
Cloud and SaaS Security - The Need for a Comprehensive Approach


Richard A. Spires, CEO, Learning Tree International, Former CIO of US Department of Homeland Security and the IRS
As a former CIO, I have implemented and seen the significant benefits of cloud computing, both the leverage of compute on demand via infrastructure-as-a-service (IaaS) and platform-as-a-service (PaaS) delivery models and the use of software-as-a-service (SaaS) applications. In particular, SaaS-based applications are becoming increasingly the way organizations can quickly and easily leverage new applications. This is driving tremendous growth and innovation—Angel List has more than 11,000 SaaS start-ups listed in the U.S. and IDC predicts the SaaS-based market to surpass $112 billion by 2019.
IT organizations need to develop a comprehensive approach for addressing the security challenges that come with relying on third-party computing and applications
While cloud computing and SaaS business models can enable IT organizations to lower infrastructure costs and enable more agility to support customers, it also increases the complexity in dealing with IT security. Not only is the IT organization giving up control (and visibility) into some of its IT infrastructure, to the degree it is leveraging SaaS-based applications, it is also having third-parties store and control sensitive data. Not so long ago, IT security staff would work to protect the organization’s IT perimeter; with today’s new computing and service models, one has to admit that a traditional perimeter no longer exists, or if a perimeter does exist, it might include protecting a number (perhaps up to dozens?) of third-party cloud service and SaaS-application providers.
I think of SaaS security as a two-fold challenge. First, in regards to the use of third-party IT cloud service providers (to include more traditional outsourced data center services), organizations need to have confidence these providers are implementing the proper security controls that should match (or at least be similar to) what they would implement within their own data centers and networks. These controls range from physical access for personnel, and up to including identity management for system administration access and appropriate network encryption. A number of non-profit organizations have been working on standardizing these controls for the industry. Notably, the Cloud Security Alliance (CSA–cloud security allianc. org) has developed the Cloud Controls Matrix (CCM), a security controls framework specifically designed for cloud computing. Leveraging CCM, the CSA has developed an auditing, certification, and registry program for cloud service providers known as Security, Trust & Assurance Registry (STAR). In a similar model, the U.S. Federal Government has developed its FedRAMP program, a means for cloud service providers to meet minimum security control requirements at three different levels as defined by the NIST 800-53 security control suite.
Check Out: Top Cloud Security Solution Companies
Yet even if an IT security manager has faith in the control suite of the underlying cloud service provider, what about the case of an organization leveraging a SaaS application? In this case, it is likely that sensitive data will be stored and controlled by the third party and used by organization’s customers or partners in ways that the data never comes in contact with the organization’s network, firewalls, or any other security device or process controlled by the organization. As a CIO or CISO, this situation gives one significant concerns, as SaaS applications can leave one with little visibility and control regarding the security of the application and its data. Hence the second challenge is how to extend an organization’s security policies and controls to public clouds and SaaS applications.
This challenge has given rise to what are known as cloud access security brokers (CASBs), products that serve as security enforcement points sitting on-premise or in the cloud and logically exist between the organization and the cloud service provider to provide a range of services to include identity authentication and authorization, device profiling, application whitelisting, encryption, alerting, malware detection, etc. Some of the leading vendors in the CASB market include Bitglass, Forcepoint, Cloudlock/Cisco and Skyhigh Networks. The use of CASB solutions is growing rapidly, with Gartner reporting that by 2020, 85 percent of large organizations will use CASB solutions, up from less than 5 percent in 2015.
On the positive side, the CASB vendors have significant capabilities and are filling a void in the market. As a former CIO, however, I have a jaded view of solving enterprise IT security challenges by continuing to add tools and then working internally to integrate them. I have rarely seen this strategy work well. As such I have become a proponent of the view that the best approach to address enterprise IT security challenges is to use an IT security platform that provides the range of capabilities to help prevent, and when necessary, detect breaches in the enterprise. In this market, Palo Alto Networks, Cisco and Check Point Software provide integrated platform solutions (disclosure: I am a member of the Palo Alto Networks Public Sector Advisory Council).
As an example of the value of a platform, Palo Alto Networks has recently extended its platform capabilities into cloud solutions and SaaS applications. What is particularly intriguing (and operationally appealing) is that I can set my security controls for a type of data (for example, tailor the controls according to the data’s sensitivity), and Palo Alto Networks technology enables me to enforce those policies throughout its platform, irrespective of whether that data is residing in my own data center, an outsourced data center, or in a SaaS application on a public cloud. This greatly simplifies administration of security policies throughout an enterprise and offers advanced threat prevention. Furthermore, one of the growing exploits used by attackers aims to infect users via malware via SaaS-based applications, since adversaries know that most organizations do not have the same ability to monitor those SaaS applications the way they do internally-based applications. A key component of these platforms is the ability to bring threat detection and prevention capabilities to all aspects of the IT infrastructure and applications, including those residing in the cloud.
The use of SaaS-based applications is becoming a preferred approach for rapidly delivering new capabilities for organizations. The demand is coming from the business users, and as such, IT organizations must accept and plan for continued expansion in the number and use of SaaS. Accordingly, IT organizations need to develop a comprehensive approach for addressing the security challenges that come with relying on third-party computing and applications, even though the user and data may never traverse the organization’s network or data centers.
See Also:
Top Cloud Technology Solution Companies
Top Cloud Consulting/Services Companies
Featured Vendors
RiverMeadow Software - A Cloud Migration Company: "Accelerating Cloud Migration: Fast, Cost Effective Low Risk"
Skybox Security Inc.: Delivering Best-In-Class Cybersecurity Management Software for Hybrid Networks
Global Cloud Consulting: Leading Businesses to Success by Imparting Knowledge on Cloud Implementatio
EDITOR'S PICK
Essential Technology Elements Necessary To Enable...
By Leni Kaufman, VP & CIO, Newport News Shipbuilding
Comparative Data Among Physician Peers
By George Evans, CIO, Singing River Health System
Monitoring Technologies Without Human Intervention
By John Kamin, EVP and CIO, Old National Bancorp
Unlocking the Value of Connected Cars
By Elliot Garbus, VP-IoT Solutions Group & GM-Automotive...
Digital Innovation Giving Rise to New Capabilities
By Gregory Morrison, SVP & CIO, Cox Enterprises
Staying Connected to Organizational Priorities is Vital...
By Alberto Ruocco, CIO, American Electric Power
Comprehensible Distribution of Training and Information...
By Sam Lamonica, CIO & VP Information Systems, Rosendin...
The Current Focus is On Comprehensive Solutions
By Sergey Cherkasov, CIO, PhosAgro
Big Data Analytics and Its Impact on the Supply Chain
By Pascal Becotte, MD-Global Supply Chain Practice for the...
Technology's Impact on Field Services
By Stephen Caulfield, Executive Director, Global Field...
Carmax, the Automobile Business with IT at the Core
By Shamim Mohammad, SVP & CIO, CarMax
The CIO's role in rethinking the scope of EPM for...
By Ronald Seymore, Managing Director, Enterprise Performance...
Driving Insurance Agent Productivity with Mobile and Big...
By Brad Bodell, SVP and CIO, CNO Financial Group, Inc.
Transformative Impact On The IT Landscape
By Jim Whitehurst, CEO, Red Hat
Get Ready for an IT Renaissance: Brought to You by Big...
By Clark Golestani, EVP and CIO, Merck
Four Initiatives Driving ECM Innovation
By Scott Craig, Vice President of Product Marketing, Lexmark...
Technology to Leverage and Enable
By Dave Kipe, SVP, Global Operations, Scholastic Inc.
By Meerah Rajavel, CIO, Forcepoint
AI is the New UI-AI + UX + DesignOps
By Amit Bahree, Executive, Global Technology and Innovation,...
Evolving Role of the CIO - Enabling Business Execution...
By Greg Tacchetti, CIO, State Auto Insurance
Read Also
Disrupt Your Legacy Application Portfolio to Improve Security And...
Why a Credentialing Strategy Must be Part of Your Digital Strategy
The Convergence of IT with the Internet of Things Innovation
It’s On People: The Undeniable Cultural Impact in a Digital...
A Promising Road Ahead for Insurtech
Bolloré Logistics Australia becomes a global leader in the use of...
