Cloud

5/25/2017
03:00 PM
Mike Convertino
Mike Convertino
Commentary
Connect Directly
LinkedIn
RSS
E-Mail vvv
100%
0%

In the Cloud, Evolving Infrastructure Means Evolving Alliances

New opportunities make for unusual bedfellows. Here's how to navigate the shift in organizational dynamics between security operations, line-of-business managers, and developers.

In the olden days of cybersecurity (you know, before 2015 or so), a company's legal and security departments tended to move in lock step. Better security went hand-in-hand with better compliance, which to a company’s legal team equated to lower risk.

Conversely, the relationship between security operations and line-of-business managers and developers was tenuous. Security was constantly shutting down or hindering efforts to move to the online services the business wanted, and developers couldn’t be trusted to write secure on-prem apps, let alone spin up data instances in the cloud.

But today? The alliances of old are strained, and the new opportunities in the cloud and in containers are making for some unusual bedfellows.

Many times the CISO is better off in the cloud. Maybe some of your on-premises systems are getting long in the tooth, or certain capabilities in the cloud are just better. These days platforms like Office 365 will develop for the cloud first, and then move new features to the datacenter.

Suddenly, you have logs you never had before. You can make policies and deploy them without re-provisioning. Instead of closing a port on a firewall on prem, you can go directly to an actual individual file — not just a port or a router. 

You can see an anomaly and automate the specific response. You can say, "Jimmy can't write .ppts or .pdfs anymore, because it looks like he's trying to export," but he can still do his day-to-day business while you investigate. And the whole time, you can see all the transactions happening where you can't on your on-prem file server.

In the cloud, the CIO is elated because he gets to make customers happy, and the developers are happy, too, because they get to make more apps, more quickly.

And instead of putting in a whopping capital expense request every five years to update systems, you've got a predictable and recurring opex line, which means instead of rolling his eyes, your CFO can plan for your needs. (I mean … maybe he still rolls his eyes, but probably not as much.)

But what about the security team's old friend Legal? Surely they'll be excited that we're offloading risk and updating compliance (based on the cloud vendor's robust certification library), right?

Well, instead of being a security issue or a technology issue, legal approval often amounts to a matter of contracts and customer data. You may be restricted from moving it to the cloud, or at least unable to do so without approval, especially for customers in highly regulated industries.

This is where it becomes crucial to understand the security position of on-premises systems compared to the cloud. Most frequently, the cloud provider is going to be certified and audited to an extent the organization just can’t match.

The CISO's ability to articulate that value and sell it in to the general counsel is critical. More advanced legal departments will realize the reduction in risk because providers are certified in so many ways. But if your counsel is more conservative, it may be a tough argument no matter how articulate you are.

So you lost legal.

But now you have the COO, the CIO, and the CFO on board because you've created a predictable operations expense out of a formerly unpredictable cap-ex hit and reduced headcount requirements both in IT and information security. Business group owners are pleased because of the rich SaaS offerings now available to them. And the company is innovating in the cloud at a rate they never could on premises.

In the end, the benefits of moving to the cloud for many situations are just too great to ignore. Better security, more information, predictable costs, and other factors tend to make the argument for themselves.

But it's also important to understand the corresponding shift in organizational dynamics. Getting everyone on the same page can help smooth the transition and lead to a healthier organization overall.  

Related Content:

 



Mike Convertino has nearly 30 years of experience in providing enterprise-level information security, cloud-grade information systems solutions, and advanced cyber capability development. His professional experience spans security leadership and product development at a wide ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
The Year in Security 2018
This Dark Reading Tech Digest explores the biggest news stories of 2018 that shaped the cybersecurity landscape.
Flash Poll
How Enterprises Are Attacking the Cybersecurity Problem
How Enterprises Are Attacking the Cybersecurity Problem
Data breach fears and the need to comply with regulations such as GDPR are two major drivers increased spending on security products and technologies. But other factors are contributing to the trend as well. Find out more about how enterprises are attacking the cybersecurity problem by reading our report today.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-0624
PUBLISHED: 2019-01-17
A spoofing vulnerability exists when a Skype for Business 2015 server does not properly sanitize a specially crafted request, aka "Skype for Business 2015 Spoofing Vulnerability." This affects Skype.
CVE-2019-0646
PUBLISHED: 2019-01-17
A Cross-site Scripting (XSS) vulnerability exists when Team Foundation Server does not properly sanitize user provided input, aka "Team Foundation Server Cross-site Scripting Vulnerability." This affects Team.
CVE-2019-0647
PUBLISHED: 2019-01-17
An information disclosure vulnerability exists when Team Foundation Server does not properly handle variables marked as secret, aka "Team Foundation Server Information Disclosure Vulnerability." This affects Team.
CVE-2018-20727
PUBLISHED: 2019-01-17
Multiple command injection vulnerabilities in NeDi before 1.7Cp3 allow authenticated users to execute code on the server side via the flt parameter to Nodes-Traffic.php, the dv parameter to Devices-Graph.php, or the tit parameter to drawmap.php.
CVE-2018-20728
PUBLISHED: 2019-01-17
A cross site request forgery (CSRF) vulnerability in NeDi before 1.7Cp3 allows remote attackers to escalate privileges via User-Management.php.