Welcome!

Government Cloud Authors: Automic Blog, Elizabeth White, Pat Romanski, Liz McMillan, Gopala Krishna Behara

Related Topics: Cloud Security, Microservices Expo, Government Cloud

Cloud Security: Blog Feed Post

Cybersecurity: It’s More Than Worms, Hacking and Phishing

The reason cyber security is so vast is that it is a strategy for mitigating risk from breach of confidentiality

To put things into perspective, let’s analogize about some information technology related initiatives.  In the realm of things, accounting is like a lake, integration is like a bay and cyber security is like the Pacific Ocean.  The scope of understanding required to be a cyber security expert is so vast that it fills volumes just trying to define it, let alone protect it.

The reason cyber security is so vast is that it is a strategy for mitigating risk from breach of confidentiality, lack of integrity and lack of availability of information systems and networks.  Consider the number of threats that target these three things and then consider this number is only the known threats.  Also, know that new threats are being uncovered daily.  Moreover, threats are not all technological, some of them are socially engineered, which make them all that more difficult to defend against.

When I talk to individuals about their cyber security strategy, most times these days, the answer reflects a tactical requirement to understand the nature of the threat and take some action to institute some protection.  If these organizations continue to operate in this manner with the number of growing threats, they will soon be all consumed just trying to keep up let alone operate the networks and systems.  The sheer magnitude of threat management will in and of itself result the worst threat of all—denial of service.

In my recent talk at the Air Force IT Conference I discussed using a Security Incident and Event Management (SIEM) tool combined with a Governance, Risk & Compliance (GRC) tool to assist with automation of handling of cyber threats.  The SIEM does a great job of allowing real incidents to be recognized, which can then be driven to closure using the GRC.  In this case, closure does not simply mean handled, it means completely mitigated.

Another growing trend I see in cyber security is to allow threat management to be designed outside of the realm of enterprise architecture.  When this occurs, security is implemented in a silo manner usually related to the operational focus of the IT group implementing the security architecture and solution.  For example, the network group focuses on network security, while the application group focuses on access control and authorization.  While common, this is perhaps the greatest weakness in a cyber security strategy and can be easily exploited by an attacker.  The cyber security solution must be implemented in an integrated manner watching horizontally from network through application.

For certain, if someone wants to breach or limit access to your systems and data, they will find a way to so that is not being watched.  Which brings me to the next most important point about cyber security—you cannot watch everything all the time.  We’ve all seen the spy movies where they time the video camera movements so they can sneak into the building undetected.  Even with the best tools on the market today, you may only be made aware of a breach after it has occurred and once it has been correlated with other known events that highlight the likelihood of breach.  At this point, stopping the breach is but a bullet point on the post-mortem slide and all attention must now be focused on the impact of the breach.

So, let’s see what we’ve got so far:

  1. We don’t know what we don’t know
  2. We can’t watch everything at all times
  3. Many are simply trying to understand the nature of the threat
  4. Current security architectures are being implemented in silo manner

And, now the cherry on top, not everything that is a threat is intentional.  As if cyber security wasn’t complex enough, now we’re not just policing for cyber criminal activity, we’re fending off and responding to: uneducated users, careless utility and maintenance personnel, suppliers and vendors, and general defects.

As I like to say, resistance is futile, so instead, implement a strategy that keeps you out of the fray as much as possible.  Implement and ensure compliance with your security policies, educate your organization on things they can do to minimize the opportunity for a cyber security incident, catalog and value your assets, and implement tools in a concerted and integrated manner.  Moreover, make it a policy to revisit this lifecycle as least two times annually.

One point I’d like to expand upon from above is catalog and value your assets.  Most organizations I have worked with do not do this as a general activity.  Cyber security threat management is a risk management activity.  You value your assets and apply resources to protect from the most critical and high-valued ones to the least critical and lower-valued ones.  If you’re in the business of arbitrage, where seconds equate to big dollars, deploy most of your budget protecting the trading systems and networks.  If you’re in government, you’re going to make sure that the systems required to operate the government get the most resources applied first.  Knowing where to apply your resources is the most critical aspect of the mission.

To me, cyber/info security may resemble the epitome of architecture as it requires more depth and more breadth than any other branch of architecture.  Moreover, to do it right, requires the architect to have experience and understanding in multiple facets of IT architecture including network, storage, server, virtualization, application and data.  The unfortunate truth, however, is that a complete security architecture is still viewed as a "nice to have", not a "must have".  Most business and IT executives feel comfortable knowing that they have a deadbolt on the front and back door and the windows are locked.

Read the original blog entry...

More Stories By JP Morgenthal

JP Morgenthal is a veteran IT solutions executive and Distinguished Engineer with CSC. He has been delivering IT services to business leaders for the past 30 years and is a recognized thought-leader in applying emerging technology for business growth and innovation. JP's strengths center around transformation and modernization leveraging next generation platforms and technologies. He has held technical executive roles in multiple businesses including: CTO, Chief Architect and Founder/CEO. Areas of expertise for JP include strategy, architecture, application development, infrastructure and operations, cloud computing, DevOps, and integration. JP is a published author with four trade publications with his most recent being “Cloud Computing: Assessing the Risks”. JP holds both a Masters and Bachelors of Science in Computer Science from Hofstra University.

@ThingsExpo Stories
To get the most out of their data, successful companies are not focusing on queries and data lakes, they are actively integrating analytics into their operations with a data-first application development approach. Real-time adjustments to improve revenues, reduce costs, or mitigate risk rely on applications that minimize latency on a variety of data sources. In his session at @BigDataExpo, Jack Norris, Senior Vice President, Data and Applications at MapR Technologies, reviewed best practices to ...
In his Opening Keynote at 21st Cloud Expo, John Considine, General Manager of IBM Cloud Infrastructure, led attendees through the exciting evolution of the cloud. He looked at this major disruption from the perspective of technology, business models, and what this means for enterprises of all sizes. John Considine is General Manager of Cloud Infrastructure Services at IBM. In that role he is responsible for leading IBM’s public cloud infrastructure including strategy, development, and offering m...
"Digital transformation - what we knew about it in the past has been redefined. Automation is going to play such a huge role in that because the culture, the technology, and the business operations are being shifted now," stated Brian Boeggeman, VP of Alliances & Partnerships at Ayehu, in this SYS-CON.tv interview at 21st Cloud Expo, held Oct 31 – Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA.
Nordstrom is transforming the way that they do business and the cloud is the key to enabling speed and hyper personalized customer experiences. In his session at 21st Cloud Expo, Ken Schow, VP of Engineering at Nordstrom, discussed some of the key learnings and common pitfalls of large enterprises moving to the cloud. This includes strategies around choosing a cloud provider(s), architecture, and lessons learned. In addition, he covered some of the best practices for structured team migration an...
No hype cycles or predictions of a gazillion things here. IoT is here. You get it. You know your business and have great ideas for a business transformation strategy. What comes next? Time to make it happen. In his session at @ThingsExpo, Jay Mason, an Associate Partner of Analytics, IoT & Cybersecurity at M&S Consulting, presented a step-by-step plan to develop your technology implementation strategy. He also discussed the evaluation of communication standards and IoT messaging protocols, data...
Recently, REAN Cloud built a digital concierge for a North Carolina hospital that had observed that most patient call button questions were repetitive. In addition, the paper-based process used to measure patient health metrics was laborious, not in real-time and sometimes error-prone. In their session at 21st Cloud Expo, Sean Finnerty, Executive Director, Practice Lead, Health Care & Life Science at REAN Cloud, and Dr. S.P.T. Krishnan, Principal Architect at REAN Cloud, discussed how they built...
SYS-CON Events announced today that Evatronix will exhibit at SYS-CON's 21st International Cloud Expo®, which will take place on Oct 31 – Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA. Evatronix SA offers comprehensive solutions in the design and implementation of electronic systems, in CAD / CAM deployment, and also is a designer and manufacturer of advanced 3D scanners for professional applications.
SYS-CON Events announced today that Synametrics Technologies will exhibit at SYS-CON's 22nd International Cloud Expo®, which will take place on June 5-7, 2018, at the Javits Center in New York, NY. Synametrics Technologies is a privately held company based in Plainsboro, New Jersey that has been providing solutions for the developer community since 1997. Based on the success of its initial product offerings such as WinSQL, Xeams, SynaMan and Syncrify, Synametrics continues to create and hone inn...
"Evatronix provides design services to companies that need to integrate the IoT technology in their products but they don't necessarily have the expertise, knowledge and design team to do so," explained Adam Morawiec, VP of Business Development at Evatronix, in this SYS-CON.tv interview at @ThingsExpo, held Oct 31 – Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA.
With tough new regulations coming to Europe on data privacy in May 2018, Calligo will explain why in reality the effect is global and transforms how you consider critical data. EU GDPR fundamentally rewrites the rules for cloud, Big Data and IoT. In his session at 21st Cloud Expo, Adam Ryan, Vice President and General Manager EMEA at Calligo, examined the regulations and provided insight on how it affects technology, challenges the established rules and will usher in new levels of diligence arou...
Smart cities have the potential to change our lives at so many levels for citizens: less pollution, reduced parking obstacles, better health, education and more energy savings. Real-time data streaming and the Internet of Things (IoT) possess the power to turn this vision into a reality. However, most organizations today are building their data infrastructure to focus solely on addressing immediate business needs vs. a platform capable of quickly adapting emerging technologies to address future ...
In his session at 21st Cloud Expo, Raju Shreewastava, founder of Big Data Trunk, provided a fun and simple way to introduce Machine Leaning to anyone and everyone. He solved a machine learning problem and demonstrated an easy way to be able to do machine learning without even coding. Raju Shreewastava is the founder of Big Data Trunk (www.BigDataTrunk.com), a Big Data Training and consulting firm with offices in the United States. He previously led the data warehouse/business intelligence and B...
The 22nd International Cloud Expo | 1st DXWorld Expo has announced that its Call for Papers is open. Cloud Expo | DXWorld Expo, to be held June 5-7, 2018, at the Javits Center in New York, NY, brings together Cloud Computing, Digital Transformation, Big Data, Internet of Things, DevOps, Machine Learning and WebRTC to one location. With cloud computing driving a higher percentage of enterprise IT budgets every year, it becomes increasingly important to plant your flag in this fast-expanding busin...
22nd International Cloud Expo, taking place June 5-7, 2018, at the Javits Center in New York City, NY, and co-located with the 1st DXWorld Expo will feature technical sessions from a rock star conference faculty and the leading industry players in the world. Cloud computing is now being embraced by a majority of enterprises of all sizes. Yesterday's debate about public vs. private has transformed into the reality of hybrid cloud: a recent survey shows that 74% of enterprises have a hybrid cloud ...
22nd International Cloud Expo, taking place June 5-7, 2018, at the Javits Center in New York City, NY, and co-located with the 1st DXWorld Expo will feature technical sessions from a rock star conference faculty and the leading industry players in the world. Cloud computing is now being embraced by a majority of enterprises of all sizes. Yesterday's debate about public vs. private has transformed into the reality of hybrid cloud: a recent survey shows that 74% of enterprises have a hybrid cloud ...
DevOps at Cloud Expo – being held June 5-7, 2018, at the Javits Center in New York, NY – announces that its Call for Papers is open. Born out of proven success in agile development, cloud computing, and process automation, DevOps is a macro trend you cannot afford to miss. From showcase success stories from early adopters and web-scale businesses, DevOps is expanding to organizations of all sizes, including the world's largest enterprises – and delivering real results. Among the proven benefits,...
@DevOpsSummit at Cloud Expo, taking place June 5-7, 2018, at the Javits Center in New York City, NY, is co-located with 22nd Cloud Expo | 1st DXWorld Expo and will feature technical sessions from a rock star conference faculty and the leading industry players in the world. The widespread success of cloud computing is driving the DevOps revolution in enterprise IT. Now as never before, development teams must communicate and collaborate in a dynamic, 24/7/365 environment. There is no time to wait...
Cloud Expo | DXWorld Expo have announced the conference tracks for Cloud Expo 2018. Cloud Expo will be held June 5-7, 2018, at the Javits Center in New York City, and November 6-8, 2018, at the Santa Clara Convention Center, Santa Clara, CA. Digital Transformation (DX) is a major focus with the introduction of DX Expo within the program. Successful transformation requires a laser focus on being data-driven and on using all the tools available that enable transformation if they plan to survive ov...
SYS-CON Events announced today that T-Mobile exhibited at SYS-CON's 20th International Cloud Expo®, which will take place on June 6-8, 2017, at the Javits Center in New York City, NY. As America's Un-carrier, T-Mobile US, Inc., is redefining the way consumers and businesses buy wireless services through leading product and service innovation. The Company's advanced nationwide 4G LTE network delivers outstanding wireless experiences to 67.4 million customers who are unwilling to compromise on qua...
SYS-CON Events announced today that Cedexis will exhibit at SYS-CON's 21st International Cloud Expo®, which will take place on Oct 31 - Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA. Cedexis is the leader in data-driven enterprise global traffic management. Whether optimizing traffic through datacenters, clouds, CDNs, or any combination, Cedexis solutions drive quality and cost-effectiveness. For more information, please visit https://www.cedexis.com.