Welcome!

DevOps Journal Authors: Jason Bloomberg, Martin Etmajer, Elizabeth White, Pat Romanski, Noel Wurst

Related Topics: Cloud Expo, SOA & WOA, Open Source, Security, Big Data Journal, SDN Journal

Cloud Expo: Article

Consolidating the Variables: Augment Existing Identity Management Systems

Using cloud security to expand on-premise investments

The modern enterprise is a fluid entity. As an IT construct it expands and contracts (sometimes simultaneously), and many of the moving parts (like users and applications) are themselves evolving and changing. This creates unique challenges in operational efficiencies, core competency support, compliance observance and risk management.  The central theme to all these challenges is establishing and maintaining control of applications which serve as gateways to all the valuable data (personal, trade secrets and other IP) on which an enterprise exists. Many companies have turned to an identity management solution which administrate and validate the digital identities of authorized users.

This is not a new concept, nor is it a foreign practice to many established enterprises. Identity management combined with controlled and channeled access is a recognized best practice and regulatory compliance necessity. Many companies have invested in some sort of authoritative identity repository and management system.  The rising issue is that in order to keep up with the quickly changing landscape of SaaS, cloud and web –based apps, that investment becomes costlier and the ability to agilely address identity validation and authentication becomes less responsive.

Unless you leverage the cloud to augment existing systems.

Let’s assume an enterprise has made a serious investment in a solution like IBM Tivoli or Oracle Identity Manager.  Both products have significant clout and enterprise functionality. It handles the identity creation, rules management, administration and provisioning for many of the legacy and on-premise products and internal systems. It's no secret that these enterprise monoliths are expensive to purchase, deploy and continuously maintain. So, when examining the scope of applications available to users, several are left unsecured because of the cost and resource drain to incorporate them into IDM fold.  Layered on this is the need to authenticate and authorize users outside of an enterprise’s direct control. This includes 3rd party suppliers, vendors and even customers; all who need access to slivers of data contained in specific applications.

The costs to expand the on-premise authentication scope are broader and deeper than simply adding the subscription price of a SaaS solution. There is the licensing of the adapter (or connector) to allow the data of the SaaS to securely flow between the application and the IDM solution via Active Directory (or other repository source). There is support and maintenance (usually 20% of the purchase price paid annually). There are the professional services to install and configure the connectors. There is the cost of development, time-to-market gaps, and the added burden of doing this multiple times for each SaaS and web-based application.

Yet, by deploying a complimentary IDaaS (identity-as-a-service) strategy, all of the above costs, services and deployment difficulties are considerably reduced or eliminated, while still promoting the necessary security gravitas to assert control, streamline workflow and optimize IT resources. As part of the IDaaS arsenal, most of the popular federated connectors are already available out of the box. IDaaS managed from the cloud also extends its scope to those Non-SAML based application (web-based) through an identity gateway. So, no development costs, no additional licenses, and professional services shrink to a minimum. By creating this umbrella over your virtual footprint, the ability to automatically provision and deprovision user accounts extends to these new applications as seamlessly as if they were parked on-premise. Additionally, creating a parallel-yet-integrated identity manager allows for seamless integration with single sign on. This unique cloud-controlled advantage enforces corporate access policy decisions across the enterprise and puts IT back in control of the IT landscape. It eliminates the potential for Shadow IT applications, BYOD abuse and enables better productivity.

The notion is not to reinvent the wheel, but to expand the metaphor, change out the tires for all-terrain use.  If an organization has spent millions to create a viable identity management system, it is unlikely they will abandon the project to put the entire administration and management in the cloud. However, it is prudent to create a cost-effective, enterprise grade equivalent to integrate new applications, multiple data stores and “outside,” users accounts into a secure and controlled environment. In short, it consolidates the variables into a manageable, automated and centralized strategy without incurring additional resources and runaway costs.

Some call this a hybrid strategy. Regardless of the label, a strategy that extends your capability to authenticate, attest and authorize user names, passwords and permissions beyond your firewall will only strengthen you defense against breach, unwanted usage and data leakage from insider threats. In that it can be done with minimal disturbance and without deep pocket spending makes this all the more attractive and practical.

The automations inherent in IDaaS also facilitates stronger compliance…especially when it comes to monitoring the SaaS and web applications. Instead of an infrequent review of logs real time reports can be instantaneously generated to see exactly who accessed what application. But the cornerstone of compliance is to monitor if any changes were made, especially to access protocols (passwords, user names etc…). IDaaS can note in real time when any attribute changes, who made the change and who approved the change. This is a standard compliance audit requirement.

The proliferation of SaaS and web-based applications has changed the security quotient. Leaving these applications partially secured still leaves them partially unsecured. IDaaS allow you to close those vulnerability gaps. Despite best efforts, network perimeters have all but disappeared. All too often, because of multiple data stores and the virtual left hand does not know what the right is doing.

As noted earlier, your IT environment continues to expand and contract. Just consider the lifecycle of the different users that need to access different applications. New hires, promotions, demotions, firings, new partners, new customers, latent customers-- each instance requires some modification to their identity rights.  Does Chuck, who used to be in your accounting department still have his active user credentials? Has Rachel who hasn’t ordered from your site in 3 years had her account retired? How easy would it be for Chuck, Rachel or some nefarious account takeover hacker using their stolen credentials to create significant havoc on your network? It’s a significant task and greater responsibility to find each data store they have been given access and deprovision, However,  IDaaS can turn off or modify any user account instantly-both in the cloud and through on-premise systems through its connection to Active Directory (or LDAP, AS/400, MySQL, Solaris, RedHat, etc…).

Now multiply the above scenario by 500 or 5000 users a day for a modest enterprise when creating users, resetting passwords and permission sets and you begin to recognize the significant advantages and efficiencies a centralized and augmented with the cloud identity rights management and access control system provide. And the larger the organization, the more complex these data islands are to resolve.

Stronger forms of authentication and authorization need to be deployed in response to the growing threats.  Using an IDaaS and SSO combination from the cloud is a proactive step towards consolidating all the variables and cost-effectively strengthening your identity defenses.

Kevin Nikkhoo
www.cloudaccess.com

More Stories By Kevin Nikkhoo

With more than 32 years of experience in information technology, and an extensive and successful entrepreneurial background, Kevin Nikkhoo is the CEO of the dynamic security-as-a-service startup Cloud Access. CloudAccess is at the forefront of the latest evolution of IT asset protection--the cloud.

Kevin holds a Bachelor of Science in Computer Engineering from McGill University, Master of Computer Engineering at California State University, Los Angeles, and an MBA from the University of Southern California with emphasis in entrepreneurial studies.

Cloud Expo Breaking News
Scott Jenson leads a project called The Physical Web within the Chrome team at Google. Project members are working to take the scalability and openness of the web and use it to talk to the exponentially exploding range of smart devices. Nearly every company today working on the IoT comes up with the same basic solution: use my server and you'll be fine. But if we really believe there will be trillions of these devices, that just can't scale. We need a system that is open a scalable and by using the URL as a basic building block, we open this up and get the same resilience that the web enjoys.
Cloud Computing is evolving into a Big Three of Amazon Web Services, Google Cloud, and Microsoft Azure. Cloud 360: Multi-Cloud Bootcamp, being held Nov 4–5, 2014, in conjunction with 15th Cloud Expo in Santa Clara, CA, delivers a real-world demonstration of how to deploy and configure a scalable and available web application on all three platforms. The Cloud 360 Bootcamp, led by Janakiram MSV, an analyst with Gigaom Research, is the first bootcamp that introduces the core concepts of Infrastructure as a Service (IaaS) based on the workings of the Big Three platforms – Amazon EC2, Google Compute Engine, and Azure VMs. Bootcamp attendees will get to see the big picture and also receive the knowledge needed to make the best cloud decisions for their business applications and entire enterprise IT organization.
The Internet of Things is a natural complement to the cloud and related technologies such as Big Data, analytics, and mobility. In his session at Internet of @ThingsExpo, Joe Weinman will lay out four generic strategies – digital disciplines – to exploit emerging digital technologies for strategic advantage. Joe Weinman has held executive leadership positions at Bell Labs, AT&T, Hewlett-Packard, and Telx, in areas such as corporate strategy, business development, product management, operations, and R&D.
SYS-CON Events announced today that DevOps.com has been named “Media Sponsor” of SYS-CON's “DevOps Summit at Cloud Expo,” which will take place on June 10–12, 2014, at the Javits Center in New York City, New York. DevOps.com is where the world meets DevOps. It is the largest collection of original content relating to DevOps on the web today Featuring up-to-the-minute news, feature stories, blogs, bylined articles and more, DevOps.com is where the thought leaders of the DevOps movement make their ideas known.
There are 182 billion emails sent every day, generating a lot of data about how recipients and ISPs respond. Many marketers take a more-is-better approach to stats, preferring to have the ability to slice and dice their email lists based numerous arbitrary stats. However, fundamentally what really matters is whether or not sending an email to a particular recipient will generate value. Data Scientists can design high-level insights such as engagement prediction models and content clusters that allow marketers to cut through the noise and design their campaigns around strong, predictive signals, rather than arbitrary statistics. SendGrid sends up to half a billion emails a day for customers such as Pinterest and GitHub. All this email adds up to more text than produced in the entire twitterverse. We track events like clicks, opens and deliveries to help improve deliverability for our customers – adding up to over 50 billion useful events every month. While SendGrid data covers only abo...
SYS-CON Events announced today that the Web Host Industry Review has been named “Media Sponsor” of SYS-CON's 15th International Cloud Expo®, which will take place on November 4–6, 2014, at the Santa Clara Convention Center in Santa Clara, CA. Since 2000, The Web Host Industry Review has made a name for itself as the foremost authority of the Web hosting industry providing reliable, insightful and comprehensive news, reviews and resources to the hosting community. TheWHIR Blogs provides a community of expert industry perspectives. The Web Host Industry Review Magazine also offers a business-minded, issue-driven perspective of interest to executives and decision-makers. WHIR TV offers on demand web hosting video interviews and web hosting video features of the key persons and events of the web hosting industry. WHIR Events brings together like-minded hosting industry professionals and decision-makers in local communities. TheWHIR is an iNET Interactive property.
SYS-CON Events announced today that O'Reilly Media has been named “Media Sponsor” of SYS-CON's 15th International Cloud Expo®, which will take place on November 4–6, 2014, at the Santa Clara Convention Center in Santa Clara, CA. O'Reilly Media spreads the knowledge of innovators through its books, online services, magazines, and conferences. Since 1978, O'Reilly Media has been a chronicler and catalyst of cutting-edge development, homing in on the technology trends that really matter and spurring their adoption by amplifying "faint signals" from the alpha geeks who are creating the future. An active participant in the technology community, the company has a long history of advocacy, meme-making, and evangelism.
SYS-CON Events announced today that Verizon has been named “Gold Sponsor” of SYS-CON's 15th International Cloud Expo®, which will take place on November 4–6, 2014, at the Santa Clara Convention Center in Santa Clara, CA. Verizon Enterprise Solutions creates global connections that generate growth, drive business innovation and move society forward. With industry-specific solutions and a full range of global wholesale offerings provided over the company's secure mobility, cloud, strategic networking and advanced communications platforms, Verizon Enterprise Solutions helps open new opportunities around the world for innovation, investment and business transformation. Visit verizonenterprise.com to learn more.
SYS-CON Events announced today that TMCnet has been named “Media Sponsor” of SYS-CON's 15th International Cloud Expo®, which will take place on November 4–6, 2014, at the Santa Clara Convention Center in Santa Clara, CA. Technology Marketing Corporation (TMC) is the world's leading business to business and integrated marketing media company, servicing niche markets within the communications and technology industries.
"In my session I spoke about enterprise cloud analytics and how we can leverage analytics as a service," explained Ajay Budhraja, CTO at the Department of Justice, in this SYS-CON.tv interview at the 14th International Cloud Expo®, held June 10-12, 2014, at the Javits Center in New York City. Cloud Expo® 2014 Silicon Valley, November 4–6, at the Santa Clara Convention Center in Santa Clara, CA, will feature technical sessions from a rock star conference faculty and the leading Cloud industry players in the world.
“We are starting to see people move beyond the commodity cloud and enterprises need to start focusing on additional value added services in order to really drive their adoption," explained Jason Mondanaro, Director of Product Management at MetraTech, in this SYS-CON.tv interview at the 14th International Cloud Expo®, held June 10-12, 2014, at the Javits Center in New York City. Cloud Expo® 2014 Silicon Valley, November 4–6, at the Santa Clara Convention Center in Santa Clara, CA, will feature technical sessions from a rock star conference faculty and the leading Cloud industry players in the world.
"We are automated capacity control software, which basically looks at all the supply and demand and running a virtual cloud environment and does a deep analysis of that and says where should things go," explained Andrew Hillier, Co-founder & CTO of CiRBA, in this SYS-CON.tv interview at the 14th International Cloud Expo®, held June 10-12, 2014, at the Javits Center in New York City. Cloud Expo® 2014 Silicon Valley, November 4–6, at the Santa Clara Convention Center in Santa Clara, CA, will feature technical sessions from a rock star conference faculty and the leading Cloud industry players in the world.
Almost everyone sees the potential of Internet of Things but how can businesses truly unlock that potential. The key will be in the ability to discover business insight in the midst of an ocean of Big Data generated from billions of embedded devices via Systems of Discover. Businesses will also need to ensure that they can sustain that insight by leveraging the cloud for global reach, scale and elasticity. In his session at Internet of @ThingsExpo, Mac Devine, Distinguished Engineer at IBM, will discuss bringing these three elements together via Systems of Discover.
The Internet of Things promises to transform businesses (and lives), but navigating the business and technical path to success can be difficult to understand. In his session at 15th Internet of @ThingsExpo, Chad Jones, Vice President, Product Strategy of LogMeIn's Xively IoT Platform, will show you how to approach creating broadly successful connected customer solutions using real world business transformation studies including New England BioLabs and more.
All too many discussions about DevOps conclude that the solution is an all-purpose player: developer and operations guru, complete with pager for round-the-clock duty. For most organizations that is not the way forward. In his session at DevOps Summit, Bernard Golden, Vice President of Strategy at ActiveState, will discuss how to achieve the agility and speed of end-to-end automation without requiring an organization stocked with Supermen and Superwomen.