Category Archives: Cloud Adoption

Overcoming the Cloud Security Compliance Conundrum

The growing demand for increased business agility and cost reductions in relation to IT infrastructure and applications is not a new agenda item for C-level executives. It has, however, remained a priority topic in 2018.

Compliance with various regulations and cloud security requirements has expanded as technology and cloud uptake advance — albeit not at a similar pace, leaving organizations with a challenging conundrum to solve. This is particularly relevant when executives consider cloud security and business transformations.

Balance the Costs and Benefits of Cloud Migration

The partnership between IBM and Red Hat announced earlier this year highlights a strategic vision to deliver transformational change to clients and meet cloud security demand. We’ve also seen record-breaking technological advancements and a growing number of data and application migrations to the cloud.

In general, these migrations follow either a hybrid or multicloud strategy. Hybrid cloud is defined as a combination of cloud services that are deployed both on-premises and in the cloud. Multicloud means using multiple cloud computing service providers across a single heterogeneous environment for applications, software or infrastructure.

Whatever the strategy, cloud migrations involve transitioning and managing extensive processing and workloads outside of traditional IT infrastructure while addressing cloud security and compliance challenges. The main industries that are seeing an increased focus, volume and complexity of regulations are banking and financial services. In these sectors, many are pursuing innovative business strategies that drive requirements for critical infrastructure and applications to the cloud.

The regulatory compliance challenge for such innovation poses both an opportunity and a concern for the C-suite and boardroom. Financial institutions must confront the reality of dramatically increasing costs while also keeping pace with the legislative and regulatory changes arising from numerous regulatory bodies. Global organizations have the added burden of even more international and nation-specific regulations.

The cost of compliance is often high, but any effort to reduce staff without demonstrable and measurable improvements in compliance processes and technology could be viewed negatively by regulatory bodies, investors and shareholders.

Meet Cloud Security Compliance Requirements Head-On

One of the most common misconceptions we hear from clients is that moving to the cloud with data held by multiple third parties on shared systems will be a complex undertaking. Our view is that cloud services can be extremely secure and often a more stable option than utilizing existing internal IT infrastructure. However, there are a some activities that need to be considered to meet regulatory compliance requirements, such as:

  • Deploying continuous monitoring of both technical and nontechnical cloud compliance requirements. This should also include corporate governance, cybersecurity and regulatory compliance controls;
  • Maintaining a unified source or framework of governance, risk and compliance information for how cloud services are utilized;
  • Developing executive and operational dashboards to provide visibility into cloud compliance statuses;
  • Implementing real-time alerting mechanisms for control failures with defined playbooks on how to respond to compliance failures from third-party providers; and
  • Ensuring that you can continuously synchronize new cloud services and capabilities with regulatory compliance requirements.

These cloud security to-dos can help your organization take on the seemingly daunting task of cloud migration while remaining secure and compliant.

The post Overcoming the Cloud Security Compliance Conundrum appeared first on Security Intelligence.

Continuous Compliance Eases Cloud Adoption for Financial Services Firms

Last month, I spoke during the Innovation Showcase at the Financial Services Information Sharing and Analysis Center (FS-ISAC) Fall Summit. The goal was to update this group of high-level security professionals on a continuous compliance managed services solution that helps solve the cloud compliance dilemma — and on the solution’s first successful implementation. In a consortium of more than 30 financial services firms building an industry-standard cloud control framework, almost all reported regulatory compliance as a major hurdle to cloud adoption.

Overcome the Challenges of Cloud Compliance

Financial institutions are eager to use the hybrid cloud as a productive workplace to achieve strategic goals. But as reported in our white paper, “Turning Regulatory Challenges of the Cloud Into Competitive Advantage,” firms must overcome three major cloud adoption challenges.

First, companies face different regulatory obligations in various geographies. Multinational organizations must map regulatory obligations to 26 different countries and jurisdictions as far-flung as Singapore, London and New York.

Second, cloud service providers (CSPs) often provide different levels of control in the cloud than in the data center. That leaves financial services firms to build the right controls to address how they store and use data and who can access it — wherever it is. Regulators express concern over the amount of sensitive information CSPs maintain, often without being subject to the stringent regulations that govern banks, according to Business Insider.

Third, financial services firms and CSPs need a common security framework. A major accomplishment was reaching a consensus among the consortium members on the Cloud Security Alliance (CSA) open source framework. Modifications make it possible to build a single framework that is fully integrated with risk management and cybersecurity controls.

Lay the Groundwork for Continuous Compliance

Our managed services solution helps answer these challenges with continuous compliance to meet requirements for workloads running on public clouds — not only for regulations impacting the cloud, but for the General Data Protection Regulation (GDPR), Financial Industry Regulatory Authority (FINRA), U.S. Securities and Exchange Commission (SEC) and other regulatory bodies. The solution was developed in three stages.

1. Build a Regulatory Database for All Geographies

A continuous compliance database maps to every regulatory authority around the world. The database also defines GDPR and other cybersecurity obligations. The service monitors changes and makes timely updates to an industry-standard cloud control framework and regulatory database.

2. Map All of the Regulations and Controls to Each CSP

Mapping to CSPs is critical to achieve a standard level of control and to meet or exceed controls financial services firms might use within their own firewalls. Our solution maps a standard set of controls to every CSP, whether it’s Amazon, Google, Microsoft or IBM.

3. Adapt the Solution to the Individual Financial Services Firm

Each financial services firm already maintains in-house controls. The managed services solution requires an adapter to map the standardized framework to the existing framework for each firm’s individual policies, standards and procedures.

Continuous Compliance in Action

One of the largest investment firms in the world recently implemented the continuous compliance managed services solution with impressive success. A team of back-office personnel previously spent each day combing the internet for new and changing legislation and determining the impacts on current controls. The employees made updates manually.

The work was painstaking, tedious, and labor- and time-intensive, but these compliance employees formed the firm’s frontline defense against regulatory risk. Our managed services solution will help enable the firm to reduce its staff while saving substantially on compliance and reducing the risk of regulatory fines and reputational damage.

Automate Compliance With Cognitive Computing

Compliance is not a one-time event, but rather an ongoing process of monitoring and maintaining. Automation and cognitive computing — including artificial intelligence (AI) and machine learning — are the engines behind better, more efficient cloud governance.

In the future, the continuous compliance service will use Watson for RegTech. Watson will initially ingest existing regulations. Then, Watson will not only identify changes and update regulations, but also revise the controls that correspond with each regulation. Once Watson is fully trained, the time to add a new regulation or update an existing one will shrink exponentially.

Transfer to Other Obligations, Technologies and Domains

Financial services firms ultimately need to be in complete, real-time alignment with their regulatory obligations worldwide. Firms can access the industry-standard database to consume and adapt to updates for policies, requirements and controls while still maintaining their own firm-specific controls and processes. Our managed services solution mainly covers financial services regulations for cloud computing. Going forward, look for the scope to extend to regulations covering myriad technologies and domains to help financial institutions of all stripes overcome their greater cloud adoption challenges.

Read the white paper: Turning the regulatory challenges of cloud into competitive advantage

The post Continuous Compliance Eases Cloud Adoption for Financial Services Firms appeared first on Security Intelligence.

Will sophisticated attacks dominate in 2019?

Trend Micro released its 2019 predictions report, warning that attackers will increase the effectiveness of proven attack methods by adding more sophisticated elements to take advantage of the changing technology landscape. “As we head into 2019, organizations must understand the security implications of greater cloud adoption, converging IT and OT, and increasing remote working,” said Greg Young, vice president of cybersecurity for Trend Micro. “Cybercriminals will continue to follow a winning formula – exploiting existing … More

The post Will sophisticated attacks dominate in 2019? appeared first on Help Net Security.

Enabling the digital future: speed, agility and resilience

As more organizations embrace digital business, infrastructure and operations (I&O) leaders will need to evolve their strategies and skills to provide an agile infrastructure for their business. In fact, Gartner said that 75 percent of I&O leaders are not prepared with the skills, behaviors or cultural presence needed over the next two to three years. These leaders will need to embrace emerging trends in edge computing, artificial intelligence (AI) and the ever-changing cloud marketplace, which … More

The post Enabling the digital future: speed, agility and resilience appeared first on Help Net Security.

What cloud platforms are DevOps professionals being asked to understand?

Cloud Academy released its November 2018 Data Report revealing trends and shifts in the cloud computing industry. The world is trending multi-cloud Multi-cloud has become reality and Cloud Academy’s analysis of job postings reveals that DevOps engineers are now expected to have concurrent proficiency in Amazon Web Services (AWS) and Microsoft Azure, with 70 percent of job postings mentioning Azure also mentioning AWS. Google places a distant third in the public cloud supremacy battle Job … More

The post What cloud platforms are DevOps professionals being asked to understand? appeared first on Help Net Security.

Cloud interoperability and app mobility outrank cost and security for primary hybrid cloud benefits

Enterprises plan to increase hybrid cloud usage, with 91% stating hybrid cloud as the ideal IT model, but only 18% stating they have that model today, according to Nutanix. Application mobility across any cloud is a top priority for 97% of respondents – with 88% of respondents saying it would “solve a lot of my problems.” IT decision makers ranked matching applications to the right cloud environment as a critical capability, and 35% of organizations … More

The post Cloud interoperability and app mobility outrank cost and security for primary hybrid cloud benefits appeared first on Help Net Security.

Enterprises Using IaaS or PaaS Have 14 Misconfigured Instances on Average, Cloud Adoption Study Finds

Enterprises using infrastructure-as-a-service (IaaS) or platform-as-a-service (PaaS) solutions have 14 misconfigured instances on average running at a given time.

A recent cloud adoption study by McAfee found that organizations have increased their usage of the cloud over time. The average number of cloud services in use per company grew from 1,682 in 2017 to 1,935 a year later. This growth was evident in both the number of enterprise cloud apps and consumer cloud apps.

But while organizations are increasingly turning to the cloud to satisfy their business needs, they aren’t taking the necessary steps to safeguard their cloud-based assets, the researchers observed. According to the report, some of the most common oversights involved inactive data encryption and unrestricted outbound access.

How Do Cloud Misconfigurations Put Data at Risk?

Cloud misconfigurations directly jeopardize organizations’ data. McAfee customers who turn on data loss prevention (DLP) discovered an average of 1,527 DLP incidents in their IaaS or PaaS storage per month. Overall, 27 percent of organizations using PaaS experienced a data theft incident affecting their cloud infrastructure.

Part of the problem is that no two cloud service providers (CSPs) offer the same security controls. Some CSPs even lack some of the most basic security measures. Just 8 percent of providers encrypted stored data at rest, for instance, while only 19.2 percent supported multifactor authentication (MFA).

How to Cope With Increasing Cloud Adoption

Security professionals can help their organizations stay protected amid increasing cloud adoption by embedding corporate security policies into contracts with CSPs. They should also consider conducting regular penetration tests to map their environments for vulnerabilities.

Sources: McAfee

The post Enterprises Using IaaS or PaaS Have 14 Misconfigured Instances on Average, Cloud Adoption Study Finds appeared first on Security Intelligence.