Click here to close now.

Welcome!

Security Authors: Elizabeth White, Pat Romanski, Esmeralda Swartz, Peter Silva, Adam Vincent

Related Topics: Cloud Expo, MICROSERVICES, Virtualization, Security, Big Data Journal, SDN Journal

Cloud Expo: Article

2014 Trends – The Year of the Insider Threat

As more and more organizations are adopting cloud strategies, there is now an added layer of complexity and sophistication

If last year underscored anything, it was the significant and far-reaching impact of breaches by trusted insiders - case in point, the Edward Snowden affair. What makes this such a critical trend for 2014 is the fact that as more and more organizations are adopting cloud strategies, there is now an added layer of complexity and sophistication when it comes to protecting who can access what types of sensitive data. The cloud makes it easier for organizations to conduct business, but that simplicity also translates into easier ways for insiders or un-trusted individuals to steal data - identity has become the new perimeter.

The number of organizations around the globe turning to a combination of traditional computing, virtualization, and public-cloud infrastructure to deliver business applications quickly, efficiently, and cost effectively is growing exponentially. As they migrate systems to the cloud, or leverage the scalability and elasticity of cloud computing to deliver entirely new applications, they can run headlong into security and compliance issues that must be solved to protect systems and make auditors happy. In addition to protecting privileged access to servers and network gear, virtualization and cloud computing add important new items that need to be locked down. First, organizations need to protect virtualization and cloud management consoles that provide unprecedented administrative power to create, configure, delete and copy network and server resources. Second, organizations must ensure the cloud management application programming interfaces (APIs) that transfer enormous administrative power to scripts, programs and DevOps tools are adequately controlled. Companies that want to ensure their data remains safe regardless of whether it is in a traditional database, in the cloud, or some variation of both, now need to seriously consider the security ramifications of having a lax privileged user policy - especially in an era where a few clicks of the mouse in the console, or a few commands in a script can wreak havoc.

The Snowden breach is a perfect example of the ramifications organizations typically overlook when they consider the negatives of a breach. According to different reports, the NSA has spent millions of dollars replacing software and hardware systems to mitigate the risk of undetected compromises on resources to which Snowden had access. These sorts of costs - forensic analysis, re-imaging, and repairing or replacing compromised systems - are frequently overlooked when assessing the potential value of privileged identity management programs. Harder to measure are the impacts arising from the disclosure or theft of sensitive and confidential information. Not to mention the potential for embarrassment and loss of trust from essential stakeholders including partners, customers, and others.

Another factor we see catapulting privileged users and insider threats as a key trend in 2014 is the increased attention toward regulations and compliance. Regulators are extending security and privacy mandates to cover the risks posed by privileged users and administrative accounts. High-profile insider breaches (e.g., Snowden, Wikileaks), plus increasingly advanced spearfishing and APT-based attacks, have heightened regulator and auditor attention to privileged user threats. And there are specific regulations that apply to specific industries. Some of the regulations include penalties for non-compliance, and many of these mandates continue to be updated to contend with the latest threats. A good number of them have been updated with specific requirements relevant to privileged identity management.

Privileged identity management protects organizations from the risks privileged users pose to systems and data. Privileged users - people like systems administrators, contractors, and third-party vendors - have routine access to the most sensitive IT resources. It's no wonder studies consistently show the largest and most damaging breaches are often traced to these individuals. Privileged identity management software supports and enforces the policies and controls needed to mitigate risks created by privileged users, those with elevated rights and access to administrative accounts, credentials, and systems.

Privileged identity management isn't just about privileged identities, though being able to positively identify powerful users and vault and manage their passwords is a key part of the equation. Next generation privileged identity management platforms also control, monitor and audit privileged users, ensuring they can access only explicitly authorized resources. Comprehensive privileged identity management tools also record privileged sessions so you know exactly what happens during each session - and you can prove it to your auditor. These tools also enable you to lock down virtual and cloud "super-user" administrative consoles, such as VMware's vCenter Server and the Amazon Web Services Management Console.

The fallout of the NSA/Snowden leak and other "insider threat" and "privileged user" incidents has significantly broadened interest in privileged identity management tools, and we expect that to only increase as cloud and virtual technologies continue to evolve. Inbound inquires to Xceedium, and likely other PIM vendors, have increased beyond the usual suspects, such as the traditional security leaders in banking and financial services or organizations with critical infrastructure and those other markets governed by strict security regulations. We're now seeing a big increase in interest across numerous industries and geographic regions.

As insider threats continue to shine a light on the need for next generation privileged identity management solutions, the important thing to remember is to focus on solutions that go beyond simple password management. The ability to attribute actions taken to specific individuals, as well as real-time logging and session recording, make it easier to proactively alert security teams to issues and conduct forensic analysis. If questions arise about an individual's activities, it's a straightforward task to determine exactly what they did and when. Cloud computing introduces important new administrative systems that need to be controlled and monitored. While security breaches are bound to happen, a modern privileged identity management system can make sure you are in a position to appropriately investigate what happened and keep the fallout to a minimum.

More Stories By Dale R. Gardner

Dale R. Gardner is Director of Product Marketing at Xceedium. He's developed and launched multiple network, systems, and security management products for the enterprise market. A former META Group analyst, he started his career as a programmer and networking specialist.

Comments (0)

Share your thoughts on this story.

Add your comment
You must be signed in to add a comment. Sign-in | Register

In accordance with our Comment Policy, we encourage comments that are on topic, relevant and to-the-point. We will remove comments that include profanity, personal attacks, racial slurs, threats of violence, or other inappropriate material that violates our Terms and Conditions, and will block users who make repeated violations. We ask all readers to expect diversity of opinion and to treat one another with dignity and respect.


@ThingsExpo Stories
SYS-CON Media announced today that @WebRTCSummit Blog, the largest WebRTC resource in the world, has been launched. @WebRTCSummit Blog offers top articles, news stories, and blog posts from the world's well-known experts and guarantees better exposure for its authors than any other publication. @WebRTCSummit Blog can be bookmarked ▸ Here @WebRTCSummit conference site can be bookmarked ▸ Here
SYS-CON Events announced today that Cisco, the worldwide leader in IT that transforms how people connect, communicate and collaborate, has been named “Gold Sponsor” of SYS-CON's 16th International Cloud Expo®, which will take place on June 9-11, 2015, at the Javits Center in New York City, NY. Cisco makes amazing things happen by connecting the unconnected. Cisco has shaped the future of the Internet by becoming the worldwide leader in transforming how people connect, communicate and collaborate. Cisco and our partners are building the platform for the Internet of Everything by connecting the...
Temasys has announced senior management additions to its team. Joining are David Holloway as Vice President of Commercial and Nadine Yap as Vice President of Product. Over the past 12 months Temasys has doubled in size as it adds new customers and expands the development of its Skylink platform. Skylink leads the charge to move WebRTC, traditionally seen as a desktop, browser based technology, to become a ubiquitous web communications technology on web and mobile, as well as Internet of Things compatible devices.
SYS-CON Events announced today that robomq.io will exhibit at SYS-CON's @ThingsExpo, which will take place on June 9-11, 2015, at the Javits Center in New York City, NY. robomq.io is an interoperable and composable platform that connects any device to any application. It helps systems integrators and the solution providers build new and innovative products and service for industries requiring monitoring or intelligence from devices and sensors.
Wearable technology was dominant at this year’s International Consumer Electronics Show (CES) , and MWC was no exception to this trend. New versions of favorites, such as the Samsung Gear (three new products were released: the Gear 2, the Gear 2 Neo and the Gear Fit), shared the limelight with new wearables like Pebble Time Steel (the new premium version of the company’s previously released smartwatch) and the LG Watch Urbane. The most dramatic difference at MWC was an emphasis on presenting wearables as fashion accessories and moving away from the original clunky technology associated with t...
Docker is an excellent platform for organizations interested in running microservices. It offers portability and consistency between development and production environments, quick provisioning times, and a simple way to isolate services. In his session at DevOps Summit at 16th Cloud Expo, Shannon Williams, co-founder of Rancher Labs, will walk through these and other benefits of using Docker to run microservices, and provide an overview of RancherOS, a minimalist distribution of Linux designed expressly to run Docker. He will also discuss Rancher, an orchestration and service discovery platf...
SYS-CON Events announced today that Akana, formerly SOA Software, has been named “Bronze Sponsor” of SYS-CON's 16th International Cloud Expo® New York, which will take place June 9-11, 2015, at the Javits Center in New York City, NY. Akana’s comprehensive suite of API Management, API Security, Integrated SOA Governance, and Cloud Integration solutions helps businesses accelerate digital transformation by securely extending their reach across multiple channels – mobile, cloud and Internet of Things. Akana enables enterprises to share data as APIs, connect and integrate applications, drive part...
SYS-CON Events announced today that Vitria Technology, Inc. will exhibit at SYS-CON’s @ThingsExpo, which will take place on June 9-11, 2015, at the Javits Center in New York City, NY. Vitria will showcase the company’s new IoT Analytics Platform through live demonstrations at booth #330. Vitria’s IoT Analytics Platform, fully integrated and powered by an operational intelligence engine, enables customers to rapidly build and operationalize advanced analytics to deliver timely business outcomes for use cases across the industrial, enterprise, and consumer segments.
SYS-CON Events announced today that Solgenia will exhibit at SYS-CON's 16th International Cloud Expo®, which will take place on June 9-11, 2015, at the Javits Center in New York City, NY, and the 17th International Cloud Expo®, which will take place on November 3–5, 2015, at the Santa Clara Convention Center in Santa Clara, CA. Solgenia is the global market leader in Cloud Collaboration and Cloud Infrastructure software solutions. Designed to “Bridge the Gap” between Personal and Professional Social, Mobile and Cloud user experiences, our solutions help large and medium-sized organizations dr...
SYS-CON Events announced today that Liaison Technologies, a leading provider of data management and integration cloud services and solutions, has been named "Silver Sponsor" of SYS-CON's 16th International Cloud Expo®, which will take place on June 9-11, 2015, at the Javits Center in New York, NY. Liaison Technologies is a recognized market leader in providing cloud-enabled data integration and data management solutions to break down complex information barriers, enabling enterprises to make smarter decisions, faster.
Cloud is not a commodity. And no matter what you call it, computing doesn’t come out of the sky. It comes from physical hardware inside brick and mortar facilities connected by hundreds of miles of networking cable. And no two clouds are built the same way. SoftLayer gives you the highest performing cloud infrastructure available. One platform that takes data centers around the world that are full of the widest range of cloud computing options, and then integrates and automates everything. Join SoftLayer on June 9 at 16th Cloud Expo to learn about IBM Cloud's SoftLayer platform, explore se...
The WebRTC Summit 2014 New York, to be held June 9-11, 2015, at the Javits Center in New York, NY, announces that its Call for Papers is open. Topics include all aspects of improving IT delivery by eliminating waste through automated business models leveraging cloud technologies. WebRTC Summit is co-located with 16th International Cloud Expo, @ThingsExpo, Big Data Expo, and DevOps Summit.
@ThingsExpo has been named the Top 5 Most Influential M2M Brand by Onalytica in the ‘Machine to Machine: Top 100 Influencers and Brands.' Onalytica analyzed the online debate on M2M by looking at over 85,000 tweets to provide the most influential individuals and brands that drive the discussion. According to Onalytica the "analysis showed a very engaged community with a lot of interactive tweets. The M2M discussion seems to be more fragmented and driven by some of the major brands present in the M2M space. This really allows some room for influential individuals to create more high value inter...
The world's leading Cloud event, Cloud Expo has launched Microservices Journal on the SYS-CON.com portal, featuring over 19,000 original articles, news stories, features, and blog entries. DevOps Journal is focused on this critical enterprise IT topic in the world of cloud computing. Microservices Journal offers top articles, news stories, and blog posts from the world's well-known experts and guarantees better exposure for its authors than any other publication. Follow new article posts on Twitter at @MicroservicesE
SYS-CON Events announced today the IoT Bootcamp – Jumpstart Your IoT Strategy, being held June 9–10, 2015, in conjunction with 16th Cloud Expo and Internet of @ThingsExpo at the Javits Center in New York City. This is your chance to jumpstart your IoT strategy. Combined with real-world scenarios and use cases, the IoT Bootcamp is not just based on presentations but includes hands-on demos and walkthroughs. We will introduce you to a variety of Do-It-Yourself IoT platforms including Arduino, Raspberry Pi, BeagleBone, Spark and Intel Edison. You will also get an overview of cloud technologies s...
SYS-CON Events announced today that SafeLogic has been named “Bag Sponsor” of SYS-CON's 16th International Cloud Expo® New York, which will take place June 9-11, 2015, at the Javits Center in New York City, NY. SafeLogic provides security products for applications in mobile and server/appliance environments. SafeLogic’s flagship product CryptoComply is a FIPS 140-2 validated cryptographic engine designed to secure data on servers, workstations, appliances, mobile devices, and in the Cloud.
Containers and microservices have become topics of intense interest throughout the cloud developer and enterprise IT communities. Accordingly, attendees at the upcoming 16th Cloud Expo at the Javits Center in New York June 9-11 will find fresh new content in a new track called PaaS | Containers & Microservices Containers are not being considered for the first time by the cloud community, but a current era of re-consideration has pushed them to the top of the cloud agenda. With the launch of Docker's initial release in March of 2013, interest was revved up several notches. Then late last...
SOA Software has changed its name to Akana. With roots in Web Services and SOA Governance, Akana has established itself as a leader in API Management and is expanding into cloud integration as an alternative to the traditional heavyweight enterprise service bus (ESB). The company recently announced that it achieved more than 90% year-over-year growth. As Akana, the company now addresses the evolution and diversification of SOA, unifying security, management, and DevOps across SOA, APIs, microservices, and more.
After making a doctor’s appointment via your mobile device, you receive a calendar invite. The day of your appointment, you get a reminder with the doctor’s location and contact information. As you enter the doctor’s exam room, the medical team is equipped with the latest tablet containing your medical history – he or she makes real time updates to your medical file. At the end of your visit, you receive an electronic prescription to your preferred pharmacy and can schedule your next appointment.
GENBAND has announced that SageNet is leveraging the Nuvia platform to deliver Unified Communications as a Service (UCaaS) to its large base of retail and enterprise customers. Nuvia’s cloud-based solution provides SageNet’s customers with a full suite of business communications and collaboration tools. Two large national SageNet retail customers have recently signed up to deploy the Nuvia platform and the company will continue to sell the service to new and existing customers. Nuvia’s capabilities include HD voice, video, multimedia messaging, mobility, conferencing, Web collaboration, deskt...