Welcome!

Java IoT Authors: Elizabeth White, Liz McMillan, Pat Romanski, Yeshim Deniz, Paul Simmons

Related Topics: @CloudExpo, Java IoT, Microservices Expo, Linux Containers, Cloud Security, @DXWorldExpo

@CloudExpo: Blog Post

Are the Barbarians at the Gate? By @EFeatherston | @CloudExpo [#Cloud]

Cloud has become the ubiquitous term and so overused that whenever a breach happens, it’s assumed it is a cloud problem

The Cloud, Security and Breaches – Are the Barbarians at the Gate?

Target. Home Depot. Community Health Systems. Nieman Marcus. Their names have been all in the news over the past year, though probably not in a way they would like. All have had very public data breaches affecting anywhere from 350,000 (Nieman Marcus) to 4.5 million (Community Health Systems) customers. Add the recent high-profile celebrity nude photo hacking scandal and cloud security has become the trending topic in all the news and social media. Some of the discussions reminded me of a line from a short-lived TV show called ‘Almost Human' (yes I watched it, and since it was not renewed, apparently I was part of a small group). In the opening sequence of the show was the line ‘technology has forever altered the criminal landscape.' Is that where we are? Are the barbarians at the gate? Will this, or should this, impact decisions about migrating to the cloud?

Cloud: guilt by association
Cloud has become the ubiquitous term and so overused that whenever a breach happens, it's assumed it is a cloud problem. The reality is that out of all the breaches I mentioned earlier, only one of them - the celebrity nude photo scandal - had any connection to cloud technology.  In his recent article Celebrities get phished, cloud gets blamed, David Linthicum makes the point saying that "no matter if it's truly a cloud service or, in most cases, internal systems that are somehow compromised. Because no one in the general media really knows what a ‘cloud' is, it's all a cloud to them." The other breaches I listed were all internal system breaches, with various methods used to accomplish the breach. 11 Steps Attackers Took to Crack Target gives a great detailed description of the process the hackers used to breach Target's systems last year. While the first step sstarted with a simple email phishing campaign, it required a complex set of tasks executed over time to eventually compromise Target's Point of Sale (PoS) systems, which is where the actual breach occurred. None of that had anything to do with the cloud.

No technology negates the need for design and planning
While a majority of the highly public security breaches may not be related to the cloud, that does not mean going to the cloud has no security risks involved. Going to the cloud does not automatically give you the security you may need for your data. Like any other complex systems, the risks must be understood, analyzed and planned for. Mitigation strategies should be put in place, and test plans designed and developed to validate that the security you have put in place is working as expected. In addition, this should not be a ‘once and done' type of planning. Security risks are changing at breakneck speeds in the Social, Mobile, Analytic and Cloud (SMAC) disruptive technology landscape of today. These disruptions have altered the criminal landscape, and while the barbarians may not be literally at the gate, they will always be trying to storm the castle, testing your defenses, trying to find other ways in, and seeking the treasures behind those walls - your data.

No system is ever 100 percent safe
This is not meant to be a doom and gloom prediction, just a reality of networked systems. The only 100 percent secure system is one that has no network connects and that no one has physical access to - obviously that level of protection is not realistic or usable in any way. Going to the cloud can be just as secure (if not more so) than using internal-only systems. Whether in the cloud or not, putting security mechanisms in place is always a delicate balancing act between protection and usability of the system. Everything is a tradeoff. As technologists, it is our responsibility to identify the risks and options available with their inherent tradeoffs, and work with the business to determine the appropriate mechanisms to put in place. Ideally, the two primary goals when designing and testing your security measures should be:

  • Make it so difficult and time-consuming to break through,that those trying will just move on
  • Have mechanisms in place to detect attempts to get through those barriers so that countermeasures can be taken (up to and including taking the system offline if the protection of the data is critical enough)

These always need to be balanced and measured with the business to ensure everyone is making informed decisions based on the business benefits, usability and risk associated with those decisions.

Are the barbarians at the gate?
Yes, they always have been and they always will be. There will always be people out there trying to hack into systems, whether for criminal intent or just because. It doesn't mean we should avoid going to the cloud or avoid providing access to systems that have legitimate business value. It just means we should always do our due diligence, identify the risks, design and plan to deal with those risks, and work in concert with the business so that informed decisions get made and all stakeholders have the appropriate expectations. This process should be constantly in motion and evolving given how quickly technology is moving in the disruptive SMAC landscape we operate in today.

More Stories By Ed Featherston

Ed Featherston is VP, Principal Architect at Cloud Technology Partners. He brings 35 years of technology experience in designing, building, and implementing large complex solutions. He has significant expertise in systems integration, Internet/intranet, and cloud technologies. He has delivered projects in various industries, including financial services, pharmacy, government and retail.

Comments (0)

Share your thoughts on this story.

Add your comment
You must be signed in to add a comment. Sign-in | Register

In accordance with our Comment Policy, we encourage comments that are on topic, relevant and to-the-point. We will remove comments that include profanity, personal attacks, racial slurs, threats of violence, or other inappropriate material that violates our Terms and Conditions, and will block users who make repeated violations. We ask all readers to expect diversity of opinion and to treat one another with dignity and respect.


@ThingsExpo Stories
Explosive growth in connected devices. Enormous amounts of data for collection and analysis. Critical use of data for split-second decision making and actionable information. All three are factors in making the Internet of Things a reality. Yet, any one factor would have an IT organization pondering its infrastructure strategy. How should your organization enhance its IT framework to enable an Internet of Things implementation? In his session at @ThingsExpo, James Kirkland, Red Hat's Chief Archi...
In his general session at 19th Cloud Expo, Manish Dixit, VP of Product and Engineering at Dice, discussed how Dice leverages data insights and tools to help both tech professionals and recruiters better understand how skills relate to each other and which skills are in high demand using interactive visualizations and salary indicator tools to maximize earning potential. Manish Dixit is VP of Product and Engineering at Dice. As the leader of the Product, Engineering and Data Sciences team at D...
Personalization has long been the holy grail of marketing. Simply stated, communicate the most relevant offer to the right person and you will increase sales. To achieve this, you must understand the individual. Consequently, digital marketers developed many ways to gather and leverage customer information to deliver targeted experiences. In his session at @ThingsExpo, Lou Casal, Founder and Principal Consultant at Practicala, discussed how the Internet of Things (IoT) has accelerated our abilit...
Organizations planning enterprise data center consolidation and modernization projects are faced with a challenging, costly reality. Requirements to deploy modern, cloud-native applications simultaneously with traditional client/server applications are almost impossible to achieve with hardware-centric enterprise infrastructure. Compute and network infrastructure are fast moving down a software-defined path, but storage has been a laggard. Until now.
Digital Transformation is much more than a buzzword. The radical shift to digital mechanisms for almost every process is evident across all industries and verticals. This is often especially true in financial services, where the legacy environment is many times unable to keep up with the rapidly shifting demands of the consumer. The constant pressure to provide complete, omnichannel delivery of customer-facing solutions to meet both regulatory and customer demands is putting enormous pressure on...
The best way to leverage your CloudEXPO | DXWorldEXPO presence as a sponsor and exhibitor is to plan your news announcements around our events. The press covering CloudEXPO | DXWorldEXPO will have access to these releases and will amplify your news announcements. More than two dozen Cloud companies either set deals at our shows or have announced their mergers and acquisitions at CloudEXPO. Product announcements during our show provide your company with the most reach through our targeted audienc...
JETRO showcased Japan Digital Transformation Pavilion at SYS-CON's 21st International Cloud Expo® at the Santa Clara Convention Center in Santa Clara, CA. The Japan External Trade Organization (JETRO) is a non-profit organization that provides business support services to companies expanding to Japan. With the support of JETRO's dedicated staff, clients can incorporate their business; receive visa, immigration, and HR support; find dedicated office space; identify local government subsidies; get...
DXWorldEXPO LLC announced today that ICC-USA, a computer systems integrator and server manufacturing company focused on developing products and product appliances, will exhibit at the 22nd International CloudEXPO | DXWorldEXPO. DXWordEXPO New York 2018, colocated with CloudEXPO New York 2018 will be held November 11-13, 2018, in New York City. ICC is a computer systems integrator and server manufacturing company focused on developing products and product appliances to meet a wide range of ...
@DevOpsSummit at Cloud Expo, taking place November 12-13 in New York City, NY, is co-located with 22nd international CloudEXPO | first international DXWorldEXPO and will feature technical sessions from a rock star conference faculty and the leading industry players in the world.
DXWorldEXPO LLC announced today that the upcoming DXWorldEXPO | CloudEXPO New York event will feature 10 companies from Poland to participate at the "Poland Digital Transformation Pavilion" on November 12-13, 2018.
22nd International Cloud Expo, taking place June 5-7, 2018, at the Javits Center in New York City, NY, and co-located with the 1st DXWorld Expo will feature technical sessions from a rock star conference faculty and the leading industry players in the world. Cloud computing is now being embraced by a majority of enterprises of all sizes. Yesterday's debate about public vs. private has transformed into the reality of hybrid cloud: a recent survey shows that 74% of enterprises have a hybrid cloud ...
In his keynote at 19th Cloud Expo, Sheng Liang, co-founder and CEO of Rancher Labs, discussed the technological advances and new business opportunities created by the rapid adoption of containers. With the success of Amazon Web Services (AWS) and various open source technologies used to build private clouds, cloud computing has become an essential component of IT strategy. However, users continue to face challenges in implementing clouds, as older technologies evolve and newer ones like Docker c...
Business professionals no longer wonder if they'll migrate to the cloud; it's now a matter of when. The cloud environment has proved to be a major force in transitioning to an agile business model that enables quick decisions and fast implementation that solidify customer relationships. And when the cloud is combined with the power of cognitive computing, it drives innovation and transformation that achieves astounding competitive advantage.
Cloud-enabled transformation has evolved from cost saving measure to business innovation strategy -- one that combines the cloud with cognitive capabilities to drive market disruption. Learn how you can achieve the insight and agility you need to gain a competitive advantage. Industry-acclaimed CTO and cloud expert, Shankar Kalyana presents. Only the most exceptional IBMers are appointed with the rare distinction of IBM Fellow, the highest technical honor in the company. Shankar has also receive...
Michael Maximilien, better known as max or Dr. Max, is a computer scientist with IBM. At IBM Research Triangle Park, he was a principal engineer for the worldwide industry point-of-sale standard: JavaPOS. At IBM Research, some highlights include pioneering research on semantic Web services, mashups, and cloud computing, and platform-as-a-service. He joined the IBM Cloud Labs in 2014 and works closely with Pivotal Inc., to help make the Cloud Found the best PaaS.
In his Opening Keynote at 21st Cloud Expo, John Considine, General Manager of IBM Cloud Infrastructure, led attendees through the exciting evolution of the cloud. He looked at this major disruption from the perspective of technology, business models, and what this means for enterprises of all sizes. John Considine is General Manager of Cloud Infrastructure Services at IBM. In that role he is responsible for leading IBM’s public cloud infrastructure including strategy, development, and offering m...
DXWorldEXPO LLC announced today that All in Mobile, a mobile app development company from Poland, will exhibit at the 22nd International CloudEXPO | DXWorldEXPO. All In Mobile is a mobile app development company from Poland. Since 2014, they maintain passion for developing mobile applications for enterprises and startups worldwide.
Headquartered in Plainsboro, NJ, Synametrics Technologies has provided IT professionals and computer systems developers since 1997. Based on the success of their initial product offerings (WinSQL and DeltaCopy), the company continues to create and hone innovative products that help its customers get more from their computer applications, databases and infrastructure. To date, over one million users around the world have chosen Synametrics solutions to help power their accelerated business or per...
We are seeing a major migration of enterprises applications to the cloud. As cloud and business use of real time applications accelerate, legacy networks are no longer able to architecturally support cloud adoption and deliver the performance and security required by highly distributed enterprises. These outdated solutions have become more costly and complicated to implement, install, manage, and maintain.SD-WAN offers unlimited capabilities for accessing the benefits of the cloud and Internet. ...
Founded in 2000, Chetu Inc. is a global provider of customized software development solutions and IT staff augmentation services for software technology providers. By providing clients with unparalleled niche technology expertise and industry experience, Chetu has become the premiere long-term, back-end software development partner for start-ups, SMBs, and Fortune 500 companies. Chetu is headquartered in Plantation, Florida, with thirteen offices throughout the U.S. and abroad.