Cloud

5/25/2017
03:00 PM
Mike Convertino
Mike Convertino
Commentary
Connect Directly
LinkedIn
RSS
E-Mail vvv
100%
0%

In the Cloud, Evolving Infrastructure Means Evolving Alliances

New opportunities make for unusual bedfellows. Here's how to navigate the shift in organizational dynamics between security operations, line-of-business managers, and developers.

In the olden days of cybersecurity (you know, before 2015 or so), a company's legal and security departments tended to move in lock step. Better security went hand-in-hand with better compliance, which to a company’s legal team equated to lower risk.

Conversely, the relationship between security operations and line-of-business managers and developers was tenuous. Security was constantly shutting down or hindering efforts to move to the online services the business wanted, and developers couldn’t be trusted to write secure on-prem apps, let alone spin up data instances in the cloud.

But today? The alliances of old are strained, and the new opportunities in the cloud and in containers are making for some unusual bedfellows.

Many times the CISO is better off in the cloud. Maybe some of your on-premises systems are getting long in the tooth, or certain capabilities in the cloud are just better. These days platforms like Office 365 will develop for the cloud first, and then move new features to the datacenter.

Suddenly, you have logs you never had before. You can make policies and deploy them without re-provisioning. Instead of closing a port on a firewall on prem, you can go directly to an actual individual file — not just a port or a router. 

You can see an anomaly and automate the specific response. You can say, "Jimmy can't write .ppts or .pdfs anymore, because it looks like he's trying to export," but he can still do his day-to-day business while you investigate. And the whole time, you can see all the transactions happening where you can't on your on-prem file server.

In the cloud, the CIO is elated because he gets to make customers happy, and the developers are happy, too, because they get to make more apps, more quickly.

And instead of putting in a whopping capital expense request every five years to update systems, you've got a predictable and recurring opex line, which means instead of rolling his eyes, your CFO can plan for your needs. (I mean … maybe he still rolls his eyes, but probably not as much.)

But what about the security team's old friend Legal? Surely they'll be excited that we're offloading risk and updating compliance (based on the cloud vendor's robust certification library), right?

Well, instead of being a security issue or a technology issue, legal approval often amounts to a matter of contracts and customer data. You may be restricted from moving it to the cloud, or at least unable to do so without approval, especially for customers in highly regulated industries.

This is where it becomes crucial to understand the security position of on-premises systems compared to the cloud. Most frequently, the cloud provider is going to be certified and audited to an extent the organization just can’t match.

The CISO's ability to articulate that value and sell it in to the general counsel is critical. More advanced legal departments will realize the reduction in risk because providers are certified in so many ways. But if your counsel is more conservative, it may be a tough argument no matter how articulate you are.

So you lost legal.

But now you have the COO, the CIO, and the CFO on board because you've created a predictable operations expense out of a formerly unpredictable cap-ex hit and reduced headcount requirements both in IT and information security. Business group owners are pleased because of the rich SaaS offerings now available to them. And the company is innovating in the cloud at a rate they never could on premises.

In the end, the benefits of moving to the cloud for many situations are just too great to ignore. Better security, more information, predictable costs, and other factors tend to make the argument for themselves.

But it's also important to understand the corresponding shift in organizational dynamics. Getting everyone on the same page can help smooth the transition and lead to a healthier organization overall.  

Related Content:

 



Mike Convertino has nearly 30 years of experience in providing enterprise-level information security, cloud-grade information systems solutions, and advanced cyber capability development. His professional experience spans security leadership and product development at a wide ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Election Websites, Back-End Systems Most at Risk of Cyberattack in Midterms
Kelly Jackson Higgins, Executive Editor at Dark Reading,  8/14/2018
Intel Reveals New Spectre-Like Vulnerability
Curtis Franklin Jr., Senior Editor at Dark Reading,  8/15/2018
Australian Teen Hacked Apple Network
Dark Reading Staff 8/17/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-15504
PUBLISHED: 2018-08-18
An issue was discovered in Embedthis GoAhead before 4.0.1 and Appweb before 7.0.2. The server mishandles some HTTP request fields associated with time, which results in a NULL pointer dereference, as demonstrated by If-Modified-Since or If-Unmodified-Since with a month greater than 11.
CVE-2018-15505
PUBLISHED: 2018-08-18
An issue was discovered in Embedthis GoAhead before 4.0.1 and Appweb before 7.0.2. An HTTP POST request with a specially crafted "Host" header field may cause a NULL pointer dereference and thus cause a denial of service, as demonstrated by the lack of a trailing ']' character in an IPv6 a...
CVE-2018-15492
PUBLISHED: 2018-08-18
A vulnerability in the lservnt.exe component of Sentinel License Manager version 8.5.3.35 (fixed in 8.5.3.2403) causes UDP amplification.
CVE-2018-15494
PUBLISHED: 2018-08-18
In Dojo Toolkit before 1.14, there is unescaped string injection in dojox/Grid/DataGrid.
CVE-2018-15495
PUBLISHED: 2018-08-18
/filemanager/upload.php in Responsive FileManager before 9.13.3 allows Directory Traversal and SSRF because the url parameter is used directly in a curl_exec call, as demonstrated by a file:///etc/passwd value.