WA Department of Finance moves to Microsoft Azure

Application Storage, Data Storage

Article | July 12, 2023

The rollout of 5G networks coupled with edge compute introduces new security concerns for both the network and the enterprise. Security at the edge presents a unique set of security challenges that differ from those faced by traditional data centers. Today new concerns emerge from the combination of distributed architectures and a disaggregated network, creating new challenges for service providers. Many mission critical applications enabled by 5G connectivity, such as smart factories, are better off hosted at the edge because it's more economical and delivers better Quality of Service (QoS). However, applications must also be secured; communication service providers need to ensure that applications operate in an environment that is both safe and provides isolation. This means that secure designs and protocols are in place to pre-empt threats, avoid incidents and minimize response time when incidents do occur. As enterprises adopt private 5G networks to drive their Industry 4.0 strategies, these new enterprise 5G trends demand a new approach to security. Companies must find ways to reduce their exposure to cyberattacks that could potentially disrupt mission critical services, compromise industrial assets and threaten the safety of their workforce. Cybersecurity readiness is essential to ensure private network investments are not devalued. The 5G network architecture, particularly at the edge, introduces new levels of service decomposition now evolving beyond the virtual machine and into the space of orchestrated containers. Such disaggregation requires the operation of a layered technology stack, from the physical infrastructure to resource abstraction, container enablement and orchestration, all of which present attack surfaces which require addressing from a security perspective. So how can CSPs protect their network and services from complex and rapidly growing threats? Addressing vulnerability points of the network layer by layer As networks grow and the number of connected nodes at the edge multiply, so do the vulnerability points. The distributed nature of the 5G edge increases vulnerability threats, just by having network infrastructure scattered across tens of thousands of sites. The arrival of the Internet of Things (IoT) further complicates the picture: with a greater number of connected and mobile devices, potentially creating new network bridging connection points, questions around network security have become more relevant. As the integrity of the physical site cannot be guaranteed in the same way as a supervised data center, additional security measures need to be taken to protect the infrastructure. Transport and application control layers also need to be secured, to enable forms of "isolation" preventing a breach from propagating to other layers and components. Each layer requires specific security measures to ensure overall network security: use of Trusted Platform Modules (TPM) chipsets on motherboards, UEFI Secure OS boot process, secure connections in the control plane and more. These measures all contribute to and are integral part of an end-to-end network security design and strategy. Open RAN for a more secure solution The latest developments in open RAN and the collaborative standards-setting process related to open interfaces and supply chain diversification are enhancing the security of 5G networks. This is happening for two reasons. First, traditional networks are built using vendor proprietary technology – a limited number of vendors dominate the telco equipment market and create vendor lock-in for service providers that forces them to also rely on vendors' proprietary security solutions. This in turn prevents the adoption of "best-of-breed" solutions and slows innovation and speed of response, potentially amplifying the impact of a security breach. Second, open RAN standardization initiatives employ a set of open-source standards-based components. This has a positive effect on security as the design embedded in components is openly visible and understood; vendors can then contribute to such open-source projects where tighter security requirements need to be addressed. Aside from the inherent security of the open-source components, open RAN defines a number of open interfaces which can be individually assessed in their security aspects. The openness intrinsically present in open RAN means that service components can be seamlessly upgraded or swapped to facilitate the introduction of more stringent security characteristics, or they can simultaneously swiftly address identified vulnerabilities. Securing network components with AI Monitoring the status of myriad network components, particularly spotting a security attack taking place among a multitude of cooperating application functions, requires resources that transcend the capabilities of a finite team of human operators. This is where advances in AI technology can help to augment the abilities of operations teams. AI massively scales the ability to monitor any number of KPIs, learn their characteristic behavior and identify anomalies – this makes it the ideal companion in the secure operation of the 5G edge. The self-learning aspect of AI supports not just the identification of known incident patterns but also the ability to learn about new, unknown and unanticipated threats. Security by design Security needs to be integral to the design of the network architecture and its services. The adoption of open standards caters to the definition of security best practices in both the design and operation of the new 5G network edge. The analytics capabilities embedded in edge hyperconverged infrastructure components provide the platform on which to build an effective monitoring and troubleshooting toolkit, ensuring the secure operation of the intelligent edge.

Application Infrastructure, Application Storage

Article | July 19, 2023

Stay ahead of the curve and navigate the complex landscape of regulatory obligations to safeguard data in cloud. Explores the challenges of maintaining compliance and strategies for risk mitigation. Contents 1. Introduction 2. 3 Essential Regulatory Requirements 2.1 Before migration 2.2. During migration 2.3. After migration 3. Challenges in Ensuring Compliance in Infrastructure as a Service in Cloud Computing 3.1. Shared Responsibility Model 3.2. Data Breach 3.3. Access Mismanagement 3.4. Audit and Monitoring Challenges 4. Strategies for Addressing Compliance Challenges in IaaS 4.1. Risk Management and Assessment 4.2. Encryption and Collaboration with Cloud Service Providers 4.3. Contractual Agreements 4.4. Compliance Monitoring and Reporting 5. Conclusion 1. Introduction Ensuring Infrastructure as a Service (IaaS) compliance in security is crucial for organizations to meet regulatory requirements and avoid potential legal and financial consequences. However, several challenges must be addressed before and after migration to the cloud. This article provides an overview of the regulatory requirements in cloud computing, explores the challenges faced in ensuring compliance in IaaS, a cloud implementation service and provides strategies for addressing these challenges to ensure a successful cloud migration. 2. 3 Essential Regulatory Requirements When adopting cloud infrastructure as a service, organizations must comply with regulatory requirements before, during, and after migration to the cloud. This ensures avoiding the challenges, firms may face later and suggest solutions if they do so. 2.1 Before migration: Organizations must identify the relevant regulations that apply to their industry and geographic location. This includes: Data Protection Laws, Industry-Specific Regulations, and International Laws. 2.2. During migration: Organizations must ensure that they meet regulatory requirements while transferring data and applications to the cloud. This involves: Ensuring proper access management, data encryption, and data residency requirements. 2.3. After migration: Organizations must continue to meet regulatory requirements through ongoing monitoring and reporting. This includes: Regularly reviewing and updating security measures, ensuring proper data protection, and complying with audit and reporting requirements. 3. Challenges in Ensuring Compliance in Infrastructureas a Service in Cloud Computing 3.1. Shared Responsibility Model The lack of control over the infrastructure in IaaS cloud computing is caused by the shared responsibility model of IaaS, where the cloud service provider is responsible for the IaaS security while the customer is responsible for securing the data and applications they store and run in the cloud. According to a survey, 22.8% of respondents cited the lack of control over infrastructure as a top concern for cloud security. (Source: Cloud Security Alliance) 3.2. Data Breach Data breaches have serious consequences for businesses, including legal and financial penalties, damage to their reputation, and the loss of customer trust. The location of data and the regulations governing its storage and processing create challenges for businesses operating in multiple jurisdictions. The global average total cost of a data breach increased by USD 0.11 million to USD 4.35 million in 2022, the highest it's been in the history of this report. The increase from USD 4.24 million in the 2021 report to USD 4.35 million in the 2022 report represents a 2.6% increase. (Source: IBM) 3.3. Access Mismanagement Insider threats, where authorized users abuse their access privileges, can be a significant challenge for access management in IaaS. This includes the intentional or accidental misuse of credentials or non-protected infrastructure and the theft or loss of devices containing sensitive data. The 2020 data breach investigations report found that over 80% of data breaches were caused by compromised credentials or human error, highlighting the importance of effective access management. (Source: Verizon) 3.4. Audit and Monitoring Challenges Large volumes of alerts overwhelm security teams, leading to fatigue and missed alerts, which result in non-compliance or security incidents going unnoticed. Limited resources may also make it challenging to effectively monitor and audit infrastructure as a service cloud environment, including the implementation and maintenance of monitoring tools. 4. Strategies for Addressing Compliance Challenges in IaaS 4.1. Risk Management and Assessment Risk Assessment and Management includes conducting a risk assessment, including assessing risks related to data security, access controls, and regulatory compliance. It also involves implementing risk mitigation measures to address identified risks, like additional security measures or access controls such as encryption or multi-factor authentication. 4.2. Encryption and Collaboration with Cloud Service Providers Encryption can be implemented at the application, database, or file system level, depending on the specific needs of the business. In addition, businesses should establish clear service level agreements with their cloud service provider related to data protection. This includes requirements for data security, access controls, and backup and recovery processes. 4.3. Contractual Agreements The agreement should also establish audit and compliance requirements, including regular assessments of access management controls and policies. Using contractual agreements, organizations help ensure that they are clearly defined and that the cloud service provider is held accountable for implementing effective access management controls and policies. 4.4. Compliance Monitoring and Reporting Monitoring and Reporting involves setting up automated monitoring and reporting mechanisms that track compliance with relevant regulations and standards and generate reports. They should also leverage technologies such as intrusion detection and prevention systems, security information and event management (SIEM) tools, and log analysis tools to collect, analyze, and report on security events in real time. 5. Conclusion In accordance with the increasing prevalence of data breaches and the growing complexity of regulatory requirements, maintaining a secure and compliant cloud environment will be crucial for businesses to build trust with customers and avoid legal and financial risks. Addressing these requirements, the cloud helps companies maintain data privacy, avoid legal risks, and build customer trust. Organizations create a secure and compliant cloud environment that meets their needs by overcoming challenges and implementing best practices, working closely with cloud service providers. Ultimately, by prioritizing compliance and investing in the necessary resources and expertise, businesses can navigate these challenges and unlock the full potential of the cloud with confidence.

Hyper-Converged Infrastructure, IT Systems Management

Article | September 14, 2023

Containers have emerged as a choice for deploying and scaling applications, owing to their lightweight, isolated, and portable nature. However, the absence of robust security measures may expose containers to diverse threats, thereby compromising the confidentiality and integrity of data and apps. Contents 1 Introduction 2 IaaS Container Security Techniques 2.1 Container Image Security 2.2 Host Security 2.3 Network Security 2.4 Data Security 2.5 Identity and Access Management (IAM) 2.6 Runtime Container Security 2.7 Compliance and Auditing 3 Conclusion 1. Introduction Infrastructure as a Service has become an increasingly popular way of deploying and managing applications, and containerization has emerged as a leading technology for packaging and deploying these applications. Containers are software packages that include all the necessary components to operate in any environment. While containers offer numerous benefits, such as portability, scalability, and speed, they also introduce new security challenges that must be addressed. Implementing adequate IaaS container security requires a comprehensive approach encompassing multiple layers and techniques. This blog explores the critical components of IaaS container security. It provides an overview of the techniques and best practices for implementing security measures that ensure the confidentiality and integrity of containerized applications. By following these, organizations can leverage the benefits of IaaS and containerization while mitigating the security risks that come along. 2. IaaS Container Security Techniques The increasing IAAS security risks and security issues associated with IAAS these days are leading to a massive data breach. Thus, IAAS security concerns are taken into consideration, and seven best techniques are drafted below. 2.1. Container Image Security: Container images are the building blocks of containerized applications. Ensuring the security of these images is essential to prevent security threats. The following measures are used for container image security: Using secure registries: The registry is the location where container images are stored and distributed. Usage of centrally managed registries on campus, the International Organization for Standardization (ISO) can scan them for security issues and system managers may simply assess package gaps, etc. Signing images: Container images can be signed using digital signatures to ensure their authenticity. Signed images can be verified before being deployed to ensure they have not been tampered with. Scanning images: Although standard AppSec tools such as Software Composition Analysis (SCA) can check container images for vulnerabilities in software packages and dependencies, extra dependencies can be introduced during the development process or even at runtime. 2.2. Host Security: Host security is a collection of capabilities that provide a framework for implementing a variety of security solutions on hosts to prevent attacks. The underlying host infrastructure where containers are deployed must be secured. The following measures are used for host security: Using secure operating systems: The host operating system must be safe and up-to-date with the latest high severity security patches within 7 days of release, and others, within 30 days to prevent vulnerabilities and security issues. Applying security patches: Security patches must be applied to the host operating system and other software packages to fix vulnerabilities and prevent security threats. Hardening the host environment: The host environment must be hardened by disabling unnecessary services, limiting access to the host, and applying security policies to prevent unauthorized access. 2.3. Network Security: Network security involves securing the network traffic between containers and the outside world. The following measures are used for network security: Using Microsegmentation and firewalls: Microsegmentation tools with next-gen firewalls provide container network security. Microsegmentation software leverages network virtualization to build extremely granular security zones in data centers and cloud applications to isolate and safeguard each workload. Encryption: Encryption can protect network traffic and prevent eavesdropping and interception of data. Access control measures: Access control measures can restrict access to containerized applications based on user roles and responsibilities. 2.4. Data Security: Data stored in containers must be secured to ensure its confidentiality and integrity. The following measures are used for data security: Using encryption: Data stored in containers can be encrypted, using Transport Layer Security protocol version 1.1. (TLS 1.1) or higher, to protect it from unauthorized access and prevent data leaks. All outbound traffic from private cloud should be encrypted at the transport layer. Access control measures: Access control measures can restrict access to sensitive data in containers based on user roles and responsibilities. Not storing sensitive data in clear text: Sensitive data must not be stored in clear text within containers to prevent unauthorized access and data breaches. Backup app data, atleast weekly. 2.5. Identity and Access Management (IAM): IAM involves managing access to the container infrastructure and resources based on the roles and responsibilities of the users. The following measures are used for IAM: Implementing identity and access management solutions: IAM solutions can manage user identities, assign user roles and responsibilities, authenticate and provide access control policies. Multi-factor authentication: Multi-factor authentication can add an extra layer of security to the login process. Auditing capabilities: Auditing capabilities can monitor user activity and detect potential security threats. 2.6. Runtime Container Security: To keep its containers safe, businesses should employ a defense-in-depth strategy, as part of runtime protection. Malicious processes, files, and network activity that deviates from a baseline can be detected and blocked via runtime container security. Container runtime protection can give an extra layer of defense against malicious code on top of the network security provided by containerized next-generation firewalls. In addition, HTTP layer 7 based threats like the OWASP Top 10, denial of service (DoS), and bots can be prevented with embedded web application and API security. 2.7. Compliance and Auditing: Compliance and auditing ensure that the container infrastructure complies with relevant regulatory and industry standards. The following measures are used for compliance and auditing: Monitoring and auditing capabilities: Monitoring and auditing capabilities can detect and report cloud security incidents and violations. Compliance frameworks: Compliance frameworks can be used to ensure that the container infrastructure complies with relevant regulatory and industry standards, such as HIPAA, PCI DSS, and GDPR. Enabling data access logs on AWS S3 buckets containing high-risk Confidential Data is one such example. 3. Conclusion IaaS container security is critical for organizations that rely on containerization technology for deploying and managing their applications. There is likely to be an increased focus on the increased use of AI and ML to detect and respond to security incidents in real-time, the adoption of more advanced encryption techniques to protect data, and the integration of security measures into the entire application development lifecycle. In order to stay ahead of the challenges and ensure the continued security of containerized applications, the ongoing process of IaaS container security requires continuous attention and improvement. By prioritizing security and implementing effective measures, organizations can confidently leverage the benefits of containerization while maintaining the confidentiality and integrity of their applications and data.

Article | April 20, 2020

Pacific Electric Wire & Cable Co. (PEWC) is a manufacturer in Taiwan with subsidiaries in China, Singapore, Thailand, and Australia. Like many companies, they had been facing the looming change over to SAP HANA. They were ready to switch over from their older SAP software and take advantage of SAP HANA apps and databases. They also had a goal of speeding up operational analytics and insights. But with the change to HANA, they needed all new infrastructure, certified by SAP, to support it.