devopsy.kinsta.cloud

Category: IT Security

  • A Security Vulnerability Management Guide

    A Security Vulnerability Management Guide

    Living in a container-native world is not easy. Containers have a reputation for being a point of entry for security vulnerabilities for many organizations. In 2015, according to a research paper, over 40% of Docker images distributed through Docker Hub had high-risk vulnerabilities; at that time there were more than 95,000 container images hosted on Docker Hub. Today, there are over 3.5 million container images on Docker, and container security is of even greater concern. In a more recent 2020 study by a team of researchers at the Norwegian University of Science and Technology found container image vulnerabilities in certified and popular packages.

    This is just one example of one kind of security vulnerability. This article will share an introduction to security vulnerabilities and the role of vulnerability management for containers and other artifacts in a continuous integration and continuous delivery (CI/CD) pipeline.

    What is a Security Vulnerability?

    A vulnerability is a weakness or flaw present in software. Security vulnerabilities can be present in application dependencies or operating system (OS) packages. Common vulnerabilities include missing data encryption, buffer overflows, missing authentication for critical functions and insecure interactions between software components.

    There are different risks associated with different types of vulnerabilities. With critical or high-risk vulnerabilities, an attacker who exploits your software has the potential to seriously impact your organization. Risks associated with data breaches impact not only an organization, but also its end users and customers.

    Vulnerability Management Techniques

    Vulnerability assessment practices and tools exist to make detecting vulnerabilities simple, accurate and fast. Some of these practices include:

    • Penetration testing – Penetration testing, or pen testing, allows you to identify security vulnerabilities by attempting to break into your own systems to identify weaknesses.
    • Configuration management – Configuration management involves managing infrastructure configurations and identifying missing patches that leave your software service vulnerable to errors and risks. There are tools that provide infrastructure scanning as-a-service to help detect outdated or misconfigured instances.
    • Container and application Scanning – Allows you to detect vulnerabilities in deployable artifacts and running applications. Some available tools for container scanning include Twistlock, Clair and Trivy.

    These practices help build solid, repeatable vulnerability management techniques across your security and delivery teams. One way to scale these security practices is through security automation. Security automation is the use of technology that performs tasks with reduced manual assistance. It ultimately enables users to apply security decisions automatically and secure processes to deliver more robust applications and infrastructure.

    Security Practices in your CI/CD process

    Security automation is a core tenant of DevSecOps. DevSecOps is short for development security and operations, and it describes how organizations deliver and make security decisions and actions within the development life cycle of their valued deliverables.

    DevSecOps is a way of continuously integrating security in the software development life cycle. It’s a way of working and thinking so that security is at the forefront of how security teams deliver business value.

    One way to enable DevSecOps is through your CI/CD pipeline. Today’s enterprises can use CI/CD to accelerate better software delivery, but with that speed it becomes even more important to enable robust security. Vulnerability scanning improves software security while giving individuals across engineering and product teams accountability for each of the processes these teams own.

    Don’t let Security Vulnerabilities Ruin your DevSecOps

    This is a simple, basic introduction to security vulnerabilities and the risks they pose for your organization. There are practices and tools for detecting and reducing security vulnerabilities, and finding ways to incorporate those processes into a CI/CD pipeline is a great way to accelerate your DevSecOps.

  • Report: Software Quality Issues Costing U.S. Companies $2.08 Trillion

    Report: Software Quality Issues Costing U.S. Companies $2.08 Trillion

    A report published today by the Consortium for Information & Software Quality (CISQ) estimates poor software quality collectively cost companies in the U.S. an estimated $2.08 trillion in 2020.

    The report, co-sponsored by software quality and security tools provider Synopsys, attempts to calculate, at least theoretically, the cost of known software failures. The report identifies operational software failures, estimated to be $1.56 trillion, as the single largest cost. The next-largest cost contributor is unsuccessful development projects, which totals $260 billion, an estimated 46% increase since 2018, according to the report. The project failure rate remained steady, at about 19%, for over a decade, according to the report.

    Finally, legacy systems issues contributed $520 billion to costs in 2020, a significant decrease from the $635 billion these issues cost in 2018.

    That estimate does not include technical debt, which CISQ estimates at another $1.13 trillion. Technical debt costs have been growing at a rate of 14% per year since 2018, the report noted.

    Joe Jarzombek, director for government and critical infrastructure programs for Synopsys, said it’s apparent there’s not enough focus on quality assurance within software supply chains. However, as organizations begin to realize how dependent their digital business transformation initiatives are on quality software, business executives will be forced to shift focus.

    Unfortunately, most business executives today still don’t understand or appreciate how software is constructed. Most organizations don’t even have a bill of materials describing the components that make up an application, noted Jarzombek.

    That issue becomes especially problematic in the event of a security breach, because too many organizations can’t draw a correlation between vulnerabilities and the impact on specific components of an application, added Jarzombek. At the same time, however, cybercriminals are becoming more efficient at scanning applications to discover and exploit those vulnerabilities, said Jarzombek.

    Many organizations also don’t appreciate how adept cybercriminals have become at exploiting what are perceived as low-level vulnerabilities to distribute malware laterally across an application, said Jarzombek. There is a tendency to patch only the most critical vulnerabilities within an application, while the rest are left to future updates. When fixing low-level vulnerabilities is not prioritized, these vulnerabilities may remain over multiple release cycles.

    Ultimately, Jarzombek said, rather than treating security separately from the application development process, it should be addressed as part of a comprehensive approach to software quality assurance. The immediate challenge, however, is that not enough developers have access to the tools they need to address these ongoing cybersecurity issues.

    The impact of poor software quality on individual companies will vary widely, but poor software quality is itself a universal issue. Most software development teams are not deliberately ignoring these issues; instead, the processes currently employed to build software are not especially robust, mature or, for that matter, automated, leaving organizations vulnerable.

  • Building an IaC Security and Governance Program Step-by-Step

    Building an IaC Security and Governance Program Step-by-Step

    Infrastructure as code (IaC) is undoubtedly changing how engineers approach the cloud. IaC, when coupled with dev tools and automation, opens up new avenues for infrastructure performance, scalability and, now, security.

    By embedding IaC security and compliance controls into your version control systems and CI/CD pipelines, you can start identifying and fixing errors earlier. But, to do so without being disruptive, it’s vital to lay out a strategy to determine where and how to enforce security controls to meet your goals without slowing your developers down, from experimentation to governing your strategy.

    This post will share a technical process for approaching and building an internal IaC security strategy.

    What are Your Infrastructure Security Goals?

    The key to implementing the most sustainable infrastructure security program lies in leveraging the tools and workflows developers already use. For many, that may be easier said than done because security tooling traditionally lacks the access and context necessary to play nice with dev workflows. The IaC security approach is fundamentally different from the more reactive cloud security monitoring and alerting that happen independent of developer workflows.

    As you start paving the road ahead for continuous infrastructure security processes, start by defining your ideal state. That way, as you go through the process, you’ll have an idea as to how and where you want to enforce different security and compliance controls.

    What Policies Do You Want to Enforce, and How?

    Your infrastructure security program is highly dependent on your organizations’ security priorities and maturity, and you should read this guide with your unique needs in mind.

    If you want to improve your overall cloud security posture, you may want to look for ways to apply common security policy frameworks such as the Center for Internet Security. Several open source security scanners such as Checkov or Open Policy Agent (OPA) enforce policy-as-code at the IaC level.

    They’re usually standalone packaged containers defined to accept a file, directory, repository, branch, etc., and output scan results in a machine-readable format such as JSON or JUnit XML. The most significant advantage of using an open source scanner is that they pre-package valuable security testing logic that your developers won’t have to learn.

    The alternative to a scanner is a full-featured security product, preferably one with exposed APIs and webhook integration sources. Most developer-first security solutions have done this part of the heavy lifting, so you should be getting some of this out-of-the-box.

    If you need to enforce external controls such as industry benchmarks or regulatory compliance requirements, you’ll need a more structured approach that maps individual checks to desired outcomes. Many cloud providers include robust compliance reporting for standard benchmarks such as HIPAA, NIST, PCI-DSS, etc. Make sure your policy enforcement approach enables you to build your own policies so you can adopt those controls as well.

    Where Should You Enforce Infrastructure Policies?

    Each of your teams likely has its unique frameworks and processes in place, and it’s important to have a full lay of the land before diving in. Start with a simple mapping exercise and list all the configuration frameworks in use—from CloudFormation or Azure Resource Manager (ARM) to Terraform or Pulumi.

    Once you know what frameworks exist internally, the next step is to determine the best place to scan them for infrastructure security errors. With many frameworks in place, building out new processes from scratch would be an uphill battle. Depending on your organization’s DevOps maturity, you’ll likely find an existing foundation on which you can build.

    Understand your teams’ end-to-end code review process—from committing new infrastructure changes to CI/CD build pipelines and deployments. Your team likely has some automated tests—unit, acceptance, integration, etc.—in place to ensure updates work as intended and don’t introduce bugs. Use those processes as an example for inserting security scanning. To better understand those processes, you might want to ask questions such as:

    • What triggers a CI/CD build?
    • Do your current automated quality assurance efforts run continuously on every new pull request and commit?
    • Do more time-consuming tests such as integration tests run on less-than-continuous intervals such as nightly or only on branches following specific naming conventions?
    • Are developers testing their work locally before committing?
    • How many CI/CD pipelines are in use?

    How and where you implement your security scanning will depend on those processes and the tools used to do them. Based on your current setup, you’ll generally want to take one of two approaches to IaC security—leveraging CI/CD processes or the built-in functionality from your version control system (VCS).

    Approach #1: CI/CD Pipeline

    Building security controls as part of CI/CD pipelines is probably the easier of the two approaches because modern CI/CD tools have completely abstracted away the complexity behind orchestrating test logic.

    In many cases, scanning security in CI pipelines is the fastest way to implement an IaC security and governance program. If a modern CI tool is already in place, you can probably set it up in less than 10 minutes. If you find yourself going down this path, consider the residual results of the scan and spend time dry-running it with the team that’s going to be in charge of handling its output.

    For teams operating in a centralized infrastructure operation model, this is an optimal solution. Expertise and control can remain in the hands of a small few, and the continuous enhancements to this process will not affect a large population of developers. For everyone else—continue reading.

    Approach #2: Version control system

    Your version control system (VCS) of choice is also hiding some robust security governance internal controls. Apart from adding individual automation capabilities, all of the three platforms currently dominating the market (GitHub, GitLab and Bitbucket) offer embedded code review and authorization controls that can be utilized to better control who can change what and where.

    Through their native versioning and branching, developers can perform extensive testing without compromising any running production system and continue to collaborate and converse before making changes due to a test.

    By embedding infrastructure security here, there are some pros in terms of more fine-grained access and controls. Two of the more common methods to do that utilize the standard pull request review (PR) process:

    • PR annotations: Start simple by choosing the path of least resistance. Using a standard webhook or API interface, you can start by scanning every PR and annotating its results with concrete secure coding advice. The benefit of the annotation is that it’s frictionless. Developers can choose to adopt or ignore it—little frustration, but on the other hand, not a lot of governance.
    • Checks: With the addition of native CI to most git platforms, you can also always incorporate a standard CI pipeline in git. The main benefit is to include a CI-like scan as part of each individual PR. It surfaces the same kind of output in an earlier stage and enables developers to react before actually failing building in the pipeline.

    How Should You Enforce Security Output?

    Before you include intrusive controls and overwhelming security scanning results, it’s a good idea to set expectations for how security output should be actioned. Nobody wants to get bombarded by tens of failure indications with no clear path to justify their decisions. If your IaC strategy is noisy or becomes a blocker at the end of the day, your team won’t adopt it.

    Define how passive or active you want the output of your security controls to be. Should it block builds actively or provide passive feedback to address in some pre-defined SLA?

    Some scanners can even integrate further into pipelines and orchestrate more advanced actions, such as blocking a build from completing until testing is complete. Scanning in CI was generally meant to be passive; it wasn’t built for interactive testing and troubleshooting. Should a development pipeline hold the answers to complex questions that need to be answered when resolving a security error or compliance violations?

    Ask yourself who is going to get the notification when that build fails. Continue by imagining if your CI console is where you want to troubleshoot a misconfiguration. Will you have sufficient context to solve the kind of issues your scanner is going to raise? Will you be able to deduce the impact of a change you’ll make to pass a CI scan?

    In addition to the previously mentioned benefits of hinging your IaC security strategy on your VCS, there are more fine-grained controls in git such as:

    • Approval rules: With a VCS, you can define how many approvals, and a pull request needs before it can be merged. Some even let you select which specific users those should be.
    • Code owners: If you have admin access to your main repo, consider using CODEOWNERS parameters to define a stricter approval protocol for more sensitive files.

    Some of the more mature tools also support advanced functionalities such as importing custom rule files and applying suppression and skips as code annotations. Those should help you make sure that only relevant checks eventually crop up.

    Conclusion

    There are no one-size-fits-all strategies for infrastructure security, and we as an industry are still defining the best practices for embedding it into IaC. It’s up to every security team to work closely with their engineering and DevOps to make security consumable and, ultimately, to prevent risk as early in the development life cycle as possible.

  • Why Service Meshes Are Security Tools

    Why Service Meshes Are Security Tools

    Are service meshes overhyped, or do they solve a real puzzle for enterprise IT systems? Service meshes are a relatively new technology, and many people have found it challenging to fit them into predefined tooling categories. That’s because service meshes have a wide variety of functionality, from load balancing to securing traffic. But service meshes do more than securing your traffic via mTLS, and they can be very important security tools for your enterprise.

    Service meshes help organizations improve their security posture, working to both proactively prevent attacks through encryption and access control as well as to provide visibility into anomalous behavior when security incidents do happen. Service meshes can be a strong addition to organizations’ security tooling and are especially important for securing applications that have both cloud-native and legacy components.

    In the past, controlling the perimeter of the network was considered “good enough” when it came to network security. There are two problems with this: First of all, even in legacy systems getting through the firewall was often not that hard and, once in, attackers could access the entire system. Just as importantly, this approach simply does not work for distributed, cloud-native applications that don’t even have a clear perimeter to protect. A service mesh makes it possible to tighten control over traffic inside the virtual network, so even if a malicious actor gets in, its presence is easier to detect and the extent of the damage can be limited.

    Service Mesh and Security

    Here’s why services meshes should be considered security tools—and how they work to secure modern enterprise applications.

    Central Control Over Communications

    Modern engineering organizations need to give individual developers the freedom to choose what components they use in applications as well as how to manage their own workflows. At the same time, enterprises need to ensure that there are consistent ways to manage how all of the parts of an application communicate inside the app as well as with external dependencies.

    A service mesh provides a uniform interface between services. Because it’s attached as a sidecar acting as a micro-dataplane for every component within the service mesh, it can add encryption and access controls to communication to and from services, even if neither are natively supported by that service.

    Just as importantly, the service mesh can be configured and controlled centrally. Individual developers don’t have to set up encryption or configure access controls; security teams can establish organization-wide security policies and enforce them automatically with the service mesh.

    Developers get to use whatever components they need and aren’t slowed down by security considerations. Security teams can make sure encryption and access controls are configured appropriately, without depending on developers at all.

    Cross-environment Microsegmentation

    The ability to control access to different parts of the infrastructure is a key part of any organization’s security posture. But in most modern enterprises, each business unit will have applications running both on-premises and in the cloud—potentially in multiple clouds.

    With an agnostic service mesh to bridge environments, organizations can segment networks in a way that still creates a seamless experience for users and doesn’t become too complex for security teams to manage effectively.

    Inside each segment, the service mesh can be used to create attribute-based access controls (ABAC), role-based access controls (RBAC) or even next-gen access controls (NGAC). A service mesh allows organizations to tune this access control very granularly, including inside individual network segments and across different deployment environments.

    Detailed Telemetry

    In addition to providing consistent encryption and access controls, service meshes can also provide the telemetry that organizations need to identify potential security incidents and respond appropriately to anomalies.

    Because all traffic moves through the service mesh, the mesh is able to collect and display granular information about network traffic. This includes the ability to track the origin and destination of every request sent through the mesh, which is important both for security as well as for passing compliance audits.

    With a service mesh that connects both legacy and cloud-native environments, detailed traffic information is available for the entire system. Security teams can use a single dashboard to see how traffic is moving through the system and to correlate signals to users, IP addresses and content as it moves from one environment to another. Having all the information in one place reduces the risk of miscommunications or miscorrelations as traffic moves between environments, either obscuring a real security risk or raising red flags unnecessarily.

    Consistent Cross-environment Security Postures

    Most modern enterprises have a hybrid/multicloud IT system that includes legacy monoliths in data centers, cloud-native infrastructure in private clouds as well as workloads running in at least one public cloud. There are legitimate business reasons for all of these infrastructure choices, but organizations need to have a strong, consistent security posture across all of them. Service mesh technology allows organizations to connect all of the services, applications and components in the system, regardless of environment, and ensure encryption, access controls and visibility into traffic flows extend throughout the entire system.

    Conclusion

    Adding a service mesh to your security toolkit is a way to ensure consistency and compliance across the entire, heterogeneous system, no matter what kind of environments and deployment architectures you have. Ultimately, your security posture is only as strong as your most vulnerable deployment. A service mesh is the best way to ensure that every part of your infrastructure complies with your internal security policies.

  • Veritas Looks to Reduce Data Protection Costs

    Veritas Looks to Reduce Data Protection Costs

    Veritas has extended the capabilities of the company’s NetBackup software as part of an effort to reduce the total cost of data protection.

    Version 8.3 of NetBackup now includes Veritas Resiliency Platform (VRP), a disaster recovery tool, and CloudPoint, a tool for backing data up on a public cloud. All of these tools are part of what Veritas calls its Enterprise Data Services Platform (EDSP).

    In addition, Veritas has integrated hardened NetBackup appliances and vendor-agnostic immutability for storage via its NetBackup OpenStorage Technology (OST) to help organizations recover from a ransomware attack more easily.

    Veritas is also adding support for 2048-bit encryption and integration with third-party key management systems (EKMS) along with more flexible enhancements to the role-based access control (RBAC) it provides.

    Other capabilities in this release of NetBackup include more granular recovery of virtual machines, the ability to orchestrated rehearsals to verify effectiveness of recovery procedures, and the ability to move data between cloud platforms.

    Veritas has also extended discovery, backup, restore and automation at scale for Microsoft SQL, Oracle and Oracle Real Application Clusters (RAC) to simplify data protection processes spanning multiple classes of databases.

    Finally, Veritas claims with this release, data protection via auto-discovery of resources and load balancing is now 25% faster and the discovery of VMware vCenter and vCloud platforms is 50% faster.

    Doug Matthews, vice president of data protection and compliance for Veritas, said with the expansion of EDSP it’s now much more cost-effective to protect data residing on multiple platforms. In the wake of the economic downturn brought on by the COVID-19 pandemic, there’s much greater sensitivity to IT costs, he said.

    At the same time, Matthews said Veritas is seeing DevOps teams become much more involved in automating data protection processes. Veritas has defined more than 600 application programming interfaces to enable DevOps teams to programmatically invoke its data protection software, he said.

    Cybersecurity teams are also becoming more involved as backup and recovery becomes a core element of ransomware defense strategies, Matthews added. In an ideal world, anytime a ransomware attack occurs, a pristine copy of any impacted data would be readily available on another unaffected platform.

    The convergence of data protection and cybersecurity has been a long time coming. Symantec once owned Veritas in the hopes of achieving that goal. Now Veritas is working with a much broader array of third-party partners to achieve that same goal, Matthews said. It may wind up being the rise of DevOps that finally forces that issue as data protection becomes one more IT task to be automated.

    In the meantime, IT organizations may want to revisit their entire approach to data protection. Chances are good that most of them have multiple redundant data protection tools and services in place that have been acquired over time. Consolidating those functions ultimately not only reduces licensing costs, but it also creates an opportunity to automate a set of mundane tasks that all too often IT staff forget to perform consistently at a time that will prove crucial.

  • Google Taps AMD for Confidential Computing Service

    Google Taps AMD for Confidential Computing Service

    Google Cloud, at a Google Cloud Next 2020 Online event, announced it is making available in beta Confidential VMs, a new service that represents the cloud service provider’s first foray into the realm of confidential computing.

    Based on second-generation EPYC processors from AMD that provide access to an embedded Secure Encrypted Virtualization (SEV) capability, Confidential VMs encrypt data while it is being processed.

    At the same time. Google unfurled Assured Workloads for Government, a service also in beta through which the company will ensure workloads are run in a specific location to meet government requirements.

    Sunil Potti, general manager and vice president of cloud security for Google Cloud, said Confidential VMs will complement existing secure cloud computing services that already isolate workloads and encrypt data at rest. Google has also invested in creating a zero-trust security model dubbed BeyondCorp that ensures access controls are strictly enforced, he noted.

    Google Cloud is following Microsoft Azure into the realm of confidential computing, which is being enabled by new classes of processors from AMD and Intel. Both Microsoft and Google Cloud are founding members of the Confidential Computing Consortium, an arm of The Linux Foundation which also includes Alibaba, ARM, Baidu, IBM, Intel, Red Hat, Swisscom and Tencent.

    Amazon Web Services (AWS) has yet to join the consortium or outline its approach to confidential computing. It already offers Nitro Enclaves through which it isolates compute environments to securely process sensitive data within their Amazon EC2 instances. Nitro Enclaves is based on the Nitro Hypervisor technology that AWS developed to provide CPU and memory isolation for EC2 instances. AWS for several years now has been making a case for “encrypt everything,” which has yet to become the default setting in most IT environments.

    It’s not clear to what degree IT organizations will embrace confidential computing services. There’s a clear need to secure data. However, many organizations may decide that paying extra to encrypt data while it’s processing may be one extra layer of security too many. There will always be financial services firms and government agencies that will prefer to encrypt data on an end-to-end basis. However, many organizations will be weighing the security benefit of those services against the cost and potential impact processing encrypted data in memory might have on applications.

    It’s also now only a matter of time before servers configured with processors that support the processing of data become available in on-premises IT environments. Many IT teams may decide that because of compliance requirements sensitive data still needs to processed within an on-premises data center.

    Of course, cloud security concerns go well beyond merely how data is encrypted. Most often, the biggest issues when it comes to cloud security is misconfigurations. Encrypting data might render any data inadvertently exposed useless. However, IT teams are just now coming to terms with best DevSecOps processes. Confidential computing services may have a role to play in enabling IT teams to achieve that goal, but it may be a while before the processors on which confidential computing depends are employed widely across an extended enterprise.

  • AIOps Greasing the Wheel of Digital Security amid COVID-19

    AIOps Greasing the Wheel of Digital Security amid COVID-19

    Amid the most challenging era for business infrastructures and transformations, AIOps (AI for IT Operations) can help industries operating in the digital environment to be vigilant when it comes to network operations or the digital security measures.

    AIOps has the potential to significantly align well with the cybersecurity needs of a company. A cybersecurity department in every organization needs to be active with respect to the latest and innovative security-related solutions. Threat detection and data security are crucial for every business entity.

    The corporate networking infrastructure for communication purposes is always under the threat of unauthorized third-parties that try to access confidential communications. Whether they are wireless, wired or connected to internet of things (IoT) devices. AIOps, through its intelligent algorithms, detects the communication requests and their source to accept them and restrict the fraudulent entities from becoming part of the legitimate network. Visibility and speed are two important aspects of platform security. If the source of the incoming request is known, it would be easy to verify it.

    The following are some of AIOps applications:

    Regulatory Framework

    General Data Protection Regulation (GDPR) corresponds to the protection of online customer data online. Businesses are required to ensure enough security measures to protect the personal and financial information of customers stored in an online account from identity theft and data breaches. AIOps can be used to secure the data from unauthorized third-party access in order to comply with the regulatory requirements.

    Real-time Data Processing

    In this era, communications, connection, data transmission and storage activities are performed online. Real-time data collection and processing in AIOps help streamline the operations and ensure the security of platforms in a centralized database. Technologies are shaping future investments. Enterprise management with respect to the performance attributes such as data analysis and monitoring for controlled access are in high demand. Advanced automation techniques have become possible with the innovative AIOps that help undergo operations in efficiently, eliminating the time-consuming and frustrating manual tasks. Machine learning and artificial intelligence algorithms collectively help reduce the overall response time, provide optimal user experience and protect network systems.

    Applications of AIOps amid the COVID-19 outbreak pave the roads for leading challenges. The rapid digital transformations during the pandemic are giving birth to various challenges with respect to security, user experience and the downfall of industries. Businesses are revamping operational infrastructure and fraudsters are actively exploiting vulnerabilities in the digital environment. The density with which the fraud is increasing each passing day is high. AIOps, under these circumstances, help businesses take into consideration vigilant security measures. The innovative solutions employ AI algorithms for the security of online platforms.

    Information Security and AIOps

    Information security highlights three major factors: confidentiality, integrity and availability. Confidentiality takes into account the need for protecting confidential customer information. Integrity keeps the form of data intact and availability ensures that the data is present at the moment when it is required. AIOps help ensure this CIA triad of information security through its high potential applications online security.

    High-scale data breaches, identity theft, account takeover frauds, malicious executables injection and similar cyberattacks are due to the uncontrolled access over user accounts and data. The list of fraud calls for stringent actions that AIOps provides in the form of digital security. The AI-powered identity verification systems help verifies the identity of customers online before onboarding them. Biometric sign-in every time while accessing the accounts help mitigate the risk fo fraud and bad actors that become the reason for malevolent activities. The spoofing detection and prevention techniques use AIOps that identify the spoofing elements in user-uploaded identity proofs and discard their communication request, which in return curb the likelihood of cyberattacks.

  • Can NetOps and SecOps Finally Get Along?

    Can NetOps and SecOps Finally Get Along?

    For years, the very definition of NetOps and SecOps has involved friction and even contentious relationships that make their respective jobs more difficult and lessen their efficiency and effectiveness. Much of this conflict originates from having charters that are seemingly in opposition to each other. At the surface, NetOps stands for connectivity, openness, speed and capacity. In contrast, SecOps comes across as binary opponents, posting for far too many regulations with segmented connectivity and a more or less closed or impaired environment.

    The truth is, however, both groups have the same goals:

    • Ensuring business operations and agility.
    • Protecting resources.

    The network is only important in its ability to connect users, systems, applications, information or data and other resources, ensuring effective business operations and agility. The network is means to an end, and not necessarily an end to itself. In a somewhat similar way, security is also not an end, but, rather, the means to an end. Security exists to protect these same users and resources. It’s all about the users and resources being able to run business operations effectively and with the agility and flexibility necessary to give it strategic advantages. Reflecting on this perspective may help NetOps and SecOps realize that they are not so far apart from each other.

    Both NetOps and SecOps struggle with many of the same issues. Both are usually overworked and understaffed, responsible for critical components or aspects of business, face constantly changing environments and challenges and slowed by cumbersome processes and a lack of agility. Because of these things, NetOps and SecOps are largely in the same boat, sharing the same storm.

    netops secopsThe lack of agility is a particularly important issue, as new technologies and techniques are constantly being developed that enable security teams to stay ahead of—or at least keep pace with—attackers. Motivated attackers tend to be far more innovative that defenders and can use anything at their disposal to accomplish their goals. Entire cybercriminal supply chains exist to provide attackers with applications, utilities, routines and even services to conduct their campaigns. These things can and will be used against defenders.

    On the other hand, deploying a new security solution on the network is generally a long, involved, cumbersome process. Even changing solutions involves considerable effort. Sometimes the rules or process gets invented along the way, compounding the difficulties. Additions or changes to the network involve tedious review processes mostly dictated by NetOps. The NetOps team also faces some of these same difficulties in adding or changing network management or monitoring solutions.

    While a careful review is warranted, current processes are too time-consuming and involved. One significant improvement can come from NetOps and SecOps coming together with an established and codified approach for network changes or additions. Getting issues out on the table for discussion is a great start. This means more collaboration and a joint learning cycle on short- and long-term organizational objectives. Both groups need to understand and appreciate the concerns of the other and realize their common ground. Prioritizing issues and agreeing on a fundamental set will ease the overall process, reduce unwarranted fear and antagonism, and eliminate much of the inventing the process on the fly.

    An emerging approach seeks to establish a centralized deployment point for both networking and security solutions with pre-established rules agreed upon by both teams. Ideally, many of the concerns can be addressed or mitigated by hardware and software designed to enforce policies or rules, provide failover as necessary, prevent performance degradation or add to the attack surface. These can allow solutions to drop into the network while offering guarantees of performance or availability.

    Streamlining deployment of shared management will result in much-needed agility and also boost efficiency and overall effectiveness. It will also lessen the typical tensions or outright opposition.

    NetOps and SecOps are much closer to each other than either realizes. Their shared guardianship of users and resources can benefit from joint discussions, plans, tools and policies. Not only can they better accomplish their own charters of connecting and protecting while providing agility and flexibility, but they also can become far more efficient with their operations. They need each other, and their organizations need the vital contributions from both. As typically said in security jargon, “A chain is only as strong as its weakest link.” The new paradigm of security-driven networking is about preventing weak links through the collaboration and synergy between NetOps and SecOps.

  • Commvault Extends Data Protection Alliance with Microsoft

    Commvault Extends Data Protection Alliance with Microsoft

    Commvault and Microsoft are extending their existing relationship to integrate Commvault’s data protection software with Azure Blob Storage.

    Azure Blob Storage is a service based on object-based storage optimized for unstructured data. Commvault last year launched the Metallic software-as-a-service (SaaS) platform, which provides a cloud-based approach to managing data protection, that runs on Azure.

    The two companies have pledged to extend that relationship to not only align engineering efforts but also enable their partners to more easily resell both Metallic and Azure cloud services under the same user contract.

    Manoj Nair, general manager for the Metallic service, said the Commvault offering presents IT administrators with a simple graphical user interface (GUI) and exposes application programming interfaces (API). That latter capability enables DevOps teams to automate the backup and recovery process via a cloud service, said Nair.

    Rather than having to rely on an IT administrator, the API enables DevOps teams to remove friction from the data protection process, he noted.

    The bulk of data protection processes are still managed by IT administrators. However, as DevOps processes continue to mature, data protection processes are becoming more automated. Developers not only want to be able to instantly recover data in the event of system failure but they also often use data protection tools to move data into and out of cloud computing environments.

    Nair said Commvault opted to extend its relationship with Microsoft in part because the amount of data being stored in the Azure cloud continues to expand exponentially as more organizations adopt Microsoft Office 365, Microsoft Teams and low-code applications built using Microsoft PowerBuilder tools. Collectively, those applications increase the amount of data gravity the Microsoft Azure cloud exerts. As the amount of data increases in the Azure cloud, the number of applications looking to access that pool of data increases steadily. As that data continues to grow, Nair said there will be a greater need for tools to protect that data.

    In general, Nair said many organizations underappreciate the need to back up and recover data stored by cloud service providers. The assumption is the cloud service provider will make it possible to recover data in the event of failure. In reality, cloud computing is based on a shared responsibility model between the end customer and the cloud service provider, under which responsibility for data protection—along with all other data management functions—belongs to the end customer.

    Of course, there is no shortage of data protection tools available. Many of those relied on today reside in an on-premises IT environment. In the wake of the COVID-19 pandemic, interest has grown regarding shifting data management tools to SaaS platforms that are more accessible. The issue many IT organizations will need to decide next is whether they want to rely on dedicated IT administrators to manage those processes versus reducing costs by employing APIs to automate a set of routine tasks that no one in IT especially enjoys managing.

  • SonicWall Adds Multi-Gigabit Switches to SD-Branch Portfolio

    SonicWall Adds Multi-Gigabit Switches to SD-Branch Portfolio

    SonicWall has added a line of multi-gigabit switches to its software-defined (SD)-branch offering that unifies the management of wireless access points and firewalls that include software-defined wide area network (SD-WAN) capabilities.

    Dmitriy Ayrapetov, vice president of platform architecture for SonicWall, said the switches will replace a series of switches that SonicWall had been reselling from Dell Technologies. SonicWall spun out of Dell at the end of 2018 after being acquired in 2012.

    SonicWall has been making a case for unifying the management of remote office networking via a central management console dubbed Capture Security Center. To achieve that goal, the company embedded SD-WAN capabilities in its firewalls while expanding its portfolio to include wireless access points and switches.

    Ayrapetov said in the wake of the COVID-19 pandemic, interest in centralizing the management of remote offices has increased for two reasons: First, IT teams are no longer inclined to travel to remote offices unless there is an absolute requirement; and second, following the economic downturn brought on by the pandemic, there’s more interest in reducing costs—an issue SonicWall addresses by consolidating the management of networking and security.

    As part of its SD-Branch offering, SonicWall also makes available client software in multiple forms, providing IT teams with capabilities such as URL filtering to block access to malicious websites that can be applied to any device on the network, including systems that employees are using to work from home. That capability makes it possible for IT organizations to enforce cybersecurity policies regardless of where employees are located or what network they are using to access IT resources in a branch office, said Ayrapetov.

    Longer-term, Ayrapetov said it’s clear organizations are moving toward zero-trust networking architecture to better ensure cybersecurity using SD-WANs and other technologies to access cloud applications. However, in the short-term, most organizations will continue to rely on virtual private networks (VPNs) to access IT resources located in a branch office, on-premises data center or public cloud.

    SonicWall has been making a case for its Boundless Cybersecurity platform, which can be broadly applied across a distributed computing environment. At the core of that platform is its Capture Advanced Threat Protection (ATP) cloud sandbox service that relies on deep memory inspection in real-time, machine learning and cyber threat intelligence to identify malware and other potential threats.

    As part of that architecture, SonicWall also provides zero-touch deployment capabilities, which eliminate the need for extensive cybersecurity expertise to deploy its appliances and services.

    It’s not clear to what degree organizations will be consolidating the management of networking and cybersecurity. However, the smaller the organization, the more likely one team is managing both networking and security. As the number of cybersecurity threats organizations face continues to rise at a time when IT budgets are under massive pressure, chances are high many larger IT organizations soon also will be consolidating the management of networking and security.