Private equity firms are snapping up manufacturing companies at a quick pace, setting off a merger and acquisition gold rush, while leaving multi-cloud manufacturing systems unprotected in a Zero Trust world.

Securing the manufacturing gold rush of 2019

The intensity private equity (PE) firms have for acquiring and aggregating manufacturing businesses is creating an abundance of opportunities for cybercriminals to breach the resulting businesses. For example, merging formerly independent infrastructures often leads to manufacturers maintaining — at least initially — multiple identity repositories such as Active Directory (AD), which contain privileged access credentials, usernames, roles, groups, entitlements, and more. Identity repository sprawl ultimately contributes to maintenance headaches but, more importantly, security blind spots that are being exploited by threat actors regularly.

A contributing factor is a fact that private equity firms rarely have advanced cybersecurity expertise or skills and therefore don’t account for these details in their business integration plans. As a result, they often rely on an outdated “trust but verify” approach, with trusted versus untrusted domains and legacy approaches to identity access management.

The speed PE firms are driving the manufacturing gold rush is creating a sense of urgency to stand up new businesses fast – leaving cybersecurity as an afterthought, if even a consideration at all. Here are several insights from PwC’s Global Industrial Manufacturing Deals Insights, Q2 2019 and Private Equity Trend Report, 2019, Powering Through Uncertainty:

• 39% of all PE investors rate the industrial manufacturing sector as the most attractive for acquiring and rolling up companies into new businesses
• The manufacturing industry saw a 31% increase in deal value from Q1 2019 to Q2 2019 with industrial manufacturing megadeals driving deal value to $27.4B in Q2, 2019, on 562 deals
• Year-to-date North American manufacturing has generated 184 deals worth $15.2B in 2019
•  Worldwide and North American cross-sector manufacturing deal volumes increased by 32% and 30% in Q2, 2019 alone

PE firms are also capitalising on how many family-run manufacturers are in the midst of a generational change in ownership. Company founders are retiring, and their children, nearly all of whom were raised working on the shop floor, are ready to sell. PE firms need to provide more cybersecurity guidance during these transactions to secure companies in transition. Here’s why:

• According to the 2019 Verizon Data Breach Investigation Report, manufacturing has been experiencing an increase in financially-motivated breaches in the past couple of years, whereby most incidents involve Phishing and the use of stolen credentials
• Manufacturing’s most commonly compromised data includes credentials (49%), internal operations data (41%), and company secrets (36%) according to the 2019 Verizon Data Breach Investigation Report
• 50% of manufacturers report experiencing a data breach or cyber-attack over the last 12 months, 11% of which were severe, according to the Sikich M&D Report 2019
• It’s the smaller suppliers in the supply chain or M&A process that hackers are starting to exploit to bring down many of the world’s largest manufacturing companies. Just ask one of the world’s leading shipping providers, A.P. Møller-Maersk

How to secure multi-cloud manufacturing systems in a Zero Trust world

To stop the cybercriminals’ gold rush, merged manufacturing businesses need to take the first step of adopting an approach to secure each acquired company’s identity repositories, whether on-premises or in the cloud. For example, instead of having to reproduce or continue to manage the defined rights and roles for users in each AD, manufacturing conglomerates can better secure their combined businesses using a multi-directory brokering approach.

Multi-directory brokering, such as the solution offered by privileged access management provider Centrify, empowers an organisation to use its existing or preferred identity directory as a single source of truth across the organisation, brokering access based on a single identity rather than having to manage user identities across multiple directories. For example, if an organisation using AD acquires an organisation using a different identity repository or has multiple cloud platforms, it can broker access across the environment no matter where the “master” identity for an individual exists. This is particularly important when it comes to privileged access to critical systems and data, as “identity sprawl” can leave gaping holes to be exploited by bad actors.

Multi-directory brokering is public cloud-agnostic, making it possible to support Windows and Linux instances in one or multiple infrastructure as a service (IaaS) platforms to secure multi-cloud manufacturing systems. The following diagram illustrates how multi-directory brokering scales to support multi-cloud manufacturing systems that often rely on hybrid multi-cloud configurations.

Manufacturers who are the most negatively impacted by the trade wars are redesigning and re-routing their supply chains to eliminate tariffs, so they don‘t have to raise their prices. Multi-cloud manufacturing systems are what they’re relying on to accomplish that. The future of their business will be heavily reliant upon how well they can secure the multi-cloud configurations of their systems. That’s why multi-directory brokering makes so much sense for manufacturers today, especially those looking for an exit strategy with a PE firm.

The PE firms driving the merger and acquisition (M&A) frenzy in specific sectors of manufacturing need to take a closer look at how identity and access management (IAM) is being implemented in the manufacturing conglomerates they are creating. With manufacturing emerging as a hot industry for PE, M&A, and data breaches, it’s time to move beyond replicating Active Directories and legacy approaches to IAM. One of the most important aspects of a successful acquisition is enabling administrators, developers, and operations teams to access systems securely, without massive incremental cost, effort, and complexity.

Conclusion

The manufacturing gold rush for PE firms doesn’t have to be one for cybercriminals as well. PE firms and the manufacturing companies they are snapping up need to pay more attention to cybersecurity during the initial integration phases of combining operations, including how they manage identities and access. Cybercriminals and bad actors both within and outside the merged companies are lying in wait, looking for easy-exploitable gaps to exfiltrate sensitive data for monetary gain, or in an attempt to thwart the new company’s success.

Interested in hearing industry leaders discuss subjects like this and sharing their experiences and use-cases? Attend the Cyber Security & Cloud Expo World Series with upcoming events in Silicon Valley, London and Amsterdam to learn more.

Bobby Hellard

No cloud is created equal – and according to a benchmark analysis of the biggest providers from network intelligence software provider ThousandEyes, performance varies between the hyperscalers with some potentially surprising findings.

The report, ThousandEyes’ 2019-2020 Cloud Performance Benchmark, assessed more than 320 million data points collected from almost 100 global metro locations over the course of a month. The study focused on Amazon Web Services (AWS), Microsoft Azure and Google Cloud Platform (GCP), as well as Alibaba Cloud and IBM Cloud.

The research not only assessed the speed of traffic being delivered by the biggest clouds, but also how it was getting there. ThousandEyes argued GCP and Azure rely heavily on private backbone networks, while AWS and Alibaba rely more heavily on the public internet. Fighting for room amid traffic jams means inevitable performance downturns. Last year’s report argued similar, exploring how AWS’ traffic only comes into its architectural backbone close to the target region.

Connectivity through China was seen as a crucial area of analysis – and the research found that even Alibaba suffered packet loss when crossing the Great Firewall.

Naturally, in some areas Alibaba would have been naturally considered the best of the bunch. Analysing the Singapore regions, customers in China using Alibaba would have a three times quicker service than IBM. Perhaps unsurprisingly, the research also found Alibaba outperformed the rest when it came to China-Hong Kong network speed.

As a result, for enterprises looking – and potentially avoiding – China, the research concluded there were viable options. Regular readers of this publication will be aware of the presence Singapore and Hong Kong can bring; the most recent analysis from the Asia Cloud Computing Association (ACCA) last year found the former had overtaken the latter as the strongest Asia-Pacific cloud nation. China, by contrast, was ranked second from last among 14 nations.

Compared with last year’s report, there are similarities. As can be expected, many of the headline-grabbing elements of reports such as this are to show that the long-term market leader – in this instance of course AWS – is more fallible than may be thought.

The report explored AWS Global Accelerator – Amazon’s fee paying service introduced this time last year for customers to use the AWS private backbone – and found that while performance gains were appreciable, it was not a one-size-fits-all solution.

Ultimately, as cloud workloads continue to become more complex, then the conversation around network and performance becomes more nuanced.

“It is imperative for enterprise IT leaders to understand that cloud architectures are complex and not to rely on network performance and connectivity assumptions or instincts while designing them,” the report concludes. “Enterprises relying heavily on the public cloud or considering a move to the cloud must arm themselves with the right data on an ongoing basis to guide the planning and operational stages.

“Every organisation is different, cloud architectures are highly customised and hence these results must be reviewed through the lens of one’s own business in choosing providers, regions and connectivity approaches.”

You can read the full report here (email required).

Interested in hearing industry leaders discuss subjects like this and sharing their experiences and use-cases? Attend the Cyber Security & Cloud Expo World Series with upcoming events in Silicon Valley, London and Amsterdam to learn more.

Bobby Hellard

At this year’s Microsoft Ignite conference, Microsoft CEO Satya Nadella placed the focus on consistent developer experiences in multi- and hybrid-cloud, alongside the announcements of new initiatives for “cloud-delivered quantum computing.” Nadella, in his keynote speech in Orlando, also emphasized the role of a consistent and reliable management platform across various cloud environments – including AWS and Google Cloud.

For instance, Azure Arc, which was introduced on the first day of Ignite, is “a control panel built for multi-cloud, multi-edge, and for the first time managed data services for where the edge compute is,” stated Nadella.

Before the premier Microsoft Ignite event for IT decision-makers, Microsoft had provided journalists an 87-page document that listed all news items to expect from the conference. But here are the top five announcements you should know about:

Azure Arc – manage resources anywhere

The Azure Arc control panel will let organizations leverage Azure to manage their resources across AWS and Google Cloud. The panel will also work for Linux and Windows Servers, and Kubernetes clusters as well. Furthermore, it will allow users to take limited Azure data services to these platforms. Previously, Azure Stack only worked on a limited set of hardware. Though Arc doesn’t have all Azure services, it will be a single platform for enterprises to manage their resources across a multi-cloud environment and their data centers. Owing to the complexities in hybrid environments, the control panel can be a single tool to keep enterprises in the Azure ecosystem.

Endpoint Manager – modernise device management

Per the keynote speech, Microsoft is set to combine ConfigMgr with Intune services that will allow organizations to manage laptops, PCs, tablets, and phones they issue to their employees, all under the Endpoint Manager. It’s also introducing a plethora of tools as well as recommendations to help companies modernize deployment strategies. Also, ConfigMgr users can now get a license to Intune, which will allow them to move to cloud-based management. Because security remains a significant concern in the BYOD world, managing all devices becomes a massive challenge for the IT department. With the latest offering, you can do away with multiple tools and get a single view of deployments.

Power Virtual Agents – the no-code bot builder

One of the most interesting announcements made at Microsoft Ignite has to be the introduction of Power Virtual Agents – the new ‘no-code/low-code’ tool for building chatbots. The tool uses Azure’s machine learning smarts to let users create chatbots by leveraging a visual interface. It will also allow users to integrate actual code. With the visual, anyone can build a chatbot and the creators will gain a better understanding of the user requirements than a developer who aren’t involved with business groups.

Azure Synapse – limitless analytics

Touted as the “limitless” analytics service, Microsoft introduced Azure Synapse Analytics, which is a combination of big-data analytics and data warehousing. The company said, “The service can use either serverless or provisioned resources to provide a unified experience to ingest, prepare, manage, and serve data for immediate BI and machine learning applications.” However, users can run existing data warehousing workloads with Azure Synapse. Microsoft said that it would be similar to integrating Apache Spark with SQL.

Microsoft 365 – Project Cortex

Microsoft 365 platform is also getting new additions this year. The company introduced Project Cortex, which is a new service in Microsoft 365 that leverages AI to classify all of an enterprise’s content into topics. The latest addition is set to create a network of knowledge that “improves individual productivity and organizational intelligence, helping identify experts on specific topics, and surfacing knowledge through interactive experiences across Microsoft 365.” The new service comes after Microsoft Teams and is now in private view. It is expected to be available in 2020.

Read more: With Azure Arc, Microsoft aims to go beyond traditional hybrid cloud – with Anthos and Outposts for company

Interested in hearing industry leaders discuss subjects like this and sharing their experiences and use-cases? Attend the Cyber Security & Cloud Expo World Series with upcoming events in Silicon Valley, London and Amsterdam to learn more.

Another day, another example of misunderstanding shared responsibility when it comes to cloud security. Or is it?

A new report from identity and access management (IAM) provider Centrify has argued that while many organisations understand the basics of shared responsibility, the increasing complexity of workloads means that confusion occurs when it comes to privileged access.

The study, titled ‘Reducing Risk in Cloud Migrations: Controlling Privileged Access to Hybrid and Multi-Cloud Environments’, polled more than 700 respondents across the UK, US, and Canada. Three in five (60%) respondents said security was the leading challenge when it came to cloud migration generally, while more than half (51%) affirmed they were taking different approaches to securing cloud workloads compared with on-premises.

Yet the responses begin to unravel after this. 60% of those polled said they believed cloud providers were responsible for securing privileged access. This goes to show that while some data may be more privileged than others, it all falls under the same bucket.

Cloud providers, as they frequently note, are responsible for the security of the cloud – infrastructure and uptimes et al – while the onus is on the user for security in the cloud; applications and data. While not being able to cut the cord completely, vendors have gradually taken more proactive steps; none more so than Amazon Web Services, who this time last year launched a new offering to help mitigate against open bucket misunderstandings – which are frequently an open goal for criminals.

For Centrify, the company’s focus on privileged access management (PAM) can be seen in other survey responses. More than two thirds (68%) of those polled said they were not implementing PAM best practices for cloud environments, while more than three quarters (76%) said they use more than one identity directory for their cloud strategy, putting them at risk of ‘identity sprawl’ attacks.

Organisations predominantly saw applying privileged access controls as a way to secure access to cloud service management – cited by 71% – while secure access to cloud workloads and containers was cited by more than half (53%). The report notes how that the more specific the privilege is, the interest diminishes in securing it.

In terms of best practices companies utilise, unsurprisingly the most popular was multi-factor authentication across all privileged access accounts – albeit only cited by 60% of those polled. The remaining factors were used by less than half of respondents, from operating a ‘least privileged access’ model (43%), to privileged session monitoring (38%). It must be noted that many of these questions come down to how many clients have an ‘all-in-one’ security offering, compared with a more bits-and-pieces strategy.

Centrify argues there are five key actions organisations should take; understanding privileged access to cloud environments was the company’s responsibility; reducing risk associated with identity sprawl; enforce a least privilege model; employ a common security model; and modernise your security approach, focusing on cloud-native PAM.

“We know that 80% of data breaches involved privileged access abuse, so it’s critical that organisations understand what they are responsible for when it comes to cloud security, and take a least privilege approach to controlling privileged access to cloud environments,” said Centrify CEO Tim Steinkopf. “Too much access and privilege puts their workloads and data at risk.”

You can read the full report here (email required).

Interested in hearing industry leaders discuss subjects like this and sharing their experiences and use-cases? Attend the Cyber Security & Cloud Expo World Series with upcoming events in Silicon Valley, London and Amsterdam to learn more.

Bobby Hellard

Dale Walker

The initial commercial interest in cryptocurrency IT infrastructure was the potential to enable an alternative to government-backed fiat currencies. However, now most of the forward-looking focus is on blockchain, the distributed ledger technology that underpins the new applications.

Although deployments are still very much in the realm of the early adopter, blockchain has proven advantages across several vertical industries: it is safe, decentralised, transparent and can reduce intermediary costs.

Blockchain use case market development

While many CIOs and CTOs believe that blockchain likely has a way to go before becoming a mainstream technology within their sector, five compelling use cases across asset tracking, financial services and digital identity are already in production.

They offer valuable business process improvements to the pioneering organisation that has already deployed a blockchain — whether in terms of increased efficiency, reduced fees and fraud, or full transparency across the whole network.

According to the latest worldwide market study by Juniper Research, the total value of B2B cross-border payments immutably stored on a blockchain will exceed $4.4 trillion by 2024 — that's up from $171 billion in 2019.

Blockchain enables real-time clearing and settlement for B2B transactions, while offering increased transparency and reduced costs. These practical applications can deliver significant other benefits.

The new research revealed that financial institutions will save $7 billion by 2024, due to the automation of ‘Know Your Customer’ checks, allied to the involvement of blockchain in identifying users via self-sovereign identity.

Juniper Research assessed 15 leading blockchain vendors, scoring them on experience in the sector, marketing efforts and customer deployments along with their blockchain solutions. Juniper identified the 5 leading vendors as follows: IBM, Infosys Finacle, Guardtime, R3 and Ripple.

The analyst research scored IBM highly for its diverse blockchain solutions in production, with a strong client base for many vertical industries. Additionally, Infosys Finacle has established itself as a leading blockchain provider for financial institutions, with global partners and popular solutions.

"The implementation of blockchain is part of a wider strategy for financial institutions to digitally transform operations," said Dr Morgane Kimmich, research analyst at Juniper Research. "Blockchain will enable stakeholders to reduce operational costs in a competitive market that is becoming increasingly commoditised."

The research found that Ripple, Visa and IBM are driving blockchain innovation in cross-border payments. Ripple has led the market since 2012, capitalising on its early mover advantage to grow to over 200 financial institution partners in 2019.

Outlook for blockchain applications innovation

However, Ripple is facing increased competition from Visa B2B Connect and IBM Blockchain World Wire, which have already grown their presence in 60 countries and have high-profile partners in the financial services ecosystem.

Moreover, the Juniper analyst anticipates that both companies will continue to exploit their global presence, trusted brand names and established business partner networks to scale their solutions. These market leaders are experienced in market development, moving new product and service offerings beyond the early adopter segment. More deployment growth is sure to follow their lead.

Interested in hearing more in person? Find out more at the Blockchain Expo World Series, Global, Europe and North America. 

IBM is looking to target financial services customers with the launch of what is being claimed as the world’s first financial services-ready public cloud – in association with Bank of America.

In some respects, this can be seen as a glorified customer update. Bank of America will be a ‘committed collaborator’ to use the platform, built on IBM’s public cloud, and will host key applications to support its 66 million banking customers.

Yet the companies have collaborated extensively on the product, naturally designed to stringent security practices. The duo is working with Promontory, an IBM business unit focused on financial services regulatory compliance consulting, while strict compliance will be enforced among ISVs or SaaS providers who wish to participate.

Red Hat OpenShift will be deployed as the product’s primary Kubernetes environment to manage containerised software, with more than 190 API-driven services being issued to create new cloud-native applications.

Financial services is an important battleground for the leading clouds. Amazon Web Services (AWS) cites three primary customers in this industry; Liberty Mutual, Starling Bank, and Capital One. The latter hit the headlines for the wrong reasons after a data breach was confirmed in July, although the company subsequently noted its cloud operating model helped solve the issue at greater speed. For Microsoft Azure, MetLife, German savings bank Provinzial and South African Nedbank are among its key clients.

This is not the entire story, however, as many financial services firms are looking to hybrid cloud to ensure sufficient digital adoption. According to a report from Nutanix issued in April, more than one in five financial organisations polled said they were deploying a hybrid cloud model, with the vast majority (91%) saying hybrid was their ‘ideal’ IT model.

“This is one of the most important collaborations in the financial services industry cloud space,” said Cathy Bessant, Bank of America chief operations and technology officer in a statement. “This industry-first platform will allow Bank of America to use the public cloud, putting data security, resiliency, privacy and customer information safety need at the forefront of decision making.

“By setting a standard that addresses the concern of hosting highly confidential information, we aim to drive the public cloud to a safety level that is unmatched,” Bessant added.

Interested in hearing industry leaders discuss subjects like this and sharing their experiences and use-cases? Attend the Cyber Security & Cloud Expo World Series with upcoming events in Silicon Valley, London and Amsterdam to learn more.