need to be sure they can scale up to accommodate rapid growth in traffic volumes as well as user numbers and data interactions.  The taps should do this automatically, without needing IT intervention.  Virtualisation means agility, so if an application or service expands to handle 10x or 100x the number of users, make sure the virtual tap you are using can scale elastically – without impacting application performance. 

Securing in the dark: Virtualised networks are typically segmented using virtual firewalls to protect key applications and services from attack, and to prevent lateral movement in the virtualised environment that could compromise data or resources.  So the virtual taps you use needs to be able to see the application and network traffic flowing between segments.  With this comprehensive insight, you can ensure that the appropriate security rules and policies governing each segment are being enforced. 

More containers: As virtual machine use grows, container use multiplies even faster – by as much as 10-fold or more, as each application may employ multiple containers.  If your organisation is using container-based virtualisation to boost application performance, the virtual tap must be able to access traffic in the container environment.

DevOps elasticity: When your DevOps team puts out a new build – which, remember, doesn’t just cover new applications and services, but also updates to existing ones – then that update propagates across the virtual environment.  Individual virtual machines, containers, and by association their hosted applications, have shorter and shorter lifespans requiring continual awareness of the actual state of the environment. It is vital that these changes not block the entire traffic path, or take the virtual tap down with it.  As an example, consider how to archive and retrieve monitored traffic from a container that no longer exists.   The tap is your sentinel, which has to maintain pervasive access to traffic to enable you to see what is happening on the virtual network:  it must be fault-tolerant, even if the application it is monitoring fails. 

These four points apply when monitoring any virtualised environment, whether public cloud, private cloud or software defined wide-area networks (SD-WANs):  the virtual taps and the overall visibility solution need to be completely environment-agnostic. 

Elastic visibility

Once the virtual taps have been deployed to extract traffic from the virtual machines in your environments, you are ready to start processing packets.  This volume of traffic needs filtering and controlling using a network packet broker.  That keeps duplicate data from overwhelming monitoring and security tools and ensures they scale up/down as needed.  Data traffic should be broken up into manageable pieces using packet filtering, grooming and brokering processes, to make sure the security systems and analytics tools are seeing everything.

Elastically-scalable access is achievable for all the data crossing their virtual networks and clouds as well as intelligent distribution to analytics and compliance tools.  Leaving your data unmonitored is not smart business.  You do not have to give up visibility to gain cloud speed and cost advantages.  With the right architecture, you can have both so you should not compromise.   

(c)iStock.com/VisualCommunications

How do you see what isn’t physically there?  It is emerging as a major problem facing enterprises, as cloud increasingly becomes the new normal.

On-premise networks and physical data centres are disappearing fast, with core business applications and processes being migrated to cloud architectures. The latest Cisco Global Cloud Index states that by 2020, 92% of workloads will be processed in public and private cloud data centres, and just 8% in physical data centres.

The rapid move to cloud is understandable since it is so alluring:  they are elastic, cost less to operate and manage, and is scalable, enhancing business agility.  But in engineering there is no such thing as getting something for nothing.  You always have to give something up in order to gain something.  The trick, of course, is getting something you value greatly while giving up something that does not mean as much to you.  For cloud migration, these benefits are being realised at the expense of visibility and insight into those cloud environments. 

When we surveyed a range of businesses on their virtualisation practices, just 37% monitored their virtualised environments with the same rigor as their physical networks.  So there is a big visibility gap when it comes to the cloud.  While that may seem like a good trade-off today, it may feel different if and when things go wrong.   Most organisations cannot take that chance, so they need to bridge the visibility gap quickly.  They need it for better control, to maintain security no matter where their data goes, and of course to ensure reliability of their core business applications. 

It would seem like addressing this visibility gap could be fixed easily by inserting virtual network taps into the virtualised environment and sending the traffic to their monitoring, analytics, and security tools.  Unfortunately, doing this would quickly flood these tools with data, because internal East-West traffic in virtual data centres typically represents 80% of the total traffic.  It would be like connecting a lawn sprinkler to a fire hydrant.  Identifying and extracting only relevant traffic is key, but how can you do that efficiently?  More so, how can your virtual taps handle scaling up and down as virtual machines emerge and dissolve? Let’s take a closer look at the key requirements for visibility and monitoring in virtual environments.

Expanding your (visibility) horizon

There are four key points to consider when deploying virtual taps so you end up with meaningful, granular access to critical application traffic on virtualised networks. 

Horizontal scale: Cloud environments are attractive because they can scale up and down rapidly as user demands and workloads change. When placing the virtual taps in the virtual network, you need to be sure they can scale up to accommodate rapid growth in traffic volumes as well as user numbers and data interactions.  The taps should do this automatically, without needing IT intervention.  Virtualisation means agility, so if an application or service expands to handle 10x or 100x the number of users, make sure the virtual tap you are using can scale elastically – without impacting application performance. 

Securing in the dark: Virtualised networks are typically segmented using virtual firewalls to protect key applications and services from attack, and to prevent lateral movement in the virtualised environment that could compromise data or resources.  So the virtual taps you use needs to be able to see the application and network traffic flowing between segments.  With this comprehensive insight, you can ensure that the appropriate security rules and policies governing each segment are being enforced. 

More containers: As virtual machine use grows, container use multiplies even faster – by as much as 10-fold or more, as each application may employ multiple containers.  If your organisation is using container-based virtualisation to boost application performance, the virtual tap must be able to access traffic in the container environment.

DevOps elasticity: When your DevOps team puts out a new build – which, remember, doesn’t just cover new applications and services, but also updates to existing ones – then that update propagates across the virtual environment.  Individual virtual machines, containers, and by association their hosted applications, have shorter and shorter lifespans requiring continual awareness of the actual state of the environment. It is vital that these changes not block the entire traffic path, or take the virtual tap down with it.  As an example, consider how to archive and retrieve monitored traffic from a container that no longer exists.   The tap is your sentinel, which has to maintain pervasive access to traffic to enable you to see what is happening on the virtual network:  it must be fault-tolerant, even if the application it is monitoring fails. 

These four points apply when monitoring any virtualised environment, whether public cloud, private cloud or software defined wide-area networks (SD-WANs):  the virtual taps and the overall visibility solution need to be completely environment-agnostic. 

Elastic visibility

Once the virtual taps have been deployed to extract traffic from the virtual machines in your environments, you are ready to start processing packets.  This volume of traffic needs filtering and controlling using a network packet broker.  That keeps duplicate data from overwhelming monitoring and security tools and ensures they scale up/down as needed.  Data traffic should be broken up into manageable pieces using packet filtering, grooming and brokering processes, to make sure the security systems and analytics tools are seeing everything.

Elastically-scalable access is achievable for all the data crossing their virtual networks and clouds as well as intelligent distribution to analytics and compliance tools.  Leaving your data unmonitored is not smart business.  You do not have to give up visibility to gain cloud speed and cost advantages.  With the right architecture, you can have both so you should not compromise.   

It’s that time of year again! Finance teams are putting the finishing touches on next year’s corporate budgets and teams are likely looking back on 2016 to see what to change or improve in the year ahead.
Here at Vena, we’re making our annual predictions in finance and corporate performance management for 2017. We pulled the predictions after countless conversations with customers, partners, industry analysts and more. Buckle your seatbelts, I’m sure 2017 will be a wild ride!

read more

While cloud may have formally entered the enterprise in 2006, it’s now a reality for nearly every company. The Cloud Era got its start with Software as a service (SaaS) offerings that paved the way for innovations in CRM and email deployments, to create new opportunities for the likes of Salesforce and Microsoft Office 365. Still in its “early stages,” cloud now encompasses legacy applications, backups, disaster recovery, security/audit log management and so much more. 2017 will be full of continued maturation and will give way to a whole new generation of cloud-native applications.

read more