Cloud

1/18/2017
10:30 AM
Bill Kleyman
Bill Kleyman
Commentary
Connect Directly
Facebook
Twitter
LinkedIn
Google+
RSS
E-Mail vvv
50%
50%

Cloud Security & IoT: A Look At What Lies Ahead

In the brave new world of cloud, security teams must be as agile as possible. This means leveraging proactive monitoring tools, locking down access points, and forecasting requirements

In the cloud – just as in the physical world – the evolving threat dynamic is moving beyond services, users, and applications to new attack targets in the Internet of Things ranging from CCTV installations, refrigerators – and possibly even drones. This new paradigm will present many challenges for organizations; consider this, Gartner recently predicted that by 2018, 25% of corporate data traffic will flow directly from mobile devices to the cloud, bypassing enterprise security controls.

So, what does this mean for the modern organization? Where should companies be focusing their efforts when working to secure their cloud and IT environments? The new digital challenge is that our configurations and workloads will be at risk, requiring out-of-the-box thinking and new security strategies. Here are four examples of what I mean:

Greater Focus on Endpoints and Users
We all remember the good old days of traditional AV. We’re pretty far beyond that now with the next-generation of new endpoint protection (EPP) and endpoint detection and response (EDR) systems. This will require advanced capabilities around sandboxing, cloud integration, and intelligent threat analytics that offer new ways to secure users, your mobile environment, and how data interacts with endpoints.

Companies like Trend Micro, CrowdStrike, CarbonBlack, and others fall into the EPP/EDR market. They’ve introduced a new generation of endpoint security that integrates with overall managed security solutions and utilize machine-learning capabilities and security artificial intelligence to look into malformed files, deep metadata analytics, and even powerful offline capabilities. This helps mobile users leveraging a variety of devices to be secure and still consume digital content from their organizations.

Security Automation and Orchestration
Automated IT systems you can incorporate into your security architectures will be a big business in 2017 and beyond. With security workflow automation, you can intelligently control massive settings and environment changes encompassing multiple data centers and global locations. In other words, instead of manual process and configurations, you can use automation tools to ensure you have the right security policies in place. The great impact here is that you can have heterogeneous security systems all automatically managed by a single system.

The other big automation security control factor revolves around users. Today, there are powerful user-control automation systems which can integrate with human resource and business processes. I often see organizations working with hundreds, sometimes thousands, of contacts. Managing user identities isn’t always easy – and many times it’s a very manual process. This needs to stop. Rogue accounts, lost users, misconfigured permissions, and forgotten access controls are ALL security holes. Today’s automation software tools allow organizations to onboard and offboard entire subsets of users. Plus, they will integrate with HR systems and even alert administrators as well as HR when new users are created or removed.

Internal Security Lifecycle Management
This falls into the manual category of security control. New tools around security event and information management (SIEM) give administrators a lot more control around their security ecosystem. Remember, it’s not just a firewall any longer. We have app firewalls, security analytics, network forensics and intelligence, and a lot of other tools helping keep our infrastructure secure. Aggregating logs and events is going to be critical to catch problems before they become major issues. Furthermore, you’ll be able to control updates, patches, and see which systems need to be updated. Even in large organizations, you can still find old Cisco or Juniper devices which haven’t patched in ages. How much do you know about what’s going in your cloud ecosystem?

Testing, cloud-to-cloud security, and file watermarking
Cloud and virtualization have made it much easier to test out new types of security systems. If you’re planning on new cloud deployments or are working with an expanding data footprint, it’s critical for you to look at new technologies aimed at new wave IT initiatives that help with cloud vulnerability management, compliance, visibility, app security, and even penetration testing. There are other technologies that will interrogate the requesting source, and help further lock down data being sent down via authentication, watermarking, and advanced access rights management. The point is that emerging security technologies are specifically taking aim at new types of cloud and physical threats. Don’t be afraid to test out these systems or work with a partner to help guide the way.

At the end of the day, my biggest piece of advice is for organizations to remain agile with your cloud security. This means leveraging proactive monitoring tools, locking down access points and forecasting requirements. No environment will ever be 100% safe. Your goal should be to create as much visibility into your environment you can, and have contingency plans for as many security events as possible.

Related Content:

 

Bill is an enthusiastic technologist with experience in datacenter design, management, and deployment. His architecture work includes large virtualization and cloud deployments as well as business network design and implementation. Bill enjoys writing, blogging, and educating ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
1.9 Billion Data Records Exposed in First Half of 2017
Kelly Jackson Higgins, Executive Editor at Dark Reading,  9/20/2017
Get Serious about IoT Security
Derek Manky, Global Security Strategist, Fortinet,  9/20/2017
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
Security Vulnerabilities: The Next Wave
Just when you thought it was safe, researchers have unveiled a new round of IT security flaws. Is your enterprise ready?
Flash Poll
[Strategic Security Report] How Enterprises Are Attacking the IT Security Problem
[Strategic Security Report] How Enterprises Are Attacking the IT Security Problem
Enterprises are spending more of their IT budgets on cybersecurity technology. How do your organization's security plans and strategies compare to what others are doing? Here's an in-depth look.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-0290
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

CVE-2016-10369
Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

CVE-2016-8202
Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

CVE-2016-8209
Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

CVE-2017-0890
Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.