Chief Security Officer's AWS Cloud Security Wishlist
•Transferir como PPTX, PDF•
1 gostou•137 visualizações
O documento discute as preocupações e desejos de um Chief Security Officer (CSO) em relação à segurança na nuvem. O CSO deseja ter garantias de segurança total e não se preocupar com violações, além de ser visto como facilitador e não como empecilho. O documento também resume os papéis do CSO e como ele pode ter sucesso na era da nuvem trabalhando de forma coordenada com o provedor de nuvem.
Recomendados
Recomendados
Mais conteúdo relacionado
Mais procurados
Mais procurados (20)
Semelhante a Chief Security Officer's AWS Cloud Security Wishlist
Semelhante a Chief Security Officer's AWS Cloud Security Wishlist (20)
Mais de Amazon Web Services LATAM
Mais de Amazon Web Services LATAM (20)
Chief Security Officer's AWS Cloud Security Wishlist
- 1. Lista de desejos de um Chief Security Officer Nelson I. Sakai Enterprise Solutions Architect
- 2. Quem sou eu? • Enterprise Solutions Architect na AWS; • Trabalhando com soluções de Nuvem desde 2010; • Experiência de vários anos em TI, em diversas posições de suporte, consultoria, pre-vendas, arquitetura e gerência; • Atuação em diversas indústrias, como Finanças, Telco, Varejo, Governo e Manufatura.
- 3. Afinal de contas, estou, ou não estou seguro na Nuvem AWS??
- 4. Na AWS, a segurança da cloud é prioridade zero. Todos clientes AWS se beneficiam de uma arquitetura de datacenter e rede, construídas para satisfazer os requerimentos das organizações mais sensíveis a segurança.
- 5. Lista de Desejos do Chief Security Officer 1. Ganhar mais, trabalhar menos, ter menos responsabilidade (como todo mundo!!!). Migrar para AWS e passar a bola da segurança para eles… 2. Ter a garantia de que seu ambiente estará 100% seguro, independente das ações do TI, arquitetos, desenvolvedores, áreas de negócio, shadow IT, usuários… 3. NÃO acordar no meio da noite, sonhando que seu ambiente foi violado; 4. Pior, não acordar no meio da noite, recebendo a notícia de que seu ambiente foi comprometido; 5. Ser percebido como um facilitador e um elemento chave, e não como uma trava ao negócio da empresa.
- 6. Papel do Chief Security Officer (na visão do povo…) N-Ã-O!!
- 7. Papel do Chief Security Officer (na visão do Chief Security Officer…) • Garantir que, de forma alguma, a segurança do ambiente seja colocada sob risco, seja por ataques externos, seja por mudanças internas • Guardião do patrimônio da empresa, e da paz mundial… • Contra tudo e contra todos… • Incompreendido!!
- 8. Papel do Chief Security Officer (bem sucedido na era da Nuvem…) • Garantir que os mecanismos de segurança e compliance sejam 100% eficazes e, ao mesmo, tempo, permitir que as inovações e mudanças ocorram no rítmo requerido pela área de negócio; • Fazer melhor uso das funcionalidades de segurança oferecidas pelo provedor de nuvem, atuando de forma coordenada, no modelo de responsabilidade compartillhada; • Viabilizar a inovação com segurança e agilidade, e não barrá-la, por falta de segurança.
- 9. Fonte: Gartner Group Clouds are secure: are you using them securely? “CIOs e CISOs precisam parar sua obcessão com questões não fundamentadas sobre a segurança na nuvem, e, ao invés disso, aplicar sua imaginação e energia para desenvolver novas abordagens para controle na nuvem, permitindo-lhes usufruir de forma segura, aderente e confiável dos benefícios deste modelo de computação cada vez mais universal.” Para tanto…
- 10. Você sabia que…? 20% das aplicações são construídas em arquiteturas cloud-friendly e estão prontas para nuvem. Fonte: Right Scale Gastos com infraestrutura de TI na nuvem, alcançarão US$54.6 bilhões em 2019, respondendo por 46.5% do total de gastos com infraestrutura de TI. Fonte: IDC
- 11. O mundo não é (mais) plano
- 13. Desafios de Segurança no Data Center Diversos grupos diferentes Diversas ferramentas diferentes Nada falando a mesma linguagem
- 14. Preocupações com “Segurança na Nuvem” Ferramentas Controles de Segurança Compliance
- 15. O que temos ouvido de nossos clientes • Talento – Talentos em engenharia e automação é um dos maiores desafios expressados pelos CISOs em todas as 4 mesas redondas de CISOs em 2015 (re:Invent, NYC, SFO, IAD) • Requerimentos Regulatórios e Contratuais – tempo de notificação de violação, liability, direitos de auditar, alinhamento de padrões • Como eu começo? Mudanças no modelo de operação? – DevOps & como eu faço isso e mantenho separação de responsabilidades? CISOs não querem ter múltiplas ferramentas, interfaces e contratos com fornecedores • Parceria maior – integrando SOC, mitigação de DDoS, suporte a auditoria, residência, serviços gerenciados, compartilhamento de inteligência de ameaças
- 16. Princípios de Design para Arquiteturas de Cloud Menos é mais • Simplicidade de design, de APIs, de interfaces e fluxo de dados o ajudarão a conseguir um sistema escalável e seguro. Automatize • Pense na sua infraestrutura como baseada em código – este é um game changer. • Teste, faça protótipos rápidos e implemente métodos de deployment baseados em API, totalmente automatizados Faça a coisa certa • Projete para reuso de código e informação de configuração centralizada, para reduzir a superfície de ataque ao mínimo. • Sanitize e criptografe. • Não confie na verificação do lado cliente; garanta tudo em todas as camadas.
- 17. Mensagens ao Chief Security Officer O que você precisa saber sobre a AWS
- 18. Mensagem 1: A AWS é o líder Global em Segurança e Compliance na Nuvem • A AWS tem o mais antigo, e mais extenso portfolio de segurança do mercado • Nós inovamos, de forma abrangente e profunda, em funções de controle, para ajudar nossos clientes a atingirem suas necessidades de compliance • Nossas features de segurança, tornam a migração para nuvem AWS, uma opção superior de controle no gerenciamento de compliance
- 19. Mensagem 2: Compliance é uma responsabilidade conjunta • Nossos próprios programas provêm transparência de que a segurança é prioridade #1 para AWS • Nós não paramos de inovar nossas capacidades avançadas de segurança e compliance – nós inovamos as suas também • Isto faz da AWS o melhor lugar para worklods sensíveis, controlados e regulados
- 20. Mensagem 3: Nosso investimento cria um ganho imediato para você • Responsabilidade compartilhada em compliance significa que você pode migrar imediatamente seus investimentos de segurança física, para segurança na aplicação • Todo o trabalho que nós fazemos para compliance podem ser aproveitados pelos seus times de risco e compliance, hoje • O sucesso de nosso trabalho, significa menos trabalho para você
- 21. Mensagem 4: Compliance deve ser um tópico prioritário de engajamento • Compliance deve ser um tópico prioritário de engajamento • Organizações de compliance necessitarão de um engajamento apropriado, logo no início • Nós podemos e iremos pavimentar o caminho para mover os workloads mais sensíveís para AWS – precisamos engajar as pessoas certas logo no início
- 22. Endereçando a segurança na Nuvem • Gestão de Identidade & Accesso • Logging & Monitoração • Infraestrutura de Segurança • Proteção de Dados • Resiliência • Resposta a Incidentes • Validação de Conformidade • CI/CD Seguros (DevSecOps) • Análise de Configuração e Vulnerabilidade • Big Data e Análise preditiva de Segurança
- 24. Sua Organização Times de Projeto Marketing Unidades de Negócio Reporting Web & Mobile Dev / Test Analytics Apps Enterprise internas Amazon S3 Amazon Glacier Storage/ Backup Melhor prática #1 de Segurança em larga escala Segmente seu ambiente AWS
- 25. • Multi-factor authentication • Federação e single sign-on • Controle de Acesso Fine-grained • Restrinja acesso humano AWS account owner Network management Security management Server management Storage management Melhor Prática #2 Controle acesso, segregue responsabilidades
- 26. • AWS CloudTrail • API e console usage • AWS Config • Histórico de infraestrutura e mudanças • Amazon CloudWatch • Métricas de recursos e monitoração de logs • AWS Billing e Gerenciamento de Custo Melhor Prática #3 Monitore comportamentos inesperados
- 27. Desafios e Soluções (AWS Config/Config Rules) Desafio • Gerenciar mudança e configuração em escala Solução • AWS Config Detalhes • View de Time-series de cada mudança feita na infraestrutura. • O AWS Config Rules permite que você tome ações sobre mudanças para garantir que a mudança esteja em conformidade com seus padrões de segurança e compliance. Clientes – T-Mobile, J&J, Merck, NASDAQ, Burt e British Gas
- 28. Desafios e Soluções (AWS CloudTrail e Amazon CloudWatch) Desafio • Tomar ações de auditoria, englobando todo o stack de TI, de forma simples e com custo baixo. Solução • AWS CloudTrail e CloudWatch Detalhes • Auditoria de alta fidelidade • Lugar único para logar eventos em todo o stack de infraestrutura. • Disruptivo, barato, integra com o Elastic Search gerenciado para solução completa. Clientes de referência– Aire, Supercell, Veolia Water (French)
- 29. Desafios e Soluções (Amazon IAM) Desafio • Configurar corretamente o least privilege access. Solução • Amazon IAM Detalhes • Suporte a federação e enterprise roles • Autorização Fine-grained • Governança - Access Advisor, Policy Simulator, Credentials Report
- 30. Desafios e Soluções (Amazon Inspector) Desafio • Integração da segurança no delivery de soluções de TI e na qualidade de código Solução • Amazon Inspector Detalhes • O Inspector é melhor utilizado desde o início no DevOps e nos processos de delivery de TI. • Encontra problemas comuns e configurações inadequadas antes de fazê-lo em produção • Como toda solução AWS, é baseado em APIs para que você possa automatizar totalmente o assessment de aplicações e o workflow envolvendo qualquer descoberta.
- 31. Desafios e Soluções (AWS WAF) Desafio • Construir uma postura de segurança de rede, global com escala e velocidade. Solução • AWS Web Application Firewall Detalhes • Parte chave da arquitetura holística de serviços de borda • Distribuído globalmente • Acesso programático Clientes de referência – ConnectWise, Glide, Magazine Luiza e Trend Micro
- 32. Desafios e Soluções (Arquiteturas baseadas em API) Desafio • Arquiteturas de TI tradicional possuem diversas interfaces e área de superfície para tornar seguros Solução • Nas arquiteturas que somente utilizem serviços de API significam que você foque numa quantidade mínama de superfície de contato possível Detalhes • Serviços como Lambda, DynamoDB, S3 e SNS estão fundamentalmente mudando tanto o modo como as aplicações são construídas, como também a simplicidade com a qual elas são tornadas seguras. A AWS está não só liderando, como também inventando a tendência.
- 34. Visibilidade do CxO em escala CISO CIO COO CFO
- 35. Sumarizando Simplicidade & visibilidade = escala SecOps: fazer mais com menos CxO: Visibilidade & compliance
- 36. Cookbook do Rock Star de Segurança AWS 1. Conhecimento específico AWS • https://aws.amazon.com/security 2. Analytics: Inteligência de Threat; análise de logs em escala • https://aws.amazon.com/big-data 3. DevSecOps: A habilidade de resoponder rapidamente e continuamente às ameaças conforme elas surgem • https://aws.amazon.com/training/course-descriptions/devops-engineering
- 37. OBRIGADO!!
Notas do Editor
- Before we get into today’s discussion. I want to share a little bit about myself. I’m currently the VP of Security/CISO for Sumo Logic, a cloud-native data analytics provider based in the Silicon Valley. Here I’m responsible for the protecting the data of our customers and employees. I have more than 17 year of experience establishing policy management around security metrics and incident response initiatives. I hold a patent for the creation of SecureWorks’ Anomaly Detection Engine (now part of Dell)
- Also, mention the IDC whitepaper: “Assessing the Risk: Yes, the Cloud can be More Secure than your On-Premises Environment” --Pete Lindstrom, June 2015
- Also, mention the IDC whitepaper: “Assessing the Risk: Yes, the Cloud can be More Secure than your On-Premises Environment” --Pete Lindstrom, June 2015
- As many of you know, there is still an innate fear of using the cloud for security purposes. Many security practioners and organizations are struggling to understand how to control security in a cloud-based world, but consider the following stats: According to the State of the Cloud Cloud Survey 2015 by Right Scale, while cloud adoption is growing quickly, most enterprises (68 percent) run less than 20 percent of their workloads in the cloud. However, they report plenty of headroom to move additional applications to the cloud. A majority (55 percent) of respondents report that at least another 20 percent of applications are built on cloud-friendly architectures and are ready for cloud. http://www.rightscale.com/blog/cloud-industry-insights/cloud-computing-trends-2015-state-cloud-survey According to a report by Cisco, by 2018, 59% of the total cloud workloads will be Software-as-a-Service (SaaS) workloads, up from 41% in 2013. Cisco is predicting that by 2018, 28% of the total cloud workloads will be Infrastructure-as-a-Service (IaaS) workloads down from 44% in 2013. 13% of the total cloud workloads will be Platform-as-a-Service (PaaS) workloads in 2018, down from 15% in 2013. The following graphic provides a comparative analysis of IaaS, PaaS and SaaS forecasts from 2013 to 2018. Source: Cisco Global Cloud Index: Forecast and Methodology, 2013–2018 According to IDC, the five-year forecast period, IDC expects that cloud IT infrastructure spending will grow at a compound annual growth rate (CAGR) of 15.6% and will reach $54.6 billion by 2019 accounting for 46.5% of the total spending on IT infrastructure. http://www.idc.com/getdoc.jsp?containerId=prUS25732415
- Operationally, security organizations need to change their thinking and processes from traditional data center-centric (what I’m now calling “flat Earth”) models to new, more statistical models. For example, we exchange hands-on control over physical hardware with odds over a population of hardware. From a systems administration perspective, we exchange scripts and manual capacity planning and scaling with API calls, triggers, feedback loops, and the automatic provisioning and de-provisioning of spot-bid compute resources. And, of course, from a security perspective, we face the challenge of a world that is not under our complete physical control.
- 176/5000 MIT Sloan School há 20 anos disse que a vantagem competitiva sustentável é a meta de negócios / Graal. Agora isso não é mais acessível e o novo pote de ouro é o Inovação Contínua Ciclo de empresas na na top 500 do mercado, anteriormente ciclo maior hoje o ciclo é menor. A inovação continua força a renovação. Anteriormente, empresas se mantinham na forbes 500 por vantagem competitiva e não por inovação.
- Adam: What have been your top security architecture & technology challenges in a large scale data center deployment? Jim: TOP CONCERN: Lots of different groups with lots of different tools, NOTHING SPEAKING THE SAME LANGUAGE From experience in many data centers, many corporations No matter what – enforcement is a challenge co-location challenges of hardware Cages and closed circuit cameras. Lots of people managing hardware, specialized appliances Previous companies: pull connectivity to find owners Innovator’s dilemma: Automate (APIs) vs. investment justification Adam: Wow – lots of different groups, all with their own technology choices and APIs, lots of different hardware and software tools, including security tools, and a ton of complexity to get all of this speaking the same language. Seems to be a difficult barrier to overcome.
- Adam: Here you are, protecting your data center with lots of groups, lot of security tools, nothing speaking the same language Decision at Infor is to become a CLOUD-FIRST COMPANY Unknowns, unchartered territory, As the CISO of Infor, ready to embark on this journey, what were your top of mind security architecture and technology concerns with not only “security in the cloud”, but “large-scale security” in the cloud? I mean, you’re already dealing with an environment that doesn’t speak the same language, now this! How did you go about getting all of this figured out? Jim: “Trust, but Verify” TOP 3 CONCERNS: (1) security controls (2) security tools, and (3) Compliance Security controls: ISO 27001/27002, or NIST800-53 More than software: process, procedures, people e.g. background checks Tools: Trusting the tools, technology and hardware of a cloud provider like AWS finding appropriate tools to help securely manage the virtual environment Needed the ability focus on the security of the environment rather than the AWS infrastructure. Compliance: Numerous regulatory and contractual compliance requirements Had to be sure our vendor of choice could meet those requirements. I didn’t want my compliance team to be caught up in auditing our provider. Adam: Jim, I get it how those would be any CISO’s top concerns: Security control parity, tools .. Some which were hardware, and of course, compliance. Clearly, these are fair concerns and I’m sure many of our audience would share these concerns!
- AWS certifications are good news for customers, providing additional transparency and independent assurance that we follow internationally-recognized cloud security practices. However, certifying that we follow yet another best practice won’t come as a surprise; we’ve already proven information security is job #1 here at AWS. We have made massive investments in protecting customer data at the highest security levels; an investment that you, our customers, inherit when using our services. Global customers from a wide range of regulated industries (including healthcare, life sciences, federal and state governments, financial services, and public safety) continue to accelerate their use of AWS for the most critical and regulated workloads. While an announcement of a new AWS certification is a win for customers, our innovation is not limited only to building and operating our own advanced security and compliance capabilities. We are focused on taking this to another level by scaling the investment, innovation, automation and those same best practices to you, our customers, through our cloud services. Innovative new cloud security features such as AWS Inspector, AWS WAF (Web Application Firewall), and AWS Config Rules can give you a significant boost in your ability to manage security and establish reliable and ubiquitous controls in your AWS environment. This gains you a material lift in managing security risk, enabling you, whatever your requirements may be, to obtain your own certifications and manage compliance in a comprehensive and transparent manner. This makes the AWS environment more secure than any other environment, making it the best place for sensitive, controlled, and regulated workloads. We routinely attain certificates, demonstrating we have a world-class security program, but more importantly we want you to have a world-class security program as well.
- Compliance should be a standing topic of conversation It needs to be a topic of conversation, and let’s make sure it’s a discussion on the table. Compliance organizations will need proper engagement, in advance Compliance teams need to be educated about the cloud. We need to resolve their concerns. We might need proper legal terms in our EA. They need to adapt their risk and compliance frameworks and do their due diligence on the move to the cloud and the reliance on AWS to operate those controls. They need to know how to handle regulators. This is all very doable, but it generally takes time. The more heavily regulated, the more time it takes. We can and will pave the way to move the most sensitive workload to AWS – we need to engage the right people early on We’d like to engage the people responsible for these activities now, so we can get that ball rolling. We need to engage our SAs and Proserve to help you figure this out.
- Leave no trace Host FW IDS, FIM, WAF/DLP Encrypt it all Continuous Compliance Everyone's security is bad because they can't get their fundamentals right. ANTHEM: The Math of Fundamentals. A security philosophy that took me over ten years to evolve, and yet it’s all totally basic- common sense- simplicity itself: Default deny absolutely everything. Know exactly every service you need to run, what ports it needs, what it’s vulnerabilities are, what patch level it’s at and what OS privileges it needs. Then tie each of those services to a user. Every Port locked down to that user, and each users permissions locked down to the bare minimums. Then firewall every single box to only talk to it’s essential peers on the allowed ports. Everything white-listed and default deny. Anything out of spec is dropped and alerted. File integrity monitoring everywhere on all binaries and config files. Every connection is encrypted. All encryption keys are rotated every 24 hours. Good philosophy, right? Nothing but fundamentals. Totally basic. Does anyone do that? Nobody I can think of, because any ops person will tell you it is totally unrealistic. Too many servers with too many services talking to too many other servers also running too many services, and only so many guys with unix beards and clipboards who could run around and run the 30 bash scripts you needed to run in order to do the basic hardening. So all of our fundamentals suck.
- In the same way that you segment your own environments today, you can segment your virtual networks within your AWS environment. You can define which networks get Internet access and which don’t, You can define access control lists to restrict what traffic goes where. You can define user groups and define who gets access to what. The big difference in AWS is the amount of time and money it takes to do this. You don’t have to buy and manage a whole lot of hardware to get this done. You just need to define the policies of what traffic needs to go where, and what shouldn’t
- With AWS Identity and Access Management tools you get to define which of your users get to do what – in the same was as you define role-based access controls within your environment today. You can use hardware token based or software/mobile based multifactor authentication to add an extra level of assurance for your more sensitive applications, This can all integrate with your on premises environment by integrating with your existing corporate directory, and implementing federation and single sign on so that this becomes a seamless experience for your customers.
- Config Rules launched on Dec 18, so we’re still gathering use cases that we can reference externally. Here are some stories I’ve been working on with customers Security: T-mobile security has codified several of their recommendations for configuring AWS resources as Config Rules using Lambda functions. They are using these rules to ensure their developers are following best practices, such as using the appropriate AMIs with instances, IAM policies with expected permissions. They no longer need to maintain infrastructure to execute these rules or store the results of compliance. All of this is managed by AWS Config Rules and available via APIs and the security team gets notified when a rule or resource becomes non-complaint. They can decide to cut a ticket or take appropriate actions. Compliance in Healthcare: We have noticed quite a bit of interest from the healthcare/pharma vertical. J&J, BMS, Merck have used AWS Config to record a history of all their configurations for compliance assessment. They are required to have access to this configuration data for 7+ years for GxP compliance. Some customers are looking at using rules too. For example, a customer subject to HIPAA has written a rule that ensures all instances are using dedicated tenancy. Ease of use: Nasdaq is a Config Rules customer using rules to ensure resources are tagged consistently. They are in early stages of rolling this out across their accounts into production. They find Config Rules to be an effective and easy mechanism to ensure tags are consistent. It’s important to note that they are using managed rules. This implies AWS owns and maintains the code to ensure these rules are working correctly. Nasdaq simply configured them correctly the first time. This “hands off” use case is appealing to several customers who no longer want to invest in maintaining home-grown solutions to monitor configuration changes for compliance. We have two external facing case studies on core-config (i.e. not rules) . The customers that have official case studies are Burt and British Gas. We are working on Config Rules, but external reference for rules will almost certainly not be available in time for SKO.
- EMEA/france: http://aws.amazon.com/fr/solutions/case-studies/veolia-water/ (french language) EMEA/Aire: http://aws.amazon.com/solutions/case-studies/aire/ EMEA/Nordics: https://aws.amazon.com/solutions/case-studies/supercell/ Supercell - To monitor, manage, and control its environment, Supercell uses a range of tools in the AWS Console. Amazon CloudWatch and AWS CloudTrail allow it to monitor the current environment and give it a detailed log of all actions in the development and production environments. “The AWS API is one of the most important services for us—we use it a lot,” Yliharju says. “For example, the API commands allow us to easily manage and boot up new servers and even run full load-testing environments to simulate different situations and determine our capacity needs.” Aire - “We quickly saw that building a redundant infrastructure with AWS tools would be easy," says Kimball. "On the security side, it was trickier. Our financial-services clients all have different but very high security expectations, so from the start we looked to AWS to help us find the right security levels. Plus, we needed a platform that we could use to anticipate customer requirements, not just now, but into the future, too.”From a security perspective, AWS Identity and Access Management (IAM) allows the startup to create, track, and manage users within AWS. AWS CloudTrail records API calls, while monitoring service Amazon CloudWatch helps Aire to monitor log files and set alerts. AWS Key Management Service (KMS) controls encryption keys and also integrates with Amazon RDS and CloudTrail, providing logs that enable the firm to meet its compliance needs.
- CONNECTWISE - “With AWS WAF we have been able to completely hand these [traffic]concerns to Amazon. When we detect anomalies in our traffic we can protect our quality of service by blocking this traffic at the edge nodes across the world. This traffic no longer touches our infrastructure at all and is handled by CloudFront near the point that the traffic is generated.”– Robert Isaacs (Co-founder), Chief Software Architect, ConnectWise GLIDE - “Protecting our open sites and even API's is of course great in protecting and blocking attacks, however what it does more is a dramatically improvement to the reliability of our monitoring and alert systems. The attacks and hacking efforts are creating noise in our system that often leads to false positives. Integrating WAF allows us to focus on the real issues.– Roi Ginat (Co-founder), Glide Talk TREND MICRO - “[AWS WAF] is a fantastic new service that you should be looking to add to your deployment asap.” – Mark Nunnikhoven (Vice President, Cloud Research), Trend Micro Trend Micro: Deep Security IP Lists to AWS WAF IP Lists: https://github.com/deep-security/aws-waf Webinar: Defending Your Workloads with AWS WAF and Deep Security
- [TODO] – analysis of why this is true – compare and contrast [TODO] Address the objection to this vision which is “I can’t rewrite all my apps.”
- Adam: Excellent training Matt, thank you. OK, now’s let move to true business impact How Infor’s leaders, the officers of the company, have improved visibility In terms of security, procurement, cost, alignment, and compliance Let’s have a look at how visibility of the business has changed for for the CISO, CIO, COO, and finally the CFO since moving to the cloud…
- Adam (CISO QUESTION): Jim, let’s start with you, as the CISO, What’s the top visibility improvement for you. Jim (CISO ANSWER): Our security visibility is night and day now Now in the inner circle. For example, Trend Micro – new systems, policy exceptions Old days – IN THE WAY, New way: teams move faster to the cloud, SETTING DIRECTION Before we found out through back channels, now we get called in way in advance to help out. Inner circle: AWS aware tools enable collaboration with all cloud teams Adam (CIO QUESTION): Wow – it seems you are now critically involved in setting the direction, where before, you may have felt as more like a passenger. How about the CIO, what do you believe is the CIO’s biggest benefit? Jim (CIO ANSWER): Network segmentation & Appling unique security control requirements to each environment (ITAR vs. demo system) Elimination of Rogue IT Servers underneath desks, now instances jump out at you Auto protection when auto-scaling with our security stack (Trend Micro’s Deep Security) Use AWS as another tool Demo networks and other extreme special security Adam (COO Question): That’s a great news story for any CIO out there. How about the COO, what’s improvements have occurred in the compliance and governance arena? Jim: (COO Answer): Improved rhythm and efficiency of compliance activities Reliance upon the maturity of the AWS compliance activities Single pane of glass Supporting audits It keeps the auditors out of our network, reducing scope AUDITORS APPRECIATE THIS Adam (CFO Question): It sounds like some outstanding benefits to both your COO and to the auditors. And I can appreciate how that helps with scale as well. Finally, how about the CFO in terms of cost management, routing to various cost centers, to help measure and manage the business health of each group? Can you also speak to the security costs as well? Jim (CFO Answer): Rogue IT to fiscally responsible culture Amazing cultural transformation You can see cost easily and directly by using AWS accounts and running reports AWS APIs allows you to automate shutting down inactive instances Cost savings in terms of reduction of tools Don’t require multiple agreements with multiple vendors Adam: That’s amazing that there’s a cultural shift from procuring off the books to be agile, to now having teams be fiscally more responsible and turning down their workloads when they are now using them.
- Adam summarizes the takeaway: Theme in Infor’s journey: Simplicity enables scalability: tool reduction, standard exchange of security data, segmentation, speaking the same language Visibility enables scalability: The “Single pane of glass” with Infor’s security stack enables them to continue to scale at a rapid rate. Large Enterprises can scale their security operations teams while moving up the value chain and increasing their visibility. Once, there, they are a key part of the Cloud Operations team. You have also seen the cookbook to get them on their way. The Cloud Security teams can be part of the inner circle and add tremendous value to the overall cloud operations CxOs have more visibility in terms security, IT operations, procurement, compliance, governance, costs, profitability giving them a competitive advantage over their peers who remain in the data center. Compliance and auditors work more effectively together, reducing time, and allowing your business to move faster.
- Adam: Matt, we just heard from Jim about Infor’s journey in terms of operations teams, skills, and training? What are some of the new roles and skills that AWS recommends for customers looking to deploy at large scale should follow? Matt: Answers the question. Adam: Thanks Matt. Now what are some of AWS’s recommended certifications, training to best position a serious security team ready for the cloud? Matt: Answers the question, shows info to get more info