Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Cloud

5/25/2017
03:00 PM
Mike Convertino
Mike Convertino
Commentary
Connect Directly
LinkedIn
RSS
E-Mail vvv
100%
0%

In the Cloud, Evolving Infrastructure Means Evolving Alliances

New opportunities make for unusual bedfellows. Here's how to navigate the shift in organizational dynamics between security operations, line-of-business managers, and developers.

In the olden days of cybersecurity (you know, before 2015 or so), a company's legal and security departments tended to move in lock step. Better security went hand-in-hand with better compliance, which to a company’s legal team equated to lower risk.

Conversely, the relationship between security operations and line-of-business managers and developers was tenuous. Security was constantly shutting down or hindering efforts to move to the online services the business wanted, and developers couldn’t be trusted to write secure on-prem apps, let alone spin up data instances in the cloud.

But today? The alliances of old are strained, and the new opportunities in the cloud and in containers are making for some unusual bedfellows.

Many times the CISO is better off in the cloud. Maybe some of your on-premises systems are getting long in the tooth, or certain capabilities in the cloud are just better. These days platforms like Office 365 will develop for the cloud first, and then move new features to the datacenter.

Suddenly, you have logs you never had before. You can make policies and deploy them without re-provisioning. Instead of closing a port on a firewall on prem, you can go directly to an actual individual file — not just a port or a router. 

You can see an anomaly and automate the specific response. You can say, "Jimmy can't write .ppts or .pdfs anymore, because it looks like he's trying to export," but he can still do his day-to-day business while you investigate. And the whole time, you can see all the transactions happening where you can't on your on-prem file server.

In the cloud, the CIO is elated because he gets to make customers happy, and the developers are happy, too, because they get to make more apps, more quickly.

And instead of putting in a whopping capital expense request every five years to update systems, you've got a predictable and recurring opex line, which means instead of rolling his eyes, your CFO can plan for your needs. (I mean … maybe he still rolls his eyes, but probably not as much.)

But what about the security team's old friend Legal? Surely they'll be excited that we're offloading risk and updating compliance (based on the cloud vendor's robust certification library), right?

Well, instead of being a security issue or a technology issue, legal approval often amounts to a matter of contracts and customer data. You may be restricted from moving it to the cloud, or at least unable to do so without approval, especially for customers in highly regulated industries.

This is where it becomes crucial to understand the security position of on-premises systems compared to the cloud. Most frequently, the cloud provider is going to be certified and audited to an extent the organization just can’t match.

The CISO's ability to articulate that value and sell it in to the general counsel is critical. More advanced legal departments will realize the reduction in risk because providers are certified in so many ways. But if your counsel is more conservative, it may be a tough argument no matter how articulate you are.

So you lost legal.

But now you have the COO, the CIO, and the CFO on board because you've created a predictable operations expense out of a formerly unpredictable cap-ex hit and reduced headcount requirements both in IT and information security. Business group owners are pleased because of the rich SaaS offerings now available to them. And the company is innovating in the cloud at a rate they never could on premises.

In the end, the benefits of moving to the cloud for many situations are just too great to ignore. Better security, more information, predictable costs, and other factors tend to make the argument for themselves.

But it's also important to understand the corresponding shift in organizational dynamics. Getting everyone on the same page can help smooth the transition and lead to a healthier organization overall.  

Related Content:

 



Mike Convertino is the chief security officer at Arceo.ai, a leading data analytics company using AI to dynamically assess risk for the cyber insurance industry. He is an experienced executive, leading both information security and product development at multiple leading ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 5/22/2020
How an Industry Consortium Can Reinvent Security Solution Testing
Henry Harrison, Co-founder & Chief Technology Officer, Garrison,  5/21/2020
Is Zero Trust the Best Answer to the COVID-19 Lockdown?
Dan Blum, Cybersecurity & Risk Management Strategist,  5/20/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
How Cybersecurity Incident Response Programs Work (and Why Some Don't)
This Tech Digest takes a look at the vital role cybersecurity incident response (IR) plays in managing cyber-risk within organizations. Download the Tech Digest today to find out how well-planned IR programs can detect intrusions, contain breaches, and help an organization restore normal operations.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-13485
PUBLISHED: 2020-05-25
The Knock Knock plugin before 1.2.8 for Craft CMS allows IP Whitelist bypass via an X-Forwarded-For HTTP header.
CVE-2020-13486
PUBLISHED: 2020-05-25
The Knock Knock plugin before 1.2.8 for Craft CMS allows malicious redirection.
CVE-2020-13482
PUBLISHED: 2020-05-25
EM-HTTP-Request 1.1.5 uses the library eventmachine in an insecure way that allows an attacker to perform a man-in-the-middle attack against users of the library. The hostname in a TLS server certificate is not verified.
CVE-2020-13458
PUBLISHED: 2020-05-25
An issue was discovered in the Image Resizer plugin before 2.0.9 for Craft CMS. There are CSRF issues with the log-clear controller action.
CVE-2020-13459
PUBLISHED: 2020-05-25
An issue was discovered in the Image Resizer plugin before 2.0.9 for Craft CMS. There is stored XSS in the Bulk Resize action.