Welcome!

Related Topics: @CloudExpo, Microsoft Cloud, Containers Expo Blog, Agile Computing, Cloud Security, @DXWorldExpo

@CloudExpo: Article

How Cloud-Based SIEM Frees That One Hand Tied Behind Your Back

Changing the culture from reactive to proactive security strategies

Have you ever been asked to fight the state boxing champion with one hand tied behind your back? Or metaphorically experience the old adage of bringing a knife to a gunfight? Many security professionals face this scenario every day.

For many companies with whom I talk, there isn’t a lack of IT talent when it comes to security--just a lack of hours in the day, computing resources and necessary headcount with specific expertise to change the culture from reactive to proactive and strategic risk management. Executives simply expect IT security to do more with less.

But the ability to recruit and retain security experts is an issue in itself. At the MSPAlliance meeting this week in Orlando, it was reported that the unemployment rate for such professionals is less than 1%. The salary for these specialists has doubled in the past three years. No wonder there is a critical shortage to feed this growing monster. And executives are still wary to spend budget on security line items-including staffing. It is still regarded (mistakenly, I might add) as a cost center.

It is that reason why SIEM isn’t more prevalent in security initiatives. It’s expensive. It’s resource-intensive. It's too complex. It's difficult to implement. It's difficult to configure. Customization takes advance training, it take time, takes skills…Many security professionals recognize it can be a game changer, but in terms of bang for the buck, it tends to stay on the wish list. Organizations need to reprioritize and reconsider SIEM as one of the pillars of enterprise security strategy—a cornerstone that correlates across silos and countermands each one of the criticisms noted above.

We recognize risk is rising. From every survey, report and anecdote, security issues are becoming a more significant and louder talking point.  Everything from the introduction of new technologies, the morphing of infrastructures beyond network perimeters, to threats of breach, shadow IT and other internal vulnerabilities indicates that managing a firewall and filtering email is not enough.  This is not to ratchet up the rhetoric to encourage investment in security solutions, but a chance to reprioritize security and evaluate how and when a SIEM initiative might enhance capabilities without the cost and resource baggage so many apply to it.

Let’s also recognize that traditional deployments of SIEM are just not feasible for far too many companies. On premise options are cost-prohibitive. The time to monitor activity (especially in real time) is overly demanding considering other priority responsibilities. The expertise to integrate and correlate data across multiple silos and leverage their layered results into strategic action is a skill set very high in demand and hard to capture. And If I have security budget at all, I am going to invest in options in which the scope is fully affordable, manageable and fully functional. In security, solving 50% of the problem still leaves you 50% vulnerable.  All true, until you consider cloud security options.

Cloud-based SIEM certainly alleviates many of the above issues dealing with cost, deployment issues, scope fulfillment and the necessary expertise to monitor your network.

When evaluating SIEM initiatives there are a few requirements you need to consider so that you pick the best tool and process combination to close the vulnerability gap in a company. From a functionality standpoint you need a strong correlation engine. This is the foundation of situational context which allows you to discern white noise and harmless burps from true suspicious activity. Intrusion detection security without context is simply driving with one eye closed---you lose depth perception and true threat understanding. You also need real time monitoring. Looking at logs a week later may suffice for compliance needs, but any threat discovered is a week old. Classic reaction mode—but it’s neither reaction nor response, it’s mop-up and repair. Unless SIEM or log archive has a time machine module, the damage is done.

With SIEM you also need clear scope—what do you want it to monitor, what are the parameters of data synthesis, what are the response and alert protocols? You also need a process for asset classification and prioritization, data normalization and categorization of data.

The beauty of cloud-based SIEM is that a true security as a service does all the heavy lifting. It is that expertise and additional headcount you need without the CapEx costs of hardware, software, salary and the soft costs of employee benefits, training, ramp time. With all the buzz about the of cloud and it’s lack of security…this IS that security. Cloud-based SIEM is not a porous app or some subscription service sitting exposed on a server in some lonely rural business park. A cloud-based SIEM must be an extension of your own strategy…it must provide enterprise-class capability on par with any alternative version (on premise, hybrid or otherwise). When evaluating these options, simply make sure they ‘re aligned with your expectations.

But I want to take this one step further. And it moves the focus beyond SIEM. Jon Oltsik, Senior Principal Analyst at the IT strategy firm ESG he said at a webinar I attended recently, “We need integration between tools and we need better intelligence.” And he’s absolutely right.

As I alluded earlier, must SIEM should tightly integrate with Log Management. I contend that is only part of the equation. SIEM should also leverage the data collected from other security cornerstones such as identity management and access management. This unified approach is the nexus of intelligence. When considering SIEM, you should ensure that it is configured so that it collaboratively leverages data from a variety of sources so it can give you visibility; give you the details to tell friend from foe from phish from phantom.

Yet this presents another set of issues. So many solutions create so many dashboards. It is highly likely a company has multiple security systems, each looking at its own sector (i.e. Identity management is only concerned with the provisioning and de-provisioning accounts).An IT professional can easily be overwhelmed with all the check points—and then responsible for the forensic analysis to see the overall threat landscape. Centralization in a cloud-based SIEM solves the issue. In a true unified platform, all the necessary data is correlated and filtered into a single centralized dashboard. This, in turn, creates the visibility that provides the intelligence which feeds the strategies and tactics to better secure a network and all its proprietary assets.

The other issue is cost. I just recommended a company not only needs to invest in SIEM, but log management, access management, SSO and identity management. Again, I point to the cloud as the answer. By bundling these solutions as a single source, unified platform delivered and managed from a multi-tenant cloud, not only are the cost savings palpable, but the immediate deployment kick starts any initiative (you don’t have to wait a year or three to fully realize the benefits of an enterprise solution). You gain so many more capabilities you would have otherwise not been able to apply.

And with the influx of new complexities, increased threat landscapes, relentless compliance pressures, and the acknowledged critical skill shortage to address those complexities, there is a growing acceptance for security delivered from the cloud.

In a recent survey, it was shown that organizations with more sophisticated security initiatives are more vulnerable. I realize it flies in the face of reason. The answer is their sophistication creates enhanced visibility. Enhanced visibility gives them a better vantage over the threat landscape…in short they see what’s coming and can prepare strategic defenses. The point I wish to make is that this level of sophistication is affordable and manageable when applying cloud-based security tools. At the risk of being repetitive, this model creates relief in terms of infrastructure investment, removes the hurdles of configuration and implementation difficulties and diffuses maintenance and analysis complexities. Most importantly, it builds in the necessary expertise—security-as-a-service, than creates the intelligence without the additional financial outlay. It gives you a fighting chance…with both hands free.

Kevin Nikkhoo
Fighting the fight with both hands free!

www.cloudaccess.com

More Stories By Kevin Nikkhoo

With more than 32 years of experience in information technology, and an extensive and successful entrepreneurial background, Kevin Nikkhoo is the CEO of the dynamic security-as-a-service startup Cloud Access. CloudAccess is at the forefront of the latest evolution of IT asset protection--the cloud.

Kevin holds a Bachelor of Science in Computer Engineering from McGill University, Master of Computer Engineering at California State University, Los Angeles, and an MBA from the University of Southern California with emphasis in entrepreneurial studies.

Latest Stories
In his general session at 19th Cloud Expo, Manish Dixit, VP of Product and Engineering at Dice, discussed how Dice leverages data insights and tools to help both tech professionals and recruiters better understand how skills relate to each other and which skills are in high demand using interactive visualizations and salary indicator tools to maximize earning potential. Manish Dixit is VP of Product and Engineering at Dice. As the leader of the Product, Engineering and Data Sciences team at D...
In this presentation, you will learn first hand what works and what doesn't while architecting and deploying OpenStack. Some of the topics will include:- best practices for creating repeatable deployments of OpenStack- multi-site considerations- how to customize OpenStack to integrate with your existing systems and security best practices.
Transformation Abstract Encryption and privacy in the cloud is a daunting yet essential task for both security practitioners and application developers, especially as applications continue moving to the cloud at an exponential rate. What are some best practices and processes for enterprises to follow that balance both security and ease of use requirements? What technologies are available to empower enterprises with code, data and key protection from cloud providers, system administrators, inside...
Modern software design has fundamentally changed how we manage applications, causing many to turn to containers as the new virtual machine for resource management. As container adoption grows beyond stateless applications to stateful workloads, the need for persistent storage is foundational - something customers routinely cite as a top pain point. In his session at @DevOpsSummit at 21st Cloud Expo, Bill Borsari, Head of Systems Engineering at Datera, explored how organizations can reap the bene...
We are seeing a major migration of enterprises applications to the cloud. As cloud and business use of real time applications accelerate, legacy networks are no longer able to architecturally support cloud adoption and deliver the performance and security required by highly distributed enterprises. These outdated solutions have become more costly and complicated to implement, install, manage, and maintain.SD-WAN offers unlimited capabilities for accessing the benefits of the cloud and Internet. ...
"IBM is really all in on blockchain. We take a look at sort of the history of blockchain ledger technologies. It started out with bitcoin, Ethereum, and IBM evaluated these particular blockchain technologies and found they were anonymous and permissionless and that many companies were looking for permissioned blockchain," stated René Bostic, Technical VP of the IBM Cloud Unit in North America, in this SYS-CON.tv interview at 21st Cloud Expo, held Oct 31 – Nov 2, 2017, at the Santa Clara Conventi...
Security, data privacy, reliability and regulatory compliance are critical factors when evaluating whether to move business applications from in-house client hosted environments to a cloud platform. In her session at 18th Cloud Expo, Vandana Viswanathan, Associate Director at Cognizant, In this session, will provide an orientation to the five stages required to implement a cloud hosted solution validation strategy.
"Calligo is a cloud service provider with data privacy at the heart of what we do. We are a typical Infrastructure as a Service cloud provider but it's been designed around data privacy," explained Julian Box, CEO and co-founder of Calligo, in this SYS-CON.tv interview at 21st Cloud Expo, held Oct 31 – Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA.
In his session at 20th Cloud Expo, Scott Davis, CTO of Embotics, discussed how automation can provide the dynamic management required to cost-effectively deliver microservices and container solutions at scale. He also discussed how flexible automation is the key to effectively bridging and seamlessly coordinating both IT and developer needs for component orchestration across disparate clouds – an increasingly important requirement at today’s multi-cloud enterprise.
You want to start your DevOps journey but where do you begin? Do you say DevOps loudly 5 times while looking in the mirror and it suddenly appears? Do you hire someone? Do you upskill your existing team? Here are some tips to help support your DevOps transformation. Conor Delanbanque has been involved with building & scaling teams in the DevOps space globally. He is the Head of DevOps Practice at MThree Consulting, a global technology consultancy. Conor founded the Future of DevOps Thought Leade...
Jo Peterson is VP of Cloud Services for Clarify360, a boutique sourcing and benchmarking consultancy focused on transforming technology into business advantage. Clarify360 provides custom, end-to-end solutions from a portfolio of more than 170 suppliers globally. As an engineer, Jo sources net new technology footprints, and is an expert at optimizing and benchmarking existing environments focusing on Cloud Enablement and Optimization. She and her team work with clients on Cloud Discovery, Cloud ...
DXWordEXPO New York 2018, colocated with CloudEXPO New York 2018 will be held November 11-13, 2018, in New York City and will bring together Cloud Computing, FinTech and Blockchain, Digital Transformation, Big Data, Internet of Things, DevOps, AI, Machine Learning and WebRTC to one location.
René Bostic is the Technical VP of the IBM Cloud Unit in North America. Enjoying her career with IBM during the modern millennial technological era, she is an expert in cloud computing, DevOps and emerging cloud technologies such as Blockchain. Her strengths and core competencies include a proven record of accomplishments in consensus building at all levels to assess, plan, and implement enterprise and cloud computing solutions. René is a member of the Society of Women Engineers (SWE) and a m...
In an era of historic innovation fueled by unprecedented access to data and technology, the low cost and risk of entering new markets has leveled the playing field for business. Today, any ambitious innovator can easily introduce a new application or product that can reinvent business models and transform the client experience. In their Day 2 Keynote at 19th Cloud Expo, Mercer Rowe, IBM Vice President of Strategic Alliances, and Raejeanne Skillern, Intel Vice President of Data Center Group and G...
DXWorldEXPO LLC announced today that All in Mobile, a mobile app development company from Poland, will exhibit at the 22nd International CloudEXPO | DXWorldEXPO. All In Mobile is a mobile app development company from Poland. Since 2014, they maintain passion for developing mobile applications for enterprises and startups worldwide.