Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Cloud

4/7/2017
02:30 PM
Kaushik Narayan
Kaushik Narayan
Commentary
Connect Directly
LinkedIn
RSS
E-Mail vvv
50%
50%

The New Shadow IT: Custom Data Center Applications

If you think you've finally gotten control of unsanctioned user apps, think again. The next wave of rogue apps is on its way from your data center to the cloud.

Over the years, the consumerization of IT has spurred a free-for-all in the adoption of cloud services. As employees found unsanctioned applications to help them do their jobs, overwhelmed security teams took a head-in-the-sand approach, giving rise to a serious problem dubbed "Shadow IT." But how big of a problem is Shadow IT, really? That depends who you ask.

Based on my personal conversations, CIOs estimate the number of unsanctioned cloud apps to be around 100. But in a tally based on an analysis of network logs, Shadow IT totals are much larger –averaging roughly 1,000 cloud services in use since early 2015.

Since those early days, companies have taken a more proactive and managed approach to the cloud by moving to enterprise-wide deployments of applications like Office 365, Salesforce, and Box. But just as organizations think they have Shadow IT under control, a new area of rogue cloud computing has emerged: custom applications developed by a company on its own and hosted in the cloud.

Everyone Is in the Business of Software Development
New research Skyhigh Networks conducted with the Cloud Security Alliance surveyed over 300 technology professionals from departments including software developers, IT, security, operations, and DevOps. The research showed that security teams, on average, estimate their organization uses 179 custom applications. But in reality, according to the research, the average organization uses 464 custom applications, with larger companies with over 50,000 employees averaging 788 applications! That means security is aware of only 38% of custom cloud applications in use in their businesses.

Developers and DevOps build these applications for business use cases, but the applications do not necessarily pass through a security review before they are deployed. What are they? Custom applications serve diverse functions across internal employees, third-party business partners, and customers. A company may develop their own HR benefits application, code-sharing platform, or customer service tools. As a result, these applications often hold sensitive data ranging from personally identifiable information, confidential intellectual property, and payment data.

[Check out the two-day Dark Reading Cybersecurity Crash Course at Interop ITX, May 15 & 16, where Dark Reading editors and some of the industry's top cybersecurity experts will share the latest data security trends and best practices.]

These applications pose many of the same risks to corporate data as SaaS applications. But they also can trigger additional threats because they are hosted in IaaS platforms. In 2017, we will witness a tipping point for custom app deployment, when, for the first time, companies plan to deploy a majority of their computing resources in the cloud. According to Skyhigh and CSA’s survey, 61% of custom applications are currently hosted in corporate data centers, but that percentage will decline to 46% by the end of the year.

And, it’s not just trivial, low-impact applications that are moving to the cloud. According to our survey, of companies with business-critical custom applications, 46% already host those applications in the cloud with the remaining majority of custom applications developed for use in the datacenter. Retrofitting these data center applications with cloud-specific security will require development resources that most talent-strapped security departments simply do not have.

Missing Pieces of Custom Application Security
Custom applications hosted on IaaS share many of the same threats to data as SaaS. But SaaS security gives us a framework to understand these threats in IaaS-hosted custom apps. Malicious insiders, employee error, and compromised accounts, for example, all create risk to sensitive data in custom applications that could potentially lead to compliance violations. For instance, in a typical IaaS environment, a company could have a custom CRM application in the cloud with an encrypted field for credit card numbers, but employees may carelessly enter credit card numbers in a different unencrypted field like "Notes," violating PCI regulations.

Hosted in IaaS platforms, custom applications pose unique security challenges as well. Enterprise SaaS service providers develop robust APIs that allow customers to monitor and enforce security policies at scale across billions of activities every month. For example, Slack recently launched an Enterprise Grid API to accommodate security teams' requirement to monitor high risk activity on the application. Enterprise SaaS applications also create markets for security solutions from third-party providers. Custom enterprise applications lack both traits, leaving security teams on their own to lock down hundreds of applications.

As a result, companies will be left struggling to address four critical areas of security functionality:

Threat Protection: SOC teams require behavioral monitoring to detect threats in action – for example, anomalous behavior that is indicative of a compromised account. Enterprise SaaS services provide APIs or event logs for consumption from third party security providers, but custom applications require custom-developed solutions to analyze activity data. There is a huge blindspot across custom applications for threats from inside and outside the company.

Encryption: Regulations like HIPAA require organizations to encrypt sensitive data uploaded to the cloud. Specifically, organizations often need to encrypt data in their own geographic district with their own customer-managed encryption keys. Companies did not have to contend with these requirements when their custom applications were in the data center, but now that custom applications are on IaaS cloud platforms, they will be held responsible for violations.

Data Loss Prevention: SaaS platforms open the door to access to data anywhere. Cloud-hosted custom applications are available via the open Internet, putting sensitive data at risk of violating corporate security policies. The data companies want to protect with data loss prevention includes social security numbers, salaries, IP addresses, file names containing "password," and more. Controls enforcing off-network, BYOD, location-based, and content-based access policies are just a few of the capabilities IT security should insist on.

Activity monitoring: Incident response and audit teams require an audit trail of behavior on an application for post-incident forensic investigations. When custom applications leave the datacenter for IaaS platforms, they lose event logging capabilities by default. Without any record of employee activity, IT security cannot effectively respond to and remediate security incidents.

Why has security been circumvented in the flood of custom applications to the cloud? If the first wave of Shadow IT was the consumerization of applications via SaaS, the next wave has become the consumerization of infrastructure where developers and DevOps no longer need to work with security to access datacenter resources. As a result, security is faced with a stark ultimatum: Enable security for custom applications or be left behind.

Related Content:

 

Kaushik Narayan is a co-founder and CTO at Skyhigh Networks, where he is responsible for Skyhigh's technology vision and software architecture. He brings over 18 years of experience driving technology and architecture strategy for enterprise-class products. He has been ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Catherine Hudson
50%
50%
Catherine Hudson,
User Rank: Apprentice
5/18/2017 | 1:08:32 PM
Measures
Thank you, for raising a topical issue. I think SAM tools, such as Binadox, can help to solve at least part of the issue. They monitor SaaS subscription and usage events and thus, you can analyze what applications are used by your employees and decide what exposures they have to take measures.
BrooklynNellie2
100%
0%
BrooklynNellie2,
User Rank: Strategist
4/11/2017 | 8:49:47 AM
Re: The subject of your site is awesome and i'm interested to know more about..
Where's the "report spam" button?
MoleanM781
33%
67%
MoleanM781,
User Rank: Apprentice
4/8/2017 | 3:59:12 AM
The subject of your site is awesome and i'm interested to know more about..
I'm extremely pleased to discover this site. I want to to thank you for your time for this particularly wonderful read!! I definitely loved every part of it and I have you bookmarked to check out new stuff in your site.<br/><a href="https://www.hoursguru.com/bdm-customs/" >Bdm Customs Near Me</a><br/><a href="https://www.hoursguru.com/a-and-w-distributor/" >A & W Distributor Working Hours</a>
COVID-19: Latest Security News & Commentary
Dark Reading Staff 9/21/2020
Cybersecurity Bounces Back, but Talent Still Absent
Simone Petrella, Chief Executive Officer, CyberVista,  9/16/2020
Meet the Computer Scientist Who Helped Push for Paper Ballots
Kelly Jackson Higgins, Executive Editor at Dark Reading,  9/16/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Latest Comment: Exactly
Current Issue
Special Report: Computing's New Normal
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
How IT Security Organizations are Attacking the Cybersecurity Problem
How IT Security Organizations are Attacking the Cybersecurity Problem
The COVID-19 pandemic turned the world -- and enterprise computing -- on end. Here's a look at how cybersecurity teams are retrenching their defense strategies, rebuilding their teams, and selecting new technologies to stop the oncoming rise of online attacks.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-11856
PUBLISHED: 2020-09-22
Arbitrary code execution vulnerability on Micro Focus Operation Bridge Reporter, affecting version 10.40 and earlier. The vulnerability could allow remote attackers to execute arbitrary code on affected installations of OBR.
CVE-2020-16202
PUBLISHED: 2020-09-22
WebAccess Node (All versions prior to 9.0.1) has incorrect permissions set for resources used by specific services, which may allow code execution with system privileges.
CVE-2020-24333
PUBLISHED: 2020-09-22
A vulnerability in Arista&acirc;&euro;&trade;s CloudVision Portal (CVP) prior to 2020.2 allows users with &acirc;&euro;&oelig;read-only&acirc;&euro;&#65533; or greater access rights to the Configlet Management module to download files not intended for access, located on the CVP server, by accessing ...
CVE-2020-4619
PUBLISHED: 2020-09-22
IBM Data Risk Manager (iDNA) 2.0.6 stores user credentials in plain in clear text which can be read by an authenticated user. IBM X-Force ID: 184976.
CVE-2020-4620
PUBLISHED: 2020-09-22
IBM Data Risk Manager (iDNA) 2.0.6 could allow a remote authenticated attacker to upload arbitrary files, caused by the improper validation of file extensions. By sending a specially-crafted HTTP request, a remote attacker could exploit this vulnerability to upload a malicious file, which could allo...