devopsy.kinsta.cloud

Tag: illumio

  • Trend Micro Expands DevSecOps Portfolio

    Trend Micro Expands DevSecOps Portfolio

    At the AWS re:Invent 2017 conference today, Trend Micro significantly expanded its reach into DevSecOps by announcing it has acquired Immunio, a provider of agent software that can be employed on a central platform engine to execute security policies on a granular level.

    In addition, Trend Micro announced it is adding support for container image scanning to its portfolio of security products as well by the spring of 2018.

    Mark Nunnikhoven, vice president of cloud research for Trend Micro, says both the Immunio policy engine and the container image scanning technology are now part of the Trend Micro Hybrid Cloud Security family of offerings that the company plans to expand for developers. Those capabilities, in turn, are exposed to developers deploying applications on-premises or in a public cloud primarily through its Trend Micro Deep Security cloud service, a suite of security technologies and threat detection services exposed by application programming interfaces (APIs).

    Nunnikhoven notes Trend Micro has seen a significant increase over the last several years in the use of programmatic approaches to managing security. Most of the shift has been driven by developers who have driven security to the left as part of the rise of DevSecOps. But he says security professionals are also starting to develop programming skills to advance IT security both in the cloud and on-premises.

    Nunnikhoven says the rise of containers is making DevSecOps more challenging. Too many developers are still grabbing containers from registries without checking them for vulnerabilities. As many as one-third of containers may contain known vulnerabilities, he says. To address that issue, Gartner estimates that by 2019 more than 70 percent of enterprise DevSecOps initiatives will have incorporated automated security vulnerability and configuration scanning for open-source components and commercial packages. That compares to less than 10 percent in 2016.

    IT organizations, however, don’t just want to be able to scan container images. Nunnikhoven says it’s clear they want a set of integrated security tools that can be employed to secure both the containers and the hosts they are deployed on. In the case of Immunio, Trend Micro is adding a security technology that can be embedded in applications running on virtual machines or bare-metal servers, as well as containers making up a microservice.

    While Trend Micro has a long history of providing security products to IT and cybersecurity professionals, it and virtually every other security vendor are competing against a host of startups that have embraced DevSecOps to change how security technologies are consumed. In its effort to remain relevant, Trend Micro is expanding its portfolio of products to focus more on developers. Over time, however, Nunnikhoven expects there will be increased collaboration between developers and IT security professionals, as the lines of responsibility for various aspects of security are better drawn.

    In the meantime, however, Trend Micro—like most of the vendors in the IT security industry—is now clearly making a hard shift to the DevOps left.

    — Mike Vizard

  • Illumio Extends Adaptive Security Platform for More Comprehensive Protection

    Illumio Extends Adaptive Security Platform for More Comprehensive Protection

    Networks often are complex and expansive. It’s easy to think of them as a singular entity, but the array of devices that interconnect, route and segment the network can make monitoring and managing security a challenge. Illumio hopes to address that challenge and help organizations implement security that is simultaneously easier and more comprehensive with changes to its Adaptive Security Platform.

    According to Illumio, the Adaptive Security Platform is being extended to enable companies to embrace network segmentation for data centers and cloud applications without sacrificing security.

    “One of the biggest challenges in security is battling complexity and that’s amplified by increasing heterogeneity that we see in customer data centers and cloud environments. Legacy infrastructure combined with virtualization and cloud means there is opportunity for coordinated points of policy enforcement,” said Eric Hanselman, chief analyst of 451 Research. “We see segmentation in depth addressing a real requirement for customers who are looking to both strengthen security and simplify operations by centralizing and harmonizing policy and enforcement across different environments.”

    “As segmentation becomes the core strategy for data center and cloud security, organizations are now looking at how other elements of their compute environment can be used to enforce these policies,” said PJ Kirner, chief technology officer and founder of Illumio. “Our customers have asked us to efficiently coordinate policy across their data center and cloud environments, simplifying management of the security control plane.”

    Illumio shared some of the big features included in this update:

    • Illumio can now program and control leading data center and cloud infrastructure—including Cisco Systems, Microsoft Azure, AWS and Arista—to deliver the most comprehensive segmentation solution in the market.
    • Customers no longer need firewall chokepoints, SDN deployments or upgrade infrastructure to achieve robust segmentation-based security.
    • The expansion of Illumio’s enforcement point programming gives customers a centralized and automated coordination of policy management between:
      • Hosts: Workloads (bare-metal, VM, containers)
      • Network: Cisco and Arista switches (NEW), F5 LTM & ATM
      • Public Cloud: AWS Security Groups, Azure Network Security Groups
    • Customers can now write uniform security policies for hosts, the network and public cloud, improving security and reducing operational overhead.
    Illumio-ASP-Architecture
    Illumio ASP architecture

    With the extension of Illumio ASP from bare-metal servers, virtual machines and containerized host to include additional security controls for the network and cloud, Illumio states that it reduces the need to manage multiple, disconnected policy models. Illumio claims that it helps eliminate security gaps generated by disparate security policies, reduces the operation overhead created by manual segmentation and stops the need for additional firewall chokepoints or SDN deployments.

    “Despite the rapid increase in cybersecurity spending focused on implementing stronger security controls to limit access to sensitive data and applications—organizations of all sizes don’t always end up with more secure environments,” said Jon Oltsik, ESG’s senior principal analyst and founder of the firm’s cybersercurity service. “The ability to drive segmentation in depth throughout the data center and cloud can be a critical next step in securing data center and cloud environments.”

    — Tony Bradley

  • Illumio Brings Adaptive Segmentation to Cisco, Arista, AWS, and Azure

    SUNNYVALE, Calif., Jan. 31, 2017 — Illumio announced today the company is taking another step forward in making its Adaptive Security Platform (ASP)™ the new foundation for data center and cloud security with industry-first capabilities and support for ACLs on Cisco and Dynamic Filters on Arista data center network switches, as well as AWS Security Groups and Azure Network Security Groups. These new capabilities will be delivered to market during 2017 and the switch integrations will be demonstrated on the floor of the RSA conference in February.

    “As segmentation becomes the core strategy for data center and cloud security, organizations are now looking at how other elements of their compute environment can be used to enforce these policies,” said PJ Kirner, chief technology officer and founder of Illumio. “Our customers have asked us to efficiently coordinate policy across their data center and cloud environments, simplifying management of the security control plane. This expansion of our platform builds on our previously demonstrated capability of programming the F5 LTM and AFM and represents our next step towards Illumio’s vision for adaptive segmentation.”

    Today organizations are looking at segmentation to move beyond reactive breach detection solutions to a proactive protection model that stops the lateral movement of bad actors. However, that shift often comes with additional operational overhead and inconsistent policies that don’t scale across their environments.

    “Despite the rapid increase in cybersecurity spending focused on implementing stronger security controls to limit access to sensitive data and applications – organizations of all sizes don’t always end up with more secure environments,” said Jon Oltsik, ESG’s senior principal analyst and founder of the firm’s cybersercurity service. “The ability to drive segmentation in depth throughout the data center and cloud can be a critical next step in securing data center and cloud environments.”

    By extending Illumio ASP’s enforcement point ecosystem from the workload (bare-metal servers, virtual machines, containerized hosts) to the additional security controls in the network and cloud, Illumio is delivering on the promise of segmentation and is ending the need to manage multiple, disconnected policy models. This provides three core benefits:

    1. Eliminates the security gaps generated by the disparate, uncoordinated security policies enforced separately at the workload, in the network, and in cloud environments.
    2. Reduces the operational overhead of manual segmentation provisioning by taking advantage of software-driven automation of security policies.
    3. Stops the addition of unnecessary firewall choke points or SDN deployments to achieve robust segmentation-based security.

    “One of the biggest challenges in security is battling complexity and that’s amplified by increasing heterogeneity that we see in customer data centers and cloud environments. Legacy infrastructure combined with virtualization and cloud means there is opportunity for coordinated points of policy enforcement,” said Eric Hanselman, chief analyst of 451 Research. “We see segmentation in depth addressing a real requirement for customers who are looking to both strengthen security and simplify operations by centralizing and harmonizing policy and enforcement across different environments.”

    About Illumio

    Illumio stops cyber threats by controlling the lateral movement of unauthorized communications through its breakthrough adaptive segmentation technology. The company’s Adaptive Security Platform™ visualizes application traffic and delivers continuous, scalable and dynamic policy and enforcement to every bare-metal server, VM, container, and VDI within data centers and public clouds. Using Illumio, enterprises such as Morgan Stanley, Plantronics, Salesforce, King Entertainment, NetSuite, Oak Hill Advisors, and Creative Artists Agency have achieved secure application and cloud migration, environmental segmentation, compliance, and high-value application protection from breaches and threats with no changes to applications or infrastructure. For more information, visit www.illumio.com or follow us @Illumio.

    — Jules Louis

  • Illumio Introduces Adaptive User Segmentation as the Newest Weapon in the Battle to Reduce Cyber Attack Surface

    Illumio’s Adaptive User Segmentation capabilities dynamically integrate Microsoft’s Active Directory entitlements for hundreds of millions of users, dramatically expanding the reach of the Adaptive Security Platform
    SUNNYVALE, Calif.—February 17, 2016—Illumio today announced it has extended the capabilities of its industry-leading Adaptive Security Platform (ASP)Ô through integration with Microsoft’s Active Directory groups. The new capability, known as Adaptive User Segmentation, dynamically calculates and provisions connectivity rules based on user identity to prevent unauthorized communications with, and access to, any Illumio-protected applications. Illumio ASP now can govern how hundreds of millions of users connect to applications across data centers, clouds or hybrid-cloud compute environments.
    Adaptive User Segmentation is the latest step in Illumio’s core mission to secure data anywhere it resides:
    ·      When Illumio launched in October 2014, it introduced a complete range of adaptive segmentation models to reduce the attack surface, from environmental separation to micro-segmentation. It also introduced “MRI-like” visualizations of data center and cloud environments, as well as policy-driven transport layer encryption.
    ·      During RSA 2015, the company introduced its nano-segmentation capability, which provides process-level segmentation among both physical servers and virtual machines and reduces the surface area of server-to-server communications by over 99 percent. Illumio also extended its policy-driven segmentation model to incorporate F5 Local Traffic Manager and Application Firewall Modules.
    ·      Later in the year, Illumio announced partnerships with Docker and Mesosphere to extend adaptive security capabilities to fast-growing Linux container deployments.
    Illumio’s Adaptive User Segmentation extends to all of these environments and delivers the most meaningful reduction in the cyber attack surface area in computing history. The company has fused governance of both workload-to-workload communications and user-to-workload communications through this technology breakthrough, strengthening the traditional entitlement model in a way never possible before today. According to statcounter.com, Windows 7—the target OS for VDI desktops/laptops connecting to the data center—accounts for just under 50 percent of all desktop operating systems in operation.
    Today, users within an organization can see and connect to most, if not all, applications within the data center or cloud environment, regardless of their Active Directory entitlements. Given heightened challenges to deliver trust and security, relying on central systems of record like Active Directory to ensure users only have access to the appropriate assets is no longer sufficient. The breaches that occurred in the past few years in large enterprises and government agencies underscore that entitlements and authentication alone are unable to provide the protection required by high-value applications and data.
    Leveraging the Illumio ASP approach of writing and delivering a dynamic policy using a whitelist model, the integration of Illumio ASP and Active Directory allows an organization to ensure that only the correct users can connect to the appropriate workloads and applications in the data center, public cloud, private cloud or hybrid compute environment.
    “Illumio’s mission since our founding has been to help our customers regain control over their applications and data,” said Andrew Rubin, co-founder and chief executive officer of Illumio. “With the introduction of Adaptive User Segmentation, Illumio once again is dramatically reducing computing attack surface through dynamic, policy-driven enforcement that allows users to only connect to the data center and cloud compute they are entitled to access.”
    “Illumio’s new capabilities will resonate with security professionals assessing their security posture,” said Jon Oltsik, senior principal analyst, Enterprise Strategy Group. “Security leaders must deal with both sides of the user/data center equation and are well served to do it together rather than separately.”
    About Illumio
    Illumio delivers adaptive security for every computing environment, protecting the 80 percent of data center and cloud traffic missed by the perimeter. The company’s Adaptive Security Platform™ visualizes application traffic and delivers continuous, scalable, and dynamic policy and enforcement to every bare-metal server, VM, container, and VDI within data centers and public clouds. Using Illumio, enterprises such as Morgan Stanley, Plantronics, NTT, King Entertainment, NetSuite, and Creative Artists Agency have achieved secure application and cloud migration, environmental segmentation, compliance, and high-value application protection from breaches and threats with no changes to applications or infrastructure. For more information, visit www.illumio.com or follow @Illumio.
    ———————————————-
    Amber Rowland
  • The DevOps and Security Manifesto

    The DevOps and Security Manifesto

    Early in Illumio’s history, I saw the future of DevOps security. The CISO of an electronics manufacturer brought us in to help secure a new support service that was built entirely in the cloud. After meeting with the security team, we were introduced to the application development team who cast a cold eye on our technology. About five minutes into the demo, the group’s manager asked to take control of the keyboard and start using our software. “I know how to use this. It’s like network-security Chef,” he said with a wry smile. He flew through the UI.

    Fast forward to the recent DevOps Connect event at RSA, which underscored the critical importance of cybersecurity to the application development process. If business increasingly relies on agile software development, the lack of corresponding fast-moving security approaches effectively increases the risk of a breach or a cyberattack. You cannot build and mount applications in a distributed application and computing environment and then rely on a static, hierarchical security model built upon chokepoints, infrastructure control points and organizational silos.

    Traditionally, one group created applications and another deployed them on the compute infrastructure. Then, a third group implemented security and ensured applications were trusted, particularly through instrumentation of the perimeter network security. Those days are disappearing.

    It is time for a new relationship – and new, shared technologies — among DevOps, infrastructure and security, expressed through what I believe are are 10 principles for DevOps and security.

    Principle I — No divine right of InfoSec primogeniture. Security must not be run in a silo. While security teams play the most critical role in assessing corporate risk and setting policy, there must be leadership and shared responsibility across various IT functions.

    Principle II — Orchestrate but remediate. Security must be as responsive to continuous delivery as application creation and scaling. Application developers need cool, agile tools for security, too.

    Principle III — Application developers must not put the organization in harm’s way. They must consider security at the beginning of the application development cycle and not simply hand off the responsibilities to others. Moreover, they must have security capabilities well instrumented into application development tools and infrastructure.

    Principle IV — Speed should not kill. Lack of speed hurts business. The spread of malware kills business. The speed of application development should not provide a corresponding acceleration in security risk.

    Principle V — Reduce the attack surface. Application developers must co-join with security teams to reduce the attack surface available to bad actors. By considering exposure and risk at the front end of the DevOps cycle, fewer issues should arise afterwards.

    Principle VI — Security must be built-in, not bolted on. Application and security architectures that can contain the threats are the order of the enterprise. To Principles IV and V, this increases organizational speed and reduces risk.

    Principle VII — Equality of the data center and cloud. Information security must be considered and deployed equally for the data center and the cloud. Separate but equal approaches are not the preferred path for IT professionals. The more widely distributed and deployed applications become, the more unified the security approach must be.

    Principle VIII — Stream, not batch. Security must deploy as streaming technology, not batch processes. There is no “set it and forget it” approach for security in a DevOps world.

    Principle IX — A minute lost finding a breach is unacceptable. Only a minimal amount of time (second, minutes) must pass in finding cyberattacks and breaches. Systems must be engineered for constant visibility and notification of policy violations.

    Principle X — Common Contribution. The maintenance of a strong DevOps security approach requires a shared contribution to application and security approaches toward the common good. The day of IT silos is ending.

    About the Author/Alan Cohen

    Illumio Photo, Alan CohenAlan Cohen – As chief commercial officer, Alan leads Illumio’s go-to-market strategy and customer engagement life cycle organizations, including marketing, support, talent, and IT. He is a 25-year technology veteran known for company building and new-market-creation experience. Alan’s prior two companies, Airespace (acquired by Cisco for $450 million) and Nicira (acquired by VMware for $1.26 billion), were the market leaders in centralized WLANs and network virtualization, respectively.

    Prior to Nicira, Alan led the enterprise marketing organization at Cisco, a team of 300 responsible for bringing to market an associated $25 billion product portfolio. He serves as an advisor to several technology companies including MobileIron, Highfive, and Netskope. Alan is a frequent industry speaker and commentator whose work has appeared in The New York Times, Fortune, Re/code, and Gigaom. He has a BA from SUNY Buffalo, an MA from the School of International Service at American University, and an MBA in Finance from the Stern School of Business at New York University.