Welcome!

Cloud Security Authors: Rishi Bhargava, Elizabeth White, Liz McMillan, Kevin Jackson, Harry Trott

Related Topics: @CloudExpo, Industrial IoT, Microservices Expo, Containers Expo Blog, Agile Computing, Cloud Security, SDN Journal

@CloudExpo: Article

How Cloud Security Balances Risk Versus Reward

Moving beyond the concept of security as a cost center

I spend a great deal of my day thinking about security. How it affects the enterprise; how to best position and protect assets. How it shapes risk management and how it delivers potential benefits through smoother operations, enhanced trust and loss prevention.

At its core, security is about risk versus reward. It’s no great secret that many executives look at security as a cost center. Compounded by the requirements of compliance, the expansion of technology, and the nature of the modern enterprise, no one doubts the need to secure the enterprise…but to what degree? Securing your IT environment is not free, but there are best practices and technology options designed to mitigate costs while still providing a strong, manageable and proactive defense. While many companies still would rather spend capital on commodity assets, many CIOs recognize that information security is an important business driver. Many more still are looking to the cloud for security solutions to further reduce resource reliance.

In the end, it is a question each company must answer on its own. I can talk until I am blue in the face about the bogeymen of hacking, slipshod employees opening suspect emails, the exposure of a company’s most precious data, but the needs of the company—how it interacts with customers, the access it provides third parties, employee productivity processes, compliance requirements and all the other moving parts of an active organization--must create and prioritize the roadmap based on understood vulnerabilities and available resources.

However, therein lies the problem…understood vulnerabilities. This decision is based on assumptions, resource limitations and previous experience. But security issues are a moving target...it's more about knowing what you don't know. Obviously a bank or medical management facility is at more risk than a local dog grooming company, but that doesn’t mean it is any less vulnerable. In fact, the modest company might be at greater risk because even a small breach of customer data can devastate a company. A large company may be able to absorb (although painful) the fines, lawsuits and the loss of proprietary assets, but the impact on a small or mid-sized company is magnified. The damage to the trust factor alone could put them out of business.

This is not meant to be some sort of scare tactic, but the reality of doing business in the 21st century means every company must take some level of action to protect itself beyond filtering emails. However understanding investments in CapEx, resource and personnel expenditures, hardware and software management, this might be untenable for every company. This is where the CIO earns his keep. How much time and capital is necessary to invest versus the real threats to the network/assets (is a barking dog enough to chase away robbers, or do you need bolt locks, motion sensors, round-the-clock-sentries, gun turrets, etc…)

This is why cloud security (security managed from the cloud) provides the necessary balance in the risk versus reward quotient. Not only does it support a unified platform (PaaS or REACT), but eliminates many of the costs that throw the equation out of balance. A smaller company no longer has to decide to invest in virus sweepers OR access management, identity credentialing OR intrusion detection. A larger organization can reallocate important resources towards key revenue drivers and core competencies. A unified/centralized approach from the cloud provides all the capabilities with no additional capital expenditures. In the fact that it centralizes all the activity under a centralized pane of glass not only makes an organization response ready, but also automates a great deal of what compliance regulators are demanding.

What about the risk? Are organizations exposing or ceding control of their data in order to save a few bucks? Is a Pandora’s Box opening because functionality and reporting is virtualized? Of course not. Yet, with all business initiatives, there are risks. However, by applying such best practices as 24/7/365 monitoring, event correlation across multiple silos, and fostering interactive communication between functions closes the vulnerability gap significantly. But to harness all those capabilities a company would need to invest in SIEM, Access Management, Log Management, IDM and other security solutions. Before the cloud, this combined initiative was only an option available to Fortune 500 enterprises. Even applying some cloud-based tools, each of the referenced solutions typically works in parallel. What is needed is the ability to centralize and have each of the solutions leverage one another.

Now cloud security solutions and applications are two different animals when it comes to the all important data ownership and information liability. Security manages the data wherever it is stored-cloud or some locked server room in the basement of a fortified campus. It is the fence, not the animals held within. If there is a break in the fence, or the rancher hires irresponsible cowboys, then the herd is at risk. But if the foreman is vigilant about riding the perimeter and managing his employees, then there should be as many cows in the barn as there were the day before.

This is not to say data is unassailable every time the sales guy accesses the product demo site to present to a prospect via online third party collaboration software, but if the tools are in place, properly automated and integrated and the policies (access rules, credentialing, web authorization, monitoring etc…) are sound, risk goes down and reward goes up.

On Wall Street there is a “measurement” called the Sharpe Index. Essentially it characterizes how well the return of an asset compensates the investor for the risk taken. Part of the complex equation analyzes the variables to get to a positive return. Applied to finance the axiom typically means the greater the risk, the greater the return. When applied to security, and more pointedly, cloud-based security, the variables line up so that there doesn’t have to be a high trade off of risk and return Considering the lower investment, the faster deployment, the reduction of personnel and computing resources against an expanded enterprise toolset, improved capabilities, continuous and centralized alerts, security-as-a-service support and enhanced visibility across the organization, the path to realize rewards and ROI point to the cloud.

Bottom line, cloud-based security functionality is as trustworthy, as powerful and as comprehensive as any on-premise deployment. Because it is infinitely more affordable, flexible and manageable, it allows you to increase the layers of security around your enterprise for a fraction of the hard and soft costs. It allows you to concentrate on priorities, policies and core competencies to ensure your perimeters are safe and the cattle can always come in from the fields. Each company is unique in terms of its needs and security comfort level and its concept in determining risk versus reward. Yet biggest risk, in terms of security, is standing still.

More Stories By Kevin Nikkhoo

With more than 32 years of experience in information technology, and an extensive and successful entrepreneurial background, Kevin Nikkhoo is the CEO of the dynamic security-as-a-service startup Cloud Access. CloudAccess is at the forefront of the latest evolution of IT asset protection--the cloud.

Kevin holds a Bachelor of Science in Computer Engineering from McGill University, Master of Computer Engineering at California State University, Los Angeles, and an MBA from the University of Southern California with emphasis in entrepreneurial studies.

@ThingsExpo Stories
Extracting business value from Internet of Things (IoT) data doesn’t happen overnight. There are several requirements that must be satisfied, including IoT device enablement, data analysis, real-time detection of complex events and automated orchestration of actions. Unfortunately, too many companies fall short in achieving their business goals by implementing incomplete solutions or not focusing on tangible use cases. In his general session at @ThingsExpo, Dave McCarthy, Director of Products...
Information technology is an industry that has always experienced change, and the dramatic change sweeping across the industry today could not be truthfully described as the first time we've seen such widespread change impacting customer investments. However, the rate of the change, and the potential outcomes from today's digital transformation has the distinct potential to separate the industry into two camps: Organizations that see the change coming, embrace it, and successful leverage it; and...
Everyone knows that truly innovative companies learn as they go along, pushing boundaries in response to market changes and demands. What's more of a mystery is how to balance innovation on a fresh platform built from scratch with the legacy tech stack, product suite and customers that continue to serve as the business' foundation. In his General Session at 19th Cloud Expo, Michael Chambliss, Head of Engineering at ReadyTalk, discussed why and how ReadyTalk diverted from healthy revenue and mor...
20th Cloud Expo, taking place June 6-8, 2017, at the Javits Center in New York City, NY, will feature technical sessions from a rock star conference faculty and the leading industry players in the world. Cloud computing is now being embraced by a majority of enterprises of all sizes. Yesterday's debate about public vs. private has transformed into the reality of hybrid cloud: a recent survey shows that 74% of enterprises have a hybrid cloud strategy.
You have great SaaS business app ideas. You want to turn your idea quickly into a functional and engaging proof of concept. You need to be able to modify it to meet customers' needs, and you need to deliver a complete and secure SaaS application. How could you achieve all the above and yet avoid unforeseen IT requirements that add unnecessary cost and complexity? You also want your app to be responsive in any device at any time. In his session at 19th Cloud Expo, Mark Allen, General Manager of...
The 20th International Cloud Expo has announced that its Call for Papers is open. Cloud Expo, to be held June 6-8, 2017, at the Javits Center in New York City, brings together Cloud Computing, Big Data, Internet of Things, DevOps, Containers, Microservices and WebRTC to one location. With cloud computing driving a higher percentage of enterprise IT budgets every year, it becomes increasingly important to plant your flag in this fast-expanding business opportunity. Submit your speaking proposal ...
DevOps is being widely accepted (if not fully adopted) as essential in enterprise IT. But as Enterprise DevOps gains maturity, expands scope, and increases velocity, the need for data-driven decisions across teams becomes more acute. DevOps teams in any modern business must wrangle the ‘digital exhaust’ from the delivery toolchain, "pervasive" and "cognitive" computing, APIs and services, mobile devices and applications, the Internet of Things, and now even blockchain. In this power panel at @...
Major trends and emerging technologies – from virtual reality and IoT, to Big Data and algorithms – are helping organizations innovate in the digital era. However, to create real business value, IT must think beyond the ‘what’ of digital transformation to the ‘how’ to harness emerging trends, innovation and disruption. Architecture is the key that underpins and ties all these efforts together. In the digital age, it’s important to invest in architecture, extend the enterprise footprint to the cl...
Bert Loomis was a visionary. This general session will highlight how Bert Loomis and people like him inspire us to build great things with small inventions. In their general session at 19th Cloud Expo, Harold Hannon, Architect at IBM Bluemix, and Michael O'Neill, Strategic Business Development at Nvidia, discussed the accelerating pace of AI development and how IBM Cloud and NVIDIA are partnering to bring AI capabilities to "every day," on-demand. They also reviewed two "free infrastructure" pr...
Whether your IoT service is connecting cars, homes, appliances, wearable, cameras or other devices, one question hangs in the balance – how do you actually make money from this service? The ability to turn your IoT service into profit requires the ability to create a monetization strategy that is flexible, scalable and working for you in real-time. It must be a transparent, smoothly implemented strategy that all stakeholders – from customers to the board – will be able to understand and comprehe...
Businesses and business units of all sizes can benefit from cloud computing, but many don't want the cost, performance and security concerns of public cloud nor the complexity of building their own private clouds. Today, some cloud vendors are using artificial intelligence (AI) to simplify cloud deployment and management. In his session at 20th Cloud Expo, Ajay Gulati, Co-founder and CEO of ZeroStack, will discuss how AI can simplify cloud operations. He will cover the following topics: why clou...
"Dice has been around for the last 20 years. We have been helping tech professionals find new jobs and career opportunities," explained Manish Dixit, VP of Product and Engineering at Dice, in this SYS-CON.tv interview at 19th Cloud Expo, held November 1-3, 2016, at the Santa Clara Convention Center in Santa Clara, CA.
More and more brands have jumped on the IoT bandwagon. We have an excess of wearables – activity trackers, smartwatches, smart glasses and sneakers, and more that track seemingly endless datapoints. However, most consumers have no idea what “IoT” means. Creating more wearables that track data shouldn't be the aim of brands; delivering meaningful, tangible relevance to their users should be. We're in a period in which the IoT pendulum is still swinging. Initially, it swung toward "smart for smar...
The Internet of Things will challenge the status quo of how IT and development organizations operate. Or will it? Certainly the fog layer of IoT requires special insights about data ontology, security and transactional integrity. But the developmental challenges are the same: People, Process and Platform and how we integrate our thinking to solve complicated problems. In his session at 19th Cloud Expo, Craig Sproule, CEO of Metavine, demonstrated how to move beyond today's coding paradigm and sh...
In his keynote at 18th Cloud Expo, Andrew Keys, Co-Founder of ConsenSys Enterprise, provided an overview of the evolution of the Internet and the Database and the future of their combination – the Blockchain. Andrew Keys is Co-Founder of ConsenSys Enterprise. He comes to ConsenSys Enterprise with capital markets, technology and entrepreneurial experience. Previously, he worked for UBS investment bank in equities analysis. Later, he was responsible for the creation and distribution of life sett...
We are always online. We access our data, our finances, work, and various services on the Internet. But we live in a congested world of information in which the roads were built two decades ago. The quest for better, faster Internet routing has been around for a decade, but nobody solved this problem. We’ve seen band-aid approaches like CDNs that attack a niche's slice of static content part of the Internet, but that’s it. It does not address the dynamic services-based Internet of today. It does...
The WebRTC Summit New York, to be held June 6-8, 2017, at the Javits Center in New York City, NY, announces that its Call for Papers is now open. Topics include all aspects of improving IT delivery by eliminating waste through automated business models leveraging cloud technologies. WebRTC Summit is co-located with 20th International Cloud Expo and @ThingsExpo. WebRTC is the future of browser-to-browser communications, and continues to make inroads into the traditional, difficult, plug-in web ...
20th Cloud Expo, taking place June 6-8, 2017, at the Javits Center in New York City, NY, will feature technical sessions from a rock star conference faculty and the leading industry players in the world. Cloud computing is now being embraced by a majority of enterprises of all sizes. Yesterday's debate about public vs. private has transformed into the reality of hybrid cloud: a recent survey shows that 74% of enterprises have a hybrid cloud strategy.
WebRTC is the future of browser-to-browser communications, and continues to make inroads into the traditional, difficult, plug-in web communications world. The 6th WebRTC Summit continues our tradition of delivering the latest and greatest presentations within the world of WebRTC. Topics include voice calling, video chat, P2P file sharing, and use cases that have already leveraged the power and convenience of WebRTC.
"We're a cybersecurity firm that specializes in engineering security solutions both at the software and hardware level. Security cannot be an after-the-fact afterthought, which is what it's become," stated Richard Blech, Chief Executive Officer at Secure Channels, in this SYS-CON.tv interview at @ThingsExpo, held November 1-3, 2016, at the Santa Clara Convention Center in Santa Clara, CA.