Cloud

5/25/2017
03:00 PM
Mike Convertino
Mike Convertino
Commentary
Connect Directly
LinkedIn
RSS
E-Mail vvv
100%
0%

In the Cloud, Evolving Infrastructure Means Evolving Alliances

New opportunities make for unusual bedfellows. Here's how to navigate the shift in organizational dynamics between security operations, line-of-business managers, and developers.

In the olden days of cybersecurity (you know, before 2015 or so), a company's legal and security departments tended to move in lock step. Better security went hand-in-hand with better compliance, which to a company’s legal team equated to lower risk.

Conversely, the relationship between security operations and line-of-business managers and developers was tenuous. Security was constantly shutting down or hindering efforts to move to the online services the business wanted, and developers couldn’t be trusted to write secure on-prem apps, let alone spin up data instances in the cloud.

But today? The alliances of old are strained, and the new opportunities in the cloud and in containers are making for some unusual bedfellows.

Many times the CISO is better off in the cloud. Maybe some of your on-premises systems are getting long in the tooth, or certain capabilities in the cloud are just better. These days platforms like Office 365 will develop for the cloud first, and then move new features to the datacenter.

Suddenly, you have logs you never had before. You can make policies and deploy them without re-provisioning. Instead of closing a port on a firewall on prem, you can go directly to an actual individual file — not just a port or a router. 

You can see an anomaly and automate the specific response. You can say, "Jimmy can't write .ppts or .pdfs anymore, because it looks like he's trying to export," but he can still do his day-to-day business while you investigate. And the whole time, you can see all the transactions happening where you can't on your on-prem file server.

In the cloud, the CIO is elated because he gets to make customers happy, and the developers are happy, too, because they get to make more apps, more quickly.

And instead of putting in a whopping capital expense request every five years to update systems, you've got a predictable and recurring opex line, which means instead of rolling his eyes, your CFO can plan for your needs. (I mean … maybe he still rolls his eyes, but probably not as much.)

But what about the security team's old friend Legal? Surely they'll be excited that we're offloading risk and updating compliance (based on the cloud vendor's robust certification library), right?

Well, instead of being a security issue or a technology issue, legal approval often amounts to a matter of contracts and customer data. You may be restricted from moving it to the cloud, or at least unable to do so without approval, especially for customers in highly regulated industries.

This is where it becomes crucial to understand the security position of on-premises systems compared to the cloud. Most frequently, the cloud provider is going to be certified and audited to an extent the organization just can’t match.

The CISO's ability to articulate that value and sell it in to the general counsel is critical. More advanced legal departments will realize the reduction in risk because providers are certified in so many ways. But if your counsel is more conservative, it may be a tough argument no matter how articulate you are.

So you lost legal.

But now you have the COO, the CIO, and the CFO on board because you've created a predictable operations expense out of a formerly unpredictable cap-ex hit and reduced headcount requirements both in IT and information security. Business group owners are pleased because of the rich SaaS offerings now available to them. And the company is innovating in the cloud at a rate they never could on premises.

In the end, the benefits of moving to the cloud for many situations are just too great to ignore. Better security, more information, predictable costs, and other factors tend to make the argument for themselves.

But it's also important to understand the corresponding shift in organizational dynamics. Getting everyone on the same page can help smooth the transition and lead to a healthier organization overall.  

Related Content:

 



Mike Convertino has nearly 30 years of experience in providing enterprise-level information security, cloud-grade information systems solutions, and advanced cyber capability development. His professional experience spans security leadership and product development at a wide ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
WebAuthn, FIDO2 Infuse Browsers, Platforms with Strong Authentication
John Fontana, Standards & Identity Analyst, Yubico,  9/19/2018
Turn the NIST Cybersecurity Framework into Reality: 5 Steps
Mukul Kumar & Anupam Sahai, CISO & VP of Cyber Practice and VP Product Management, Cavirin Systems,  9/20/2018
NSS Labs Files Antitrust Suit Against Symantec, CrowdStrike, ESET, AMTSO
Kelly Jackson Higgins, Executive Editor at Dark Reading,  9/19/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Flash Poll
The Risk Management Struggle
The Risk Management Struggle
The majority of organizations are struggling to implement a risk-based approach to security even though risk reduction has become the primary metric for measuring the effectiveness of enterprise security strategies. Read the report and get more details today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-1664
PUBLISHED: 2018-09-25
IBM DataPower Gateway 7.1.0.0 - 7.1.0.23, 7.2.0.0 - 7.2.0.21, 7.5.0.0 - 7.5.0.16, 7.5.1.0 - 7.5.1.15, 7.5.2.0 - 7.5.2.15, and 7.6.0.0 - 7.6.0.8 as well as IBM DataPower Gateway CD 7.7.0.0 - 7.7.1.2 echoing of AMP management interface authorization headers exposes login credentials in browser cache. ...
CVE-2018-1669
PUBLISHED: 2018-09-25
IBM DataPower Gateway 7.1.0.0 - 7.1.0.23, 7.2.0.0 - 7.2.0.21, 7.5.0.0 - 7.5.0.16, 7.5.1.0 - 7.5.1.15, 7.5.2.0 - 7.5.2.15, and 7.6.0.0 - 7.6.0.8 as well as IBM DataPower Gateway CD 7.7.0.0 - 7.7.1.2 are vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote atta...
CVE-2018-1539
PUBLISHED: 2018-09-25
IBM Rational Engineering Lifecycle Manager 5.0 through 5.02 and 6.0 through 6.0.6 could allow remote attackers to bypass authentication via a direct request or forced browsing to a page other than URL intended. IBM X-Force ID: 142561.
CVE-2018-1560
PUBLISHED: 2018-09-25
IBM Rational Engineering Lifecycle Manager 5.0 through 5.02 and 6.0 through 6.0.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a tr...
CVE-2018-1588
PUBLISHED: 2018-09-25
IBM Jazz Foundation (IBM Rational Engineering Lifecycle Manager 5.0 through 5.02 and 6.0 through 6.0.6) is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resourc...