SlideShare ist ein Scribd-Unternehmen logo
1 von 13
Downloaden Sie, um offline zu lesen
Page 1 of 13
How Security Designed with the
Cloud Migration Process in Mind
Improves an Enterprise’s Risk
Posture from Top to Bottom
A discussion on how cloud deployment planners need to be ever-vigilant for all types of cyber
security attack vectors and make their data and processes safer and easier to recover from
security incidents.
Listen to the podcast. Find it on iTunes. Download the transcript. Sponsors: Unisys and
Microsoft.
Dana Gardner: Hi, this is Dana Gardner, Principal Analyst at Interarbor Solutions, and
you are listening to BriefingsDirect. This next data security insights discussion explores
how cloud deployment planners need to be ever-vigilant for all types of cybersecurity
attack vectors.
Stay with us now as we examine how those moving to and adapting to cloud
deployments can make their data and processes safer and easier to recover from
security incidents.
To learn more about taking the right precautions for
cloud and distributed data safety, please join me now in
welcoming Mark McIntyre, Senior Director of
Cybersecurity Solutions Group at Microsoft. Welcome,
Mark.
Mark McIntyre: Thank you very much. I appreciate it.
Gardner: We are also here with Sudhir Mehta, Global
Vice President of Product Management and Strategy at
Unisys. Welcome, Sudhir.
Sudhir Mehta: Hey, Dana, thanks for having me.
Gardner: Mark, what’s changed in how data is being targeted for those using cloud
models like Microsoft Azure? How is that different from two or three years ago?
Change in cloud worldwide
McIntyre
Page 2 of 13
McIntyre: First of all, the good news is that we see more and more organizations
around the world, including the US government, but broadly more global, pursuing cloud
adoption. I think that’s great. Organizations around the world recognize the business
value and I think increasingly the security value.
The challenge I see is one of expectations. Who owns what, as you go to the cloud? And
so we need to be crisper and clearer with our partners and customers as to who owns
what responsibility in terms of monitoring and managing in a team environment as you
transition from a traditional on-premises environments all the way up into a software-as-
a-services (SaaS) environment.
Gardner: Sudhir, what’s changed from your perspective at Unisys as to what the cloud
adoption era security requirements are?
Mehta: When organizations move data and workloads to
the cloud, many of them underestimate the complexities
of securing hybrid, on-premises, and cloud ecosystems.
A lot of the failures, or what we would call security
breaches or intrusions, you can attribute to inadequate
security practices, policies, procedures, and
misconfiguration errors.
As a result, cloud security breach reports have been on
the rise. Container technology adds flexibility and speed-
to-market, but it is also introducing a lot of vulnerability
and complexity.
A lot of customers have legacy, on-premises security
methodologies and technologies, which obviously they can no longer use or leverage in
the new, dynamic, elastic nature of today’s cloud environments.
Gartner estimates that through 2022 at least 95 percent of cloud security failures will be
the customers’ fault. So the net effect is cloud security exposure, the attack surface, is
on the rise. The exposure is growing.
Gardner: People, process, and technology all change as organizations move to the
cloud. And so security best practices can fall through the cracks. What are you seeing,
Mark, in how a comprehensive cloud security approach can be brought to this transition
so that cloud retains its largely sterling reputation for security?
McIntyre: I completely agree with what my colleague from Unisys said. Not to crack a
joke -- this is a serious topic -- but my colleagues and I meet a lot with both US
government and commercial counterparts. And they ask us, “Microsoft, as a large cloud
provider, what keeps you awake at night? What are you afraid of?”
Mehta
Page 3 of 13
It’s always a delicate conversation because we
need to tactfully turn it around and say, “Well,
you, the customer, you keep us awake at night.
When you come into our cloud, we inherit your
adversaries. We inherit your vulnerabilities and
your configuration challenges.”
As our customers plan a cloud migration, it will invariably include a variety of resources
being left on-premises, in a traditional IT infrastructure. We need to make sure that we
help them understand the benefits already built into the cloud, whether they are seeking
infrastructure-as-a-service (IaaS), platform-as-a-service (PaaS), or SaaS. We need to be
really clear with our customers -- through our partners, in many cases – about the
technologies that they need to make themselves more secure. We need to give them
awareness into their posture so that it is built right into the fabric of the cloud service.
Gardner: Sudhir, it sounds as if organizations who haven’t been doing things quite as
well as they should on-premises need to be even more mindful of improving on their
security posture as they move to the cloud, so that they don’t take their vulnerabilities
with them.
From Unisys’s perspective, how should organizations get their housecleaning in order
before they move to the cloud?
Don’t bring unsafe baggage to the cloud
Mehta: We always recommend that customers should absolutely first look at putting
their house in order. Security hygiene is extremely important, whether you look at data
protection, information protection, or your overall access exposure. That can be from
employees working at home or through to vendors or third-parties -- wherever they have
access to a lot of your information and data.
First and foremost, make sure you have the appropriate framework established. Then
compliance and policy management are extremely important when you move to the
cloud and to virtual and containerized frameworks. Today, many companies do their
application development in the cloud because it’s a lot more dynamic. We recommend
that our customers make sure they have the appropriate policy management,
assessments, and compliance checks in place for both on-premises and then for your
journey to the cloud.
The net of it is, if you are appropriately managed when you are on-premises, chances
are as you move from hybrid to more of a cloud-native deployment and/or cloud-native
services, you are more likely to get it right. If you don’t have it all in place when you are
on-premises, you have an uphill battle in making sure you are secured in the cloud.
Gardner: Mark, are there any related issues around identity and authentication as
organizations move from on-premises to outside of their firewall into cloud deployment?
When you come into our cloud,
we inherit your adversaries. We
inherit your vulnerabilities and
your configuration challenges.
Page 4 of 13
What should organizations be thinking about specifically around identity and
authentication?
Avoid an identity crisis
McIntyre: This is a huge area of focus right now. Even within our own company, at
Microsoft, we as employees operate in essentially an identity-driven security model. And
so it’s proper that you call this out on this podcast.
The idea that you can monitor and filter all traffic, and that you are going to make
meaningful conclusions from that in real time -- while still running your business and
pursuing your mission -- is not the best use of your time and your resources. It’s much
better to switch to a more modern, identity-based model where you can actually
incorporate newer concepts.
Within Microsoft, we have a term called Modern Workplace. It’s a reflection of the fact
that government organizations and enterprises around the world are having to anticipate
and hopefully provide a collaborative work environment where people can work in a way
that reflects their personal preferences around devices and working at home or on the
road at a coffee shop or restaurant -- or whatever. The concept of work has changed
around enterprise and is definitely forcing this opportunity to look at creating a more
modern identity framework.
If you look at some of the initiatives in the US government right now, we hear the term
Zero Trust. That includes Zero Trust networking and micro-segmentation. Initiatives like
these recognize that we know people need to keep working and doing their jobs
wherever they are. The idea is to accept the fact that people will always cause some
level of risk to the organization.
We are curious, reasonably smart, well-
intentioned people, and we make mistakes,
just like anybody else. Let’s create an
identity-driven model that allows the
organization to get better insight and control
over authentications, requests for resources,
end-to-end, and throughout a lifecycle.
Gardner: Sudhir, Unisys has been working with a number of public-sector organizations
on technologies that support a stronger posture around authentication and other
technologies. Tell us about what you have found over the past few years and how that
can be applied to these challenges of moving to a cloud like Microsoft Azure.
Mehta: Dana, going back in time, one of the requests we had from the US Department
of Defense (DoD) on the networking side, was a concern around access to sensitive
information and data. Unisys was requested by the DoD to develop a framework and
Let’s create an identity-driven
model that allows the
organization to get better insight
and control over authentications,
requests for resources, end-to-
end, and throughout a lifecycle.
Page 5 of 13
implement a solution. They were looking at more of a micro-segmentation solution, very
similar to what Mark just described.
So, fast forward, since then we have deployed and released a military-grade capability
called Unisys Stealth®, wherein we are able to manage micro-segmentation, what we
classify as key-based, encrypted micro-segmentation, that controls access to different
hosts or endpoints based on the identity of the user. It permits only authorized users to
communicate with approved endpoints and denies unauthorized communications, and
so prevents the spread of east-to-west, lateral attacks.
Gardner: Mark, for those in our audience who aren’t that technology savvy, what does
micro-segmentation mean? Why has it become an important foundational capability for
security across a cloud-use environment?
Need-to-know access for people and devices
McIntyre: First of all, I want to call out Unisys’s great work here and their leadership in
the last several years. It means a Zero-Trust environment can essentially gauge or
control east-to-west behavior or activity in a distributed environment.
For example, in a traditional IT environment, devices are not really well-managed when
they are centralized, corporate-issued devices. You can’t take them out of the facility, of
course. You don’t authenticate once you are on a network because you are already in a
physical campus environment. But it’s different in a modern, collaborative environment.
Enterprises are generally ahead on this change, but it’s now coming into government
requirements, too.
And so now, you essentially can parse out your subjects and your objects, your subjects
trying to access objects. You can spit them out and say, “We are going to create all user
accounts with a certain set of parameters.” It amounts to a privileged, need-to-know
model. You can enforce strong controls with a set of certain release-privilege rights. And,
of course, in an ideal world, you could go a step further and start implementing
biometrics [to authenticate] to get off of password dependencies.
But number one, you want to verify the identity.
Is this a person? Is this the subject who we think
they are? Are they that subject based on a
corroborating variety of different attributes,
behaviors, and activities? Things like that. And
then you can also apply the same controls to a
device and say, “Okay, this user is using a certain device. Is this device healthy? Is it
built to today’s image? Is it patched, clean, and approved to be used in this
environment? And if so, to what level?”
And then you can even go a step further and say, “In this model, now that we can verify
the access, should this person be able to use our resources through the public Internet
You want to verify the
identity. Is this a person? …
This user is using a certain
device. Is this device healthy?
Page 6 of 13
and access certain corporate resources? Should we allow an unmanaged device to have
a level of access to confidential documents within the company? Maybe that should only
be on a managed device.”
So you can create these flexible authentication scenarios based on what you know
about the subjects at hand, about the objects, and about the files that they want to
access. It’s a much more flexible, modern way to interact.
Within Azure cloud, Microsoft Azure Active Directory services offer those capabilities –
they are just built into the service. So micro-segmentation might sound like a lot of work
for your security or identity team, but it’s a great example of a cloud service that runs in
the background to help you set up the right rules and then let the service work for you.
Gardner: Sudhir, just to be clear, the Unisys Stealth(cloud) Extended Data Center for
Microsoft Azure is a service that you get from the cloud? Or is that something that you
would implement on-premises? Are there different models for how you would implement
and deploy this?
A hybrid, stealthy and healthy, cloud journey
Mehta: We have been working with Microsoft
over the years on Stealth, and we have a
fantastic relationship with Microsoft. If you are
a customer going through a cloud journey, we
deploy what we call a hybrid Stealth
deployment. In other words, we help customers
do what we call isolation with the help of
communities of interests that we create that are
basically groupings of hosts, users, and
resources based on like interests.
Then, when there is a request to communicate, you create the appropriate Stealth-
encrypted tunnels. If you have a scenario where you are doing the appropriate
communication between an on-premises host and a cloud-based host, you do that
through a secure, encrypted tunnel.
We have also implemented what we call cloaking. With cloaking, if someone is not
authorized to communicate with a certain host or a certain member of a community of
interest, you basically do not give a response back. So cloaking is also part of the
Stealth implementation.
And in working closely with Microsoft, we have further established an automated
capability through a discovery API. So when Microsoft releases new Azure services, we
are able to update the overall Stealth protocol and framework with the updated Azure
services. For customers who have Azure workloads protected by Stealth, there is no
We deploy … a hybrid Stealth
deployment. … We help
customers do … isolation with
the help of communities of
interest that we create, that
are basically groupings of
hosts, users, and resources
based on like interests.
Page 7 of 13
disruption from a productivity standpoint. They can always securely leverage whatever
applications they are running on Azure cloud.
The net of it is being able to establish the appropriate secure journey for customers, from
on-premises to the cloud, the hybrid journey. For customers leveraging Azure cloud with
different workloads, we maintain the appropriate level of secure communications just as
they would have in an on-premises deployment.
Gardner: Mark, when does this become readily available? What’s the timeline on how
these technologies come together to make a whole greater than the sum of the parts
when it comes to hybrid security and authentication?
McIntyre: Microsoft is already offering Zero Trust, identity-based security capabilities
through our services. We haven’t traditionally named them as such, although we
definitely are working along that path right now.
Microsoft Chief Digital Officer and Executive Vice President Kurt DelBene is on the US
Defense Innovation Board and is playing a leadership role in establishing essentially a
DoD or US government priority on Zero Trust. In the next several months, we will be
putting more clarity around how our partners and customers can better map capabilities
that they already own against emerging priorities and requirements like these. So
definitely look for that.
In fact, Ignite DC is February 6 and 7, in downtown Washington, DC, and Zero Trust is
certainly on the agenda there, so there will be updates at that conference.
But generally speaking, any customer can take the
underlying services that we are offering and
implement this now. What’s even better, we have
companies that are already out there doing this. And
we rely greatly on our partners like Unisys to go out
and really have those deep architecture conversations
with their stakeholders.
Gardner: Sudhir, when people use the combined solution of Microsoft Azure and Stealth
for cloud, how can they react to attacks that may get through to prevent damage from
spreading?
Contain contagion, quickly
Mehta: Good question! Internally within Unisys’s own IT organization, we have already
moved on this cloud journey. Stealth is already securing our Azure cloud deployments
and we are 95 percent deployed on Azure in terms of internal Unisys applications. So we
like to eat our own dog food.
Generally speaking,
any customer can take
the underlying services
that we are offering and
implement this now.
Page 8 of 13
If there is a situation where there is an incident of compromise, we have a capability
called dynamic isolation, where if you are looking at a managed security operations
center (SOC) situation, we have empowered the SOC to contain a risk very quickly.
We are able to isolate a user and their device within 10 seconds. If you have a situation
where someone turns nefarious, intentionally or coincidentally, we are able to isolate the
user and then implement different thresholds of isolation. If a high threshold level is
breached across 8 out of 10, that means we completely isolate that user.
If there is a threshold level of 5 or 6, we may still give the user certain levels of access.
So within a certain group they would continue to access or be able to communicate.
Dynamic isolation isolates a user and their device with
different levels of thresholds while we have like a
managed SOC go through their cycles of trying to
identify what really happened as part of what we would
call an advanced response. Unisys is the only solution
where we can actually isolate a user or the device
within the span of seconds. We can do it now within 10
seconds.
McIntyre: Getting back to your question about Microsoft’s plans, I’m very happy to share
how we’ve managed Zero Trust. Essentially it relies on Intune for device management
and Azure Active Directory for identity. It’s the way that we right now internally manage
our own employees.
My access to corporate resources can come via my personal device and work-issued
device. I’m very happy with what Unisys already has available and what we have out
there. It’s a really strong reference architecture that’s already generally available.
Gardner: Our discussion began with security for the US DoD, among the largest
enterprises you could conceive of. But I’m wondering if this is something that goes down
market as well, to small- to medium-sized businesses (SMBs) that are using Azure
and/or are moving from an on-premises model.
Do Zero Trust and your services apply to the mom and pop shops, SMBs, and the
largest enterprises?
All sizes of businesses welcome
McIntyre: Yes, this is something that would be ideally available for an SMB because
they likely do not have large logistical or infrastructure dependencies. They are probably
more flexible in how they can implement solutions. It’s a great way to go into the cloud
and a great way for them to save money upfront over traditional IT infrastructure. So
SMBs should have a really good chance to literally, natively take an idea like this and
implement it.
Unisys is the only
solution where we can
actually isolate a user
or the device within the
span of … 10 seconds.
Page 9 of 13
Gardner: Sudhir, anything to offer on that in terms of the technology and how it’s
applicable both up and down market?
Mehta: Mark is spot on. Unisys Stealth resonates really well for SMBs and the
enterprise. SMBs benefit, as Mark mentioned, in their capability to move quickly. And
with Stealth, we have an innovative capability that can discover and visualize your users.
Thereafter, you can very quickly and automatically virtualize any network into the
communities of interest I mentioned earlier. SMBs can get going within a day or two.
If you’re a large enterprise, you can define your
journey -- whether it’s from on-premises to
cloud -- depending on what you’re actually
trying to migrate or run in the cloud. So I would
say absolutely both. And it would also depend
on what you’re really looking at managing and
deploying, but the opportunities are there for
both SMBs and enterprises.
Gardner: As companies large and small are evaluating this and trying to discern their
interest, let’s look at some of the benefits. As you pointed out, Sudhir, you’re eating your
own dog food at Unisys. And Mark has described how this is also being used internally
at Microsoft as well.
Do you have ways that you can look at before and after, measure quantitatively,
qualitative, maybe anecdotally, why this has been beneficial? It’s always hard in security
to prove something that didn’t happen and why it didn’t happen. But what do you get
when you do Stealth well?
The proof is in the profit and protection
Mehta: There are a couple of things, Dana. So one is there is certainly a reduction in
cost. When we deploy for 20,000 Unisys employees, our Chief Information Security
Officer (CISO) obviously has to be a big supporter of Stealth. His read is from a cost
perspective that we have seen significant reductions in costs.
Prior to having Stealth implemented, we had a certain approach as relates to network
segmentation. From a network equipment perspective, we’ve seen a reduction of over
70 percent. If you look at server infrastructure, there has been a reduction of more than
50 percent. The maintenance and labor costs have had a reduction north of 60 percent.
Ongoing support labor cost has also seen a significant reduction as well. So that’s one
lens you could look at.
The other lens that has been interesting is the virtual private network (VPN) exposure.
As many of us know, VPNs are perhaps the best breach route for hackers today. When
we’ve implemented Stealth internally within Unisys, for a lot of our applications we have
It would depend on what
you’re really looking at
managing and deploying, but
the opportunities are there for
both SMBs and enterprises.
Page 10 of 13
done away with the requirement for logging into a VPN application. That has made for
easier access to a lot of applications – mainly for folks logging in from home or from a
Starbucks. Now when they communicate, it is through an encrypted tunnel and it’s very
secure. The VPN exposure completely goes away.
Those are the best two lenses I could give to the value proposition. Obviously there is
cost reduction. And the other is the VPN exposure goes away, at least for Unisys that’s
what we’ve found with implementing internally.
Gardner: For those using VPNs, should they move to something like Stealth? Does the
way in which VPNs add value change when you bring something like Stealth in? How
much do you reevaluate your use of VPNs in general?
Mehta: I would be remiss to say you can completely do
away with VPNs. If you go back in time and see why
VPNs were created, the overall framework was created
for secure access for certain applications. Since then,
for whatever reasons, VPNs became the only way
people communicate from working at home, for example. So the way we look at this is,
for applications that are not extremely limited to a few people, you should look at options
wherein you don’t necessarily need a VPN. You could therefore look at a solution like
Unisys Stealth.
And then if there are certain applications that are extremely sensitive, limited to only a
few folks for whatever reason, that’s where potentially you could consider using an
application like a VPN.
Gardner: Let’s look to the future. When you put these Zero Trust services into practice,
into a hybrid cloud, then ultimately a fully cloud-native environment, what’s the next shoe
to fall? Are there some things you gain when you enter into this level of micro-
segmentation, by exploiting these newer technologies?
Can this value be extended to the edge, for example? Does it have a role in Internet of
things (IoT)? A role in data transfers from organization to organization? What does this
put us in a position to do in the future that we couldn’t have done previously?
Machining the future, securely
McIntyre: You hit on two really important points. Obviously devices, IoT devices, for
example, and data. So data increasingly -- you see T-shirts out and you see slogans,
“Data is the new oil,” and such. From a security point of view there is no question this is
becoming the case, when there’s something like 44 to 45 zettabytes of data projected to
be out there for the next few years.
You can employ traditional security monitoring practices, for example label-free
detection, things like that. But it’s just not going to allow you to work quickly, especially in
I would be remiss to
say you can completely
do away with VPNs.
Page 11 of 13
an environment where we’re already challenged with having enough security workforce.
There are not enough people out there, it’s a global talent shortage.
It’s a fantastic opportunity forced on us to rely more on modern authentication
frameworks and on machine learning (ML) and artificial intelligence (AI) technologies to
take on a lot of that lower-level analysis, the log analysis work, out of human hands and
have machines free people up for the higher-level work.
For example, we have a really interesting situation within Microsoft. It goes around the
industry as well. We have many organizations go into the cloud, but of course, as we
mentioned earlier, it’s still unclear on the roles and responsibilities. We’re also seeing big
gaps in use of cloud resources versus security tools built into those resources.
And so we’re really trying to make sure that as we deliver new services to marketplace,
for example, IoT, that those are built in a way that you can configure and monitor them
like any other device in the company. With Azure, for example, we have IoT Hub. We
can literally, as you build an IoT device, make sure that it is being monitored in the same
way as your traditional infrastructure monitors.
There should not be a gap there. You can still
apply the same types of logical access
controls around them. There shouldn’t be any
tradeoffs on security for how you do security --
whether it’s IT or IoT.
Gardner: Sudhir, same question, what is use of Stealth in conjunction with cloud
activities get you in the future?
Mehta: Tagging on to what Mark said, AI and ML are becoming interesting. We
obviously had a very big digital workplace solutions organization. We are a market
leader for services, for helpdesk services. We are looking at the introduction of a lot of
what you would call as AIOps in automation as it leads to robotic process automation
(RPA) and voice assistance.
So one of the things we are observing is, as you go on this AI-ML, there is a larger
exposure because you are focusing more around the operationalization in automation or
AI-ML and certain areas where you may not be able to manage, for instance, the way
you get the training done for your bots.
So that’s where Stealth is a capability we are implementing right now with digital
workplace solutions as part of a journey for AIOps automation as an example. The other
area we are working very closely with some of other partners, as well as Microsoft, is
around application security and hardening in the cloud.
How do you make sure that when you deploy certain applications in the cloud you
ensure that it is secure and it is not being breached, or are there intrusions when you try
to make changes to your applications?
There shouldn’t be any tradeoffs
on security for how you do
security – whether it’s IT or IoT.
Page 12 of 13
Those are two areas we are currently working on, the AIOps and MLOps automation and
then the application security and hardening in the cloud, working with Microsoft as well.
Gardner: If I want to be as secure as I can, and I know that I’m going to be doing more
in the cloud, what should I be doing now in order to make myself in the best position to
take advantage of things like micro-segmentation and the technologies behind Stealth
and how they apply to a cloud like Azure? How should I get myself ready to take
advantage of these things?
Plan ahead to secure success
McIntyre: First thing is to remember how you plan and roll out your security estate. It
should be no different than what you’re doing with your larger IT planning anyway, so it’s
all digital transformation. First thing to do is close that gap between security teams. All
the teams – business and IT -- should be working together.
We want to make sure that our customers go to the cloud in a secure way, without losing
this ability to access their data. We continue to put more effort in very proactive services
-- architecture guidance, recommendations, things that can help people get started in the
cloud. It’s called Azure Blueprints, a configuration guidance and predefined templates
that can help an organization launch a resource in the cloud that’s already compliant
against FedRAMP or NIST or ISO or HIPAA standards.
We’ll continue to invest in the technologies that help customers securely deploy
technologies or cloud resources from the get-go so that we close those gaps and
configuration and close the gaps in reporting and telemetry as well. And we can’t do it
without great partners that provide those customized solutions for each sector.
Gardner: Sudhir, last word to you. What’s your advice for people to prepare themselves
to be ready to take advantage of things like Stealth?
Mehta: Look at a couple of things. One is focus on trusted identity in terms of who you
work with, who you give access to. Even within your organization you obviously need to
make sure you establish that trusted identity. And how you do it is you make sure it is
simple. Second, look at an overlay network agnostic framework, which is where Stealth
can help you. Make sure it is unique. One individual has one identity. Third is make sure
it is refutable. So it’s undeniable in terms of how you implement it, and then the fourth is,
make sure it’s got the highest level of efficacy, whether it’s related to how you deploy
and it’s also the way you architect your solution.
So, the net of it is, a) trust no one, b)
assume a breach can occur, and then c)
respond really fast to limit damage. If you do
these three things, you can get to Zero Trust
for your organization.
a) trust no one, b) assume a breach
can occur, and then c) respond
really fast to limit damage.
Page 13 of 13
Gardner: I’m afraid we’ll have to leave it there. You have been listening to a sponsored
BriefingsDirect discussion on how cloud deployment planners need to be ever-vigilant
for all types of cybersecurity attack vectors.
And we’ve learned how Unisys helps Microsoft Azure users take the right precautions for
better cloud and distributed users’ safety.
So please join me in thanking our guests, Mark McIntyre, Senior Director of
Cybersecurity Solutions Group at Microsoft, and Sudhir Mehta, Global Vice President of
Product Management and Strategy at Unisys. Thank you so much.
And a big thank you as well to our audience for joining this BriefingsDirect data security
insights discussion. I’m Dana Gardner, Principal Analyst at Interarbor Solutions, your
host throughout this series of Unisys- and Microsoft-sponsored BriefingsDirect
discussions.
Thanks again for listening. Please pass this along to your community and do come back
next time.
Listen to the podcast. Find it on iTunes. Download the transcript. Sponsors: Unisys and
Microsoft.
A discussion on how cloud deployment planners need to be ever-vigilant for all types of cyber
security attack vectors and make their data and processes safer and easier to recover from
security incidents. Copyright Interarbor Solutions, LLC, 2005-2020. All rights reserved.
You may also be interested in:
• How Unisys and Microsoft team up to ease complex cloud adoption for governments and
enterprises
• How Unisys and Dell EMC head off backup storage cyber security vulnerabilities
• Data-driven and intelligent healthcare processes improve patient outcomes while making
the IT increasingly invisible
• Data-driven and intelligent healthcare processes improve patient outcomes while making
the IT increasingly invisible
• How The Open Group Healthcare Forum and Health Enterprise Reference Architecture
cures process and IT ills
• The next line of defense—How new security leverages virtualization to counter
sophisticated threats
• Expert Panel Explores the New Reality for Cloud Security and Trusted Mobile Apps
Delivery
• How IT innovators turn digital disruption into a business productivity force multiplier
• How the Citrix Technology Professionals Program produces user experience benefits
from greater ecosystem collaboration

Weitere ähnliche Inhalte

Kürzlich hochgeladen

Enhancing Worker Digital Experience: A Hands-on Workshop for Partners
Enhancing Worker Digital Experience: A Hands-on Workshop for PartnersEnhancing Worker Digital Experience: A Hands-on Workshop for Partners
Enhancing Worker Digital Experience: A Hands-on Workshop for PartnersThousandEyes
 
#StandardsGoals for 2024: What’s new for BISAC - Tech Forum 2024
#StandardsGoals for 2024: What’s new for BISAC - Tech Forum 2024#StandardsGoals for 2024: What’s new for BISAC - Tech Forum 2024
#StandardsGoals for 2024: What’s new for BISAC - Tech Forum 2024BookNet Canada
 
IAC 2024 - IA Fast Track to Search Focused AI Solutions
IAC 2024 - IA Fast Track to Search Focused AI SolutionsIAC 2024 - IA Fast Track to Search Focused AI Solutions
IAC 2024 - IA Fast Track to Search Focused AI SolutionsEnterprise Knowledge
 
WhatsApp 9892124323 ✓Call Girls In Kalyan ( Mumbai ) secure service
WhatsApp 9892124323 ✓Call Girls In Kalyan ( Mumbai ) secure serviceWhatsApp 9892124323 ✓Call Girls In Kalyan ( Mumbai ) secure service
WhatsApp 9892124323 ✓Call Girls In Kalyan ( Mumbai ) secure servicePooja Nehwal
 
AI as an Interface for Commercial Buildings
AI as an Interface for Commercial BuildingsAI as an Interface for Commercial Buildings
AI as an Interface for Commercial BuildingsMemoori
 
Factors to Consider When Choosing Accounts Payable Services Providers.pptx
Factors to Consider When Choosing Accounts Payable Services Providers.pptxFactors to Consider When Choosing Accounts Payable Services Providers.pptx
Factors to Consider When Choosing Accounts Payable Services Providers.pptxKatpro Technologies
 
Key Features Of Token Development (1).pptx
Key  Features Of Token  Development (1).pptxKey  Features Of Token  Development (1).pptx
Key Features Of Token Development (1).pptxLBM Solutions
 
FULL ENJOY 🔝 8264348440 🔝 Call Girls in Diplomatic Enclave | Delhi
FULL ENJOY 🔝 8264348440 🔝 Call Girls in Diplomatic Enclave | DelhiFULL ENJOY 🔝 8264348440 🔝 Call Girls in Diplomatic Enclave | Delhi
FULL ENJOY 🔝 8264348440 🔝 Call Girls in Diplomatic Enclave | Delhisoniya singh
 
Maximizing Board Effectiveness 2024 Webinar.pptx
Maximizing Board Effectiveness 2024 Webinar.pptxMaximizing Board Effectiveness 2024 Webinar.pptx
Maximizing Board Effectiveness 2024 Webinar.pptxOnBoard
 
[2024]Digital Global Overview Report 2024 Meltwater.pdf
[2024]Digital Global Overview Report 2024 Meltwater.pdf[2024]Digital Global Overview Report 2024 Meltwater.pdf
[2024]Digital Global Overview Report 2024 Meltwater.pdfhans926745
 
The Codex of Business Writing Software for Real-World Solutions 2.pptx
The Codex of Business Writing Software for Real-World Solutions 2.pptxThe Codex of Business Writing Software for Real-World Solutions 2.pptx
The Codex of Business Writing Software for Real-World Solutions 2.pptxMalak Abu Hammad
 
08448380779 Call Girls In Greater Kailash - I Women Seeking Men
08448380779 Call Girls In Greater Kailash - I Women Seeking Men08448380779 Call Girls In Greater Kailash - I Women Seeking Men
08448380779 Call Girls In Greater Kailash - I Women Seeking MenDelhi Call girls
 
08448380779 Call Girls In Diplomatic Enclave Women Seeking Men
08448380779 Call Girls In Diplomatic Enclave Women Seeking Men08448380779 Call Girls In Diplomatic Enclave Women Seeking Men
08448380779 Call Girls In Diplomatic Enclave Women Seeking MenDelhi Call girls
 
Breaking the Kubernetes Kill Chain: Host Path Mount
Breaking the Kubernetes Kill Chain: Host Path MountBreaking the Kubernetes Kill Chain: Host Path Mount
Breaking the Kubernetes Kill Chain: Host Path MountPuma Security, LLC
 
Swan(sea) Song – personal research during my six years at Swansea ... and bey...
Swan(sea) Song – personal research during my six years at Swansea ... and bey...Swan(sea) Song – personal research during my six years at Swansea ... and bey...
Swan(sea) Song – personal research during my six years at Swansea ... and bey...Alan Dix
 
Install Stable Diffusion in windows machine
Install Stable Diffusion in windows machineInstall Stable Diffusion in windows machine
Install Stable Diffusion in windows machinePadma Pradeep
 
Benefits Of Flutter Compared To Other Frameworks
Benefits Of Flutter Compared To Other FrameworksBenefits Of Flutter Compared To Other Frameworks
Benefits Of Flutter Compared To Other FrameworksSoftradix Technologies
 
SIEMENS: RAPUNZEL – A Tale About Knowledge Graph
SIEMENS: RAPUNZEL – A Tale About Knowledge GraphSIEMENS: RAPUNZEL – A Tale About Knowledge Graph
SIEMENS: RAPUNZEL – A Tale About Knowledge GraphNeo4j
 
Unblocking The Main Thread Solving ANRs and Frozen Frames
Unblocking The Main Thread Solving ANRs and Frozen FramesUnblocking The Main Thread Solving ANRs and Frozen Frames
Unblocking The Main Thread Solving ANRs and Frozen FramesSinan KOZAK
 
Kotlin Multiplatform & Compose Multiplatform - Starter kit for pragmatics
Kotlin Multiplatform & Compose Multiplatform - Starter kit for pragmaticsKotlin Multiplatform & Compose Multiplatform - Starter kit for pragmatics
Kotlin Multiplatform & Compose Multiplatform - Starter kit for pragmaticscarlostorres15106
 

Kürzlich hochgeladen (20)

Enhancing Worker Digital Experience: A Hands-on Workshop for Partners
Enhancing Worker Digital Experience: A Hands-on Workshop for PartnersEnhancing Worker Digital Experience: A Hands-on Workshop for Partners
Enhancing Worker Digital Experience: A Hands-on Workshop for Partners
 
#StandardsGoals for 2024: What’s new for BISAC - Tech Forum 2024
#StandardsGoals for 2024: What’s new for BISAC - Tech Forum 2024#StandardsGoals for 2024: What’s new for BISAC - Tech Forum 2024
#StandardsGoals for 2024: What’s new for BISAC - Tech Forum 2024
 
IAC 2024 - IA Fast Track to Search Focused AI Solutions
IAC 2024 - IA Fast Track to Search Focused AI SolutionsIAC 2024 - IA Fast Track to Search Focused AI Solutions
IAC 2024 - IA Fast Track to Search Focused AI Solutions
 
WhatsApp 9892124323 ✓Call Girls In Kalyan ( Mumbai ) secure service
WhatsApp 9892124323 ✓Call Girls In Kalyan ( Mumbai ) secure serviceWhatsApp 9892124323 ✓Call Girls In Kalyan ( Mumbai ) secure service
WhatsApp 9892124323 ✓Call Girls In Kalyan ( Mumbai ) secure service
 
AI as an Interface for Commercial Buildings
AI as an Interface for Commercial BuildingsAI as an Interface for Commercial Buildings
AI as an Interface for Commercial Buildings
 
Factors to Consider When Choosing Accounts Payable Services Providers.pptx
Factors to Consider When Choosing Accounts Payable Services Providers.pptxFactors to Consider When Choosing Accounts Payable Services Providers.pptx
Factors to Consider When Choosing Accounts Payable Services Providers.pptx
 
Key Features Of Token Development (1).pptx
Key  Features Of Token  Development (1).pptxKey  Features Of Token  Development (1).pptx
Key Features Of Token Development (1).pptx
 
FULL ENJOY 🔝 8264348440 🔝 Call Girls in Diplomatic Enclave | Delhi
FULL ENJOY 🔝 8264348440 🔝 Call Girls in Diplomatic Enclave | DelhiFULL ENJOY 🔝 8264348440 🔝 Call Girls in Diplomatic Enclave | Delhi
FULL ENJOY 🔝 8264348440 🔝 Call Girls in Diplomatic Enclave | Delhi
 
Maximizing Board Effectiveness 2024 Webinar.pptx
Maximizing Board Effectiveness 2024 Webinar.pptxMaximizing Board Effectiveness 2024 Webinar.pptx
Maximizing Board Effectiveness 2024 Webinar.pptx
 
[2024]Digital Global Overview Report 2024 Meltwater.pdf
[2024]Digital Global Overview Report 2024 Meltwater.pdf[2024]Digital Global Overview Report 2024 Meltwater.pdf
[2024]Digital Global Overview Report 2024 Meltwater.pdf
 
The Codex of Business Writing Software for Real-World Solutions 2.pptx
The Codex of Business Writing Software for Real-World Solutions 2.pptxThe Codex of Business Writing Software for Real-World Solutions 2.pptx
The Codex of Business Writing Software for Real-World Solutions 2.pptx
 
08448380779 Call Girls In Greater Kailash - I Women Seeking Men
08448380779 Call Girls In Greater Kailash - I Women Seeking Men08448380779 Call Girls In Greater Kailash - I Women Seeking Men
08448380779 Call Girls In Greater Kailash - I Women Seeking Men
 
08448380779 Call Girls In Diplomatic Enclave Women Seeking Men
08448380779 Call Girls In Diplomatic Enclave Women Seeking Men08448380779 Call Girls In Diplomatic Enclave Women Seeking Men
08448380779 Call Girls In Diplomatic Enclave Women Seeking Men
 
Breaking the Kubernetes Kill Chain: Host Path Mount
Breaking the Kubernetes Kill Chain: Host Path MountBreaking the Kubernetes Kill Chain: Host Path Mount
Breaking the Kubernetes Kill Chain: Host Path Mount
 
Swan(sea) Song – personal research during my six years at Swansea ... and bey...
Swan(sea) Song – personal research during my six years at Swansea ... and bey...Swan(sea) Song – personal research during my six years at Swansea ... and bey...
Swan(sea) Song – personal research during my six years at Swansea ... and bey...
 
Install Stable Diffusion in windows machine
Install Stable Diffusion in windows machineInstall Stable Diffusion in windows machine
Install Stable Diffusion in windows machine
 
Benefits Of Flutter Compared To Other Frameworks
Benefits Of Flutter Compared To Other FrameworksBenefits Of Flutter Compared To Other Frameworks
Benefits Of Flutter Compared To Other Frameworks
 
SIEMENS: RAPUNZEL – A Tale About Knowledge Graph
SIEMENS: RAPUNZEL – A Tale About Knowledge GraphSIEMENS: RAPUNZEL – A Tale About Knowledge Graph
SIEMENS: RAPUNZEL – A Tale About Knowledge Graph
 
Unblocking The Main Thread Solving ANRs and Frozen Frames
Unblocking The Main Thread Solving ANRs and Frozen FramesUnblocking The Main Thread Solving ANRs and Frozen Frames
Unblocking The Main Thread Solving ANRs and Frozen Frames
 
Kotlin Multiplatform & Compose Multiplatform - Starter kit for pragmatics
Kotlin Multiplatform & Compose Multiplatform - Starter kit for pragmaticsKotlin Multiplatform & Compose Multiplatform - Starter kit for pragmatics
Kotlin Multiplatform & Compose Multiplatform - Starter kit for pragmatics
 

Empfohlen

How to Prepare For a Successful Job Search for 2024
How to Prepare For a Successful Job Search for 2024How to Prepare For a Successful Job Search for 2024
How to Prepare For a Successful Job Search for 2024Albert Qian
 
Social Media Marketing Trends 2024 // The Global Indie Insights
Social Media Marketing Trends 2024 // The Global Indie InsightsSocial Media Marketing Trends 2024 // The Global Indie Insights
Social Media Marketing Trends 2024 // The Global Indie InsightsKurio // The Social Media Age(ncy)
 
Trends In Paid Search: Navigating The Digital Landscape In 2024
Trends In Paid Search: Navigating The Digital Landscape In 2024Trends In Paid Search: Navigating The Digital Landscape In 2024
Trends In Paid Search: Navigating The Digital Landscape In 2024Search Engine Journal
 
5 Public speaking tips from TED - Visualized summary
5 Public speaking tips from TED - Visualized summary5 Public speaking tips from TED - Visualized summary
5 Public speaking tips from TED - Visualized summarySpeakerHub
 
ChatGPT and the Future of Work - Clark Boyd
ChatGPT and the Future of Work - Clark Boyd ChatGPT and the Future of Work - Clark Boyd
ChatGPT and the Future of Work - Clark Boyd Clark Boyd
 
Getting into the tech field. what next
Getting into the tech field. what next Getting into the tech field. what next
Getting into the tech field. what next Tessa Mero
 
Google's Just Not That Into You: Understanding Core Updates & Search Intent
Google's Just Not That Into You: Understanding Core Updates & Search IntentGoogle's Just Not That Into You: Understanding Core Updates & Search Intent
Google's Just Not That Into You: Understanding Core Updates & Search IntentLily Ray
 
Time Management & Productivity - Best Practices
Time Management & Productivity -  Best PracticesTime Management & Productivity -  Best Practices
Time Management & Productivity - Best PracticesVit Horky
 
The six step guide to practical project management
The six step guide to practical project managementThe six step guide to practical project management
The six step guide to practical project managementMindGenius
 
Beginners Guide to TikTok for Search - Rachel Pearson - We are Tilt __ Bright...
Beginners Guide to TikTok for Search - Rachel Pearson - We are Tilt __ Bright...Beginners Guide to TikTok for Search - Rachel Pearson - We are Tilt __ Bright...
Beginners Guide to TikTok for Search - Rachel Pearson - We are Tilt __ Bright...RachelPearson36
 
Unlocking the Power of ChatGPT and AI in Testing - A Real-World Look, present...
Unlocking the Power of ChatGPT and AI in Testing - A Real-World Look, present...Unlocking the Power of ChatGPT and AI in Testing - A Real-World Look, present...
Unlocking the Power of ChatGPT and AI in Testing - A Real-World Look, present...Applitools
 
12 Ways to Increase Your Influence at Work
12 Ways to Increase Your Influence at Work12 Ways to Increase Your Influence at Work
12 Ways to Increase Your Influence at WorkGetSmarter
 
Ride the Storm: Navigating Through Unstable Periods / Katerina Rudko (Belka G...
Ride the Storm: Navigating Through Unstable Periods / Katerina Rudko (Belka G...Ride the Storm: Navigating Through Unstable Periods / Katerina Rudko (Belka G...
Ride the Storm: Navigating Through Unstable Periods / Katerina Rudko (Belka G...DevGAMM Conference
 
Barbie - Brand Strategy Presentation
Barbie - Brand Strategy PresentationBarbie - Brand Strategy Presentation
Barbie - Brand Strategy PresentationErica Santiago
 
Good Stuff Happens in 1:1 Meetings: Why you need them and how to do them well
Good Stuff Happens in 1:1 Meetings: Why you need them and how to do them wellGood Stuff Happens in 1:1 Meetings: Why you need them and how to do them well
Good Stuff Happens in 1:1 Meetings: Why you need them and how to do them wellSaba Software
 
Introduction to C Programming Language
Introduction to C Programming LanguageIntroduction to C Programming Language
Introduction to C Programming LanguageSimplilearn
 

Empfohlen (20)

How to Prepare For a Successful Job Search for 2024
How to Prepare For a Successful Job Search for 2024How to Prepare For a Successful Job Search for 2024
How to Prepare For a Successful Job Search for 2024
 
Social Media Marketing Trends 2024 // The Global Indie Insights
Social Media Marketing Trends 2024 // The Global Indie InsightsSocial Media Marketing Trends 2024 // The Global Indie Insights
Social Media Marketing Trends 2024 // The Global Indie Insights
 
Trends In Paid Search: Navigating The Digital Landscape In 2024
Trends In Paid Search: Navigating The Digital Landscape In 2024Trends In Paid Search: Navigating The Digital Landscape In 2024
Trends In Paid Search: Navigating The Digital Landscape In 2024
 
5 Public speaking tips from TED - Visualized summary
5 Public speaking tips from TED - Visualized summary5 Public speaking tips from TED - Visualized summary
5 Public speaking tips from TED - Visualized summary
 
ChatGPT and the Future of Work - Clark Boyd
ChatGPT and the Future of Work - Clark Boyd ChatGPT and the Future of Work - Clark Boyd
ChatGPT and the Future of Work - Clark Boyd
 
Getting into the tech field. what next
Getting into the tech field. what next Getting into the tech field. what next
Getting into the tech field. what next
 
Google's Just Not That Into You: Understanding Core Updates & Search Intent
Google's Just Not That Into You: Understanding Core Updates & Search IntentGoogle's Just Not That Into You: Understanding Core Updates & Search Intent
Google's Just Not That Into You: Understanding Core Updates & Search Intent
 
How to have difficult conversations
How to have difficult conversations How to have difficult conversations
How to have difficult conversations
 
Introduction to Data Science
Introduction to Data ScienceIntroduction to Data Science
Introduction to Data Science
 
Time Management & Productivity - Best Practices
Time Management & Productivity -  Best PracticesTime Management & Productivity -  Best Practices
Time Management & Productivity - Best Practices
 
The six step guide to practical project management
The six step guide to practical project managementThe six step guide to practical project management
The six step guide to practical project management
 
Beginners Guide to TikTok for Search - Rachel Pearson - We are Tilt __ Bright...
Beginners Guide to TikTok for Search - Rachel Pearson - We are Tilt __ Bright...Beginners Guide to TikTok for Search - Rachel Pearson - We are Tilt __ Bright...
Beginners Guide to TikTok for Search - Rachel Pearson - We are Tilt __ Bright...
 
Unlocking the Power of ChatGPT and AI in Testing - A Real-World Look, present...
Unlocking the Power of ChatGPT and AI in Testing - A Real-World Look, present...Unlocking the Power of ChatGPT and AI in Testing - A Real-World Look, present...
Unlocking the Power of ChatGPT and AI in Testing - A Real-World Look, present...
 
12 Ways to Increase Your Influence at Work
12 Ways to Increase Your Influence at Work12 Ways to Increase Your Influence at Work
12 Ways to Increase Your Influence at Work
 
ChatGPT webinar slides
ChatGPT webinar slidesChatGPT webinar slides
ChatGPT webinar slides
 
More than Just Lines on a Map: Best Practices for U.S Bike Routes
More than Just Lines on a Map: Best Practices for U.S Bike RoutesMore than Just Lines on a Map: Best Practices for U.S Bike Routes
More than Just Lines on a Map: Best Practices for U.S Bike Routes
 
Ride the Storm: Navigating Through Unstable Periods / Katerina Rudko (Belka G...
Ride the Storm: Navigating Through Unstable Periods / Katerina Rudko (Belka G...Ride the Storm: Navigating Through Unstable Periods / Katerina Rudko (Belka G...
Ride the Storm: Navigating Through Unstable Periods / Katerina Rudko (Belka G...
 
Barbie - Brand Strategy Presentation
Barbie - Brand Strategy PresentationBarbie - Brand Strategy Presentation
Barbie - Brand Strategy Presentation
 
Good Stuff Happens in 1:1 Meetings: Why you need them and how to do them well
Good Stuff Happens in 1:1 Meetings: Why you need them and how to do them wellGood Stuff Happens in 1:1 Meetings: Why you need them and how to do them well
Good Stuff Happens in 1:1 Meetings: Why you need them and how to do them well
 
Introduction to C Programming Language
Introduction to C Programming LanguageIntroduction to C Programming Language
Introduction to C Programming Language
 

How Security Designed with the Cloud Migration Process in Mind Improves an Enterprise’s Risk Posture from Top to Bottom

  • 1. Page 1 of 13 How Security Designed with the Cloud Migration Process in Mind Improves an Enterprise’s Risk Posture from Top to Bottom A discussion on how cloud deployment planners need to be ever-vigilant for all types of cyber security attack vectors and make their data and processes safer and easier to recover from security incidents. Listen to the podcast. Find it on iTunes. Download the transcript. Sponsors: Unisys and Microsoft. Dana Gardner: Hi, this is Dana Gardner, Principal Analyst at Interarbor Solutions, and you are listening to BriefingsDirect. This next data security insights discussion explores how cloud deployment planners need to be ever-vigilant for all types of cybersecurity attack vectors. Stay with us now as we examine how those moving to and adapting to cloud deployments can make their data and processes safer and easier to recover from security incidents. To learn more about taking the right precautions for cloud and distributed data safety, please join me now in welcoming Mark McIntyre, Senior Director of Cybersecurity Solutions Group at Microsoft. Welcome, Mark. Mark McIntyre: Thank you very much. I appreciate it. Gardner: We are also here with Sudhir Mehta, Global Vice President of Product Management and Strategy at Unisys. Welcome, Sudhir. Sudhir Mehta: Hey, Dana, thanks for having me. Gardner: Mark, what’s changed in how data is being targeted for those using cloud models like Microsoft Azure? How is that different from two or three years ago? Change in cloud worldwide McIntyre
  • 2. Page 2 of 13 McIntyre: First of all, the good news is that we see more and more organizations around the world, including the US government, but broadly more global, pursuing cloud adoption. I think that’s great. Organizations around the world recognize the business value and I think increasingly the security value. The challenge I see is one of expectations. Who owns what, as you go to the cloud? And so we need to be crisper and clearer with our partners and customers as to who owns what responsibility in terms of monitoring and managing in a team environment as you transition from a traditional on-premises environments all the way up into a software-as- a-services (SaaS) environment. Gardner: Sudhir, what’s changed from your perspective at Unisys as to what the cloud adoption era security requirements are? Mehta: When organizations move data and workloads to the cloud, many of them underestimate the complexities of securing hybrid, on-premises, and cloud ecosystems. A lot of the failures, or what we would call security breaches or intrusions, you can attribute to inadequate security practices, policies, procedures, and misconfiguration errors. As a result, cloud security breach reports have been on the rise. Container technology adds flexibility and speed- to-market, but it is also introducing a lot of vulnerability and complexity. A lot of customers have legacy, on-premises security methodologies and technologies, which obviously they can no longer use or leverage in the new, dynamic, elastic nature of today’s cloud environments. Gartner estimates that through 2022 at least 95 percent of cloud security failures will be the customers’ fault. So the net effect is cloud security exposure, the attack surface, is on the rise. The exposure is growing. Gardner: People, process, and technology all change as organizations move to the cloud. And so security best practices can fall through the cracks. What are you seeing, Mark, in how a comprehensive cloud security approach can be brought to this transition so that cloud retains its largely sterling reputation for security? McIntyre: I completely agree with what my colleague from Unisys said. Not to crack a joke -- this is a serious topic -- but my colleagues and I meet a lot with both US government and commercial counterparts. And they ask us, “Microsoft, as a large cloud provider, what keeps you awake at night? What are you afraid of?” Mehta
  • 3. Page 3 of 13 It’s always a delicate conversation because we need to tactfully turn it around and say, “Well, you, the customer, you keep us awake at night. When you come into our cloud, we inherit your adversaries. We inherit your vulnerabilities and your configuration challenges.” As our customers plan a cloud migration, it will invariably include a variety of resources being left on-premises, in a traditional IT infrastructure. We need to make sure that we help them understand the benefits already built into the cloud, whether they are seeking infrastructure-as-a-service (IaaS), platform-as-a-service (PaaS), or SaaS. We need to be really clear with our customers -- through our partners, in many cases – about the technologies that they need to make themselves more secure. We need to give them awareness into their posture so that it is built right into the fabric of the cloud service. Gardner: Sudhir, it sounds as if organizations who haven’t been doing things quite as well as they should on-premises need to be even more mindful of improving on their security posture as they move to the cloud, so that they don’t take their vulnerabilities with them. From Unisys’s perspective, how should organizations get their housecleaning in order before they move to the cloud? Don’t bring unsafe baggage to the cloud Mehta: We always recommend that customers should absolutely first look at putting their house in order. Security hygiene is extremely important, whether you look at data protection, information protection, or your overall access exposure. That can be from employees working at home or through to vendors or third-parties -- wherever they have access to a lot of your information and data. First and foremost, make sure you have the appropriate framework established. Then compliance and policy management are extremely important when you move to the cloud and to virtual and containerized frameworks. Today, many companies do their application development in the cloud because it’s a lot more dynamic. We recommend that our customers make sure they have the appropriate policy management, assessments, and compliance checks in place for both on-premises and then for your journey to the cloud. The net of it is, if you are appropriately managed when you are on-premises, chances are as you move from hybrid to more of a cloud-native deployment and/or cloud-native services, you are more likely to get it right. If you don’t have it all in place when you are on-premises, you have an uphill battle in making sure you are secured in the cloud. Gardner: Mark, are there any related issues around identity and authentication as organizations move from on-premises to outside of their firewall into cloud deployment? When you come into our cloud, we inherit your adversaries. We inherit your vulnerabilities and your configuration challenges.
  • 4. Page 4 of 13 What should organizations be thinking about specifically around identity and authentication? Avoid an identity crisis McIntyre: This is a huge area of focus right now. Even within our own company, at Microsoft, we as employees operate in essentially an identity-driven security model. And so it’s proper that you call this out on this podcast. The idea that you can monitor and filter all traffic, and that you are going to make meaningful conclusions from that in real time -- while still running your business and pursuing your mission -- is not the best use of your time and your resources. It’s much better to switch to a more modern, identity-based model where you can actually incorporate newer concepts. Within Microsoft, we have a term called Modern Workplace. It’s a reflection of the fact that government organizations and enterprises around the world are having to anticipate and hopefully provide a collaborative work environment where people can work in a way that reflects their personal preferences around devices and working at home or on the road at a coffee shop or restaurant -- or whatever. The concept of work has changed around enterprise and is definitely forcing this opportunity to look at creating a more modern identity framework. If you look at some of the initiatives in the US government right now, we hear the term Zero Trust. That includes Zero Trust networking and micro-segmentation. Initiatives like these recognize that we know people need to keep working and doing their jobs wherever they are. The idea is to accept the fact that people will always cause some level of risk to the organization. We are curious, reasonably smart, well- intentioned people, and we make mistakes, just like anybody else. Let’s create an identity-driven model that allows the organization to get better insight and control over authentications, requests for resources, end-to-end, and throughout a lifecycle. Gardner: Sudhir, Unisys has been working with a number of public-sector organizations on technologies that support a stronger posture around authentication and other technologies. Tell us about what you have found over the past few years and how that can be applied to these challenges of moving to a cloud like Microsoft Azure. Mehta: Dana, going back in time, one of the requests we had from the US Department of Defense (DoD) on the networking side, was a concern around access to sensitive information and data. Unisys was requested by the DoD to develop a framework and Let’s create an identity-driven model that allows the organization to get better insight and control over authentications, requests for resources, end-to- end, and throughout a lifecycle.
  • 5. Page 5 of 13 implement a solution. They were looking at more of a micro-segmentation solution, very similar to what Mark just described. So, fast forward, since then we have deployed and released a military-grade capability called Unisys Stealth®, wherein we are able to manage micro-segmentation, what we classify as key-based, encrypted micro-segmentation, that controls access to different hosts or endpoints based on the identity of the user. It permits only authorized users to communicate with approved endpoints and denies unauthorized communications, and so prevents the spread of east-to-west, lateral attacks. Gardner: Mark, for those in our audience who aren’t that technology savvy, what does micro-segmentation mean? Why has it become an important foundational capability for security across a cloud-use environment? Need-to-know access for people and devices McIntyre: First of all, I want to call out Unisys’s great work here and their leadership in the last several years. It means a Zero-Trust environment can essentially gauge or control east-to-west behavior or activity in a distributed environment. For example, in a traditional IT environment, devices are not really well-managed when they are centralized, corporate-issued devices. You can’t take them out of the facility, of course. You don’t authenticate once you are on a network because you are already in a physical campus environment. But it’s different in a modern, collaborative environment. Enterprises are generally ahead on this change, but it’s now coming into government requirements, too. And so now, you essentially can parse out your subjects and your objects, your subjects trying to access objects. You can spit them out and say, “We are going to create all user accounts with a certain set of parameters.” It amounts to a privileged, need-to-know model. You can enforce strong controls with a set of certain release-privilege rights. And, of course, in an ideal world, you could go a step further and start implementing biometrics [to authenticate] to get off of password dependencies. But number one, you want to verify the identity. Is this a person? Is this the subject who we think they are? Are they that subject based on a corroborating variety of different attributes, behaviors, and activities? Things like that. And then you can also apply the same controls to a device and say, “Okay, this user is using a certain device. Is this device healthy? Is it built to today’s image? Is it patched, clean, and approved to be used in this environment? And if so, to what level?” And then you can even go a step further and say, “In this model, now that we can verify the access, should this person be able to use our resources through the public Internet You want to verify the identity. Is this a person? … This user is using a certain device. Is this device healthy?
  • 6. Page 6 of 13 and access certain corporate resources? Should we allow an unmanaged device to have a level of access to confidential documents within the company? Maybe that should only be on a managed device.” So you can create these flexible authentication scenarios based on what you know about the subjects at hand, about the objects, and about the files that they want to access. It’s a much more flexible, modern way to interact. Within Azure cloud, Microsoft Azure Active Directory services offer those capabilities – they are just built into the service. So micro-segmentation might sound like a lot of work for your security or identity team, but it’s a great example of a cloud service that runs in the background to help you set up the right rules and then let the service work for you. Gardner: Sudhir, just to be clear, the Unisys Stealth(cloud) Extended Data Center for Microsoft Azure is a service that you get from the cloud? Or is that something that you would implement on-premises? Are there different models for how you would implement and deploy this? A hybrid, stealthy and healthy, cloud journey Mehta: We have been working with Microsoft over the years on Stealth, and we have a fantastic relationship with Microsoft. If you are a customer going through a cloud journey, we deploy what we call a hybrid Stealth deployment. In other words, we help customers do what we call isolation with the help of communities of interests that we create that are basically groupings of hosts, users, and resources based on like interests. Then, when there is a request to communicate, you create the appropriate Stealth- encrypted tunnels. If you have a scenario where you are doing the appropriate communication between an on-premises host and a cloud-based host, you do that through a secure, encrypted tunnel. We have also implemented what we call cloaking. With cloaking, if someone is not authorized to communicate with a certain host or a certain member of a community of interest, you basically do not give a response back. So cloaking is also part of the Stealth implementation. And in working closely with Microsoft, we have further established an automated capability through a discovery API. So when Microsoft releases new Azure services, we are able to update the overall Stealth protocol and framework with the updated Azure services. For customers who have Azure workloads protected by Stealth, there is no We deploy … a hybrid Stealth deployment. … We help customers do … isolation with the help of communities of interest that we create, that are basically groupings of hosts, users, and resources based on like interests.
  • 7. Page 7 of 13 disruption from a productivity standpoint. They can always securely leverage whatever applications they are running on Azure cloud. The net of it is being able to establish the appropriate secure journey for customers, from on-premises to the cloud, the hybrid journey. For customers leveraging Azure cloud with different workloads, we maintain the appropriate level of secure communications just as they would have in an on-premises deployment. Gardner: Mark, when does this become readily available? What’s the timeline on how these technologies come together to make a whole greater than the sum of the parts when it comes to hybrid security and authentication? McIntyre: Microsoft is already offering Zero Trust, identity-based security capabilities through our services. We haven’t traditionally named them as such, although we definitely are working along that path right now. Microsoft Chief Digital Officer and Executive Vice President Kurt DelBene is on the US Defense Innovation Board and is playing a leadership role in establishing essentially a DoD or US government priority on Zero Trust. In the next several months, we will be putting more clarity around how our partners and customers can better map capabilities that they already own against emerging priorities and requirements like these. So definitely look for that. In fact, Ignite DC is February 6 and 7, in downtown Washington, DC, and Zero Trust is certainly on the agenda there, so there will be updates at that conference. But generally speaking, any customer can take the underlying services that we are offering and implement this now. What’s even better, we have companies that are already out there doing this. And we rely greatly on our partners like Unisys to go out and really have those deep architecture conversations with their stakeholders. Gardner: Sudhir, when people use the combined solution of Microsoft Azure and Stealth for cloud, how can they react to attacks that may get through to prevent damage from spreading? Contain contagion, quickly Mehta: Good question! Internally within Unisys’s own IT organization, we have already moved on this cloud journey. Stealth is already securing our Azure cloud deployments and we are 95 percent deployed on Azure in terms of internal Unisys applications. So we like to eat our own dog food. Generally speaking, any customer can take the underlying services that we are offering and implement this now.
  • 8. Page 8 of 13 If there is a situation where there is an incident of compromise, we have a capability called dynamic isolation, where if you are looking at a managed security operations center (SOC) situation, we have empowered the SOC to contain a risk very quickly. We are able to isolate a user and their device within 10 seconds. If you have a situation where someone turns nefarious, intentionally or coincidentally, we are able to isolate the user and then implement different thresholds of isolation. If a high threshold level is breached across 8 out of 10, that means we completely isolate that user. If there is a threshold level of 5 or 6, we may still give the user certain levels of access. So within a certain group they would continue to access or be able to communicate. Dynamic isolation isolates a user and their device with different levels of thresholds while we have like a managed SOC go through their cycles of trying to identify what really happened as part of what we would call an advanced response. Unisys is the only solution where we can actually isolate a user or the device within the span of seconds. We can do it now within 10 seconds. McIntyre: Getting back to your question about Microsoft’s plans, I’m very happy to share how we’ve managed Zero Trust. Essentially it relies on Intune for device management and Azure Active Directory for identity. It’s the way that we right now internally manage our own employees. My access to corporate resources can come via my personal device and work-issued device. I’m very happy with what Unisys already has available and what we have out there. It’s a really strong reference architecture that’s already generally available. Gardner: Our discussion began with security for the US DoD, among the largest enterprises you could conceive of. But I’m wondering if this is something that goes down market as well, to small- to medium-sized businesses (SMBs) that are using Azure and/or are moving from an on-premises model. Do Zero Trust and your services apply to the mom and pop shops, SMBs, and the largest enterprises? All sizes of businesses welcome McIntyre: Yes, this is something that would be ideally available for an SMB because they likely do not have large logistical or infrastructure dependencies. They are probably more flexible in how they can implement solutions. It’s a great way to go into the cloud and a great way for them to save money upfront over traditional IT infrastructure. So SMBs should have a really good chance to literally, natively take an idea like this and implement it. Unisys is the only solution where we can actually isolate a user or the device within the span of … 10 seconds.
  • 9. Page 9 of 13 Gardner: Sudhir, anything to offer on that in terms of the technology and how it’s applicable both up and down market? Mehta: Mark is spot on. Unisys Stealth resonates really well for SMBs and the enterprise. SMBs benefit, as Mark mentioned, in their capability to move quickly. And with Stealth, we have an innovative capability that can discover and visualize your users. Thereafter, you can very quickly and automatically virtualize any network into the communities of interest I mentioned earlier. SMBs can get going within a day or two. If you’re a large enterprise, you can define your journey -- whether it’s from on-premises to cloud -- depending on what you’re actually trying to migrate or run in the cloud. So I would say absolutely both. And it would also depend on what you’re really looking at managing and deploying, but the opportunities are there for both SMBs and enterprises. Gardner: As companies large and small are evaluating this and trying to discern their interest, let’s look at some of the benefits. As you pointed out, Sudhir, you’re eating your own dog food at Unisys. And Mark has described how this is also being used internally at Microsoft as well. Do you have ways that you can look at before and after, measure quantitatively, qualitative, maybe anecdotally, why this has been beneficial? It’s always hard in security to prove something that didn’t happen and why it didn’t happen. But what do you get when you do Stealth well? The proof is in the profit and protection Mehta: There are a couple of things, Dana. So one is there is certainly a reduction in cost. When we deploy for 20,000 Unisys employees, our Chief Information Security Officer (CISO) obviously has to be a big supporter of Stealth. His read is from a cost perspective that we have seen significant reductions in costs. Prior to having Stealth implemented, we had a certain approach as relates to network segmentation. From a network equipment perspective, we’ve seen a reduction of over 70 percent. If you look at server infrastructure, there has been a reduction of more than 50 percent. The maintenance and labor costs have had a reduction north of 60 percent. Ongoing support labor cost has also seen a significant reduction as well. So that’s one lens you could look at. The other lens that has been interesting is the virtual private network (VPN) exposure. As many of us know, VPNs are perhaps the best breach route for hackers today. When we’ve implemented Stealth internally within Unisys, for a lot of our applications we have It would depend on what you’re really looking at managing and deploying, but the opportunities are there for both SMBs and enterprises.
  • 10. Page 10 of 13 done away with the requirement for logging into a VPN application. That has made for easier access to a lot of applications – mainly for folks logging in from home or from a Starbucks. Now when they communicate, it is through an encrypted tunnel and it’s very secure. The VPN exposure completely goes away. Those are the best two lenses I could give to the value proposition. Obviously there is cost reduction. And the other is the VPN exposure goes away, at least for Unisys that’s what we’ve found with implementing internally. Gardner: For those using VPNs, should they move to something like Stealth? Does the way in which VPNs add value change when you bring something like Stealth in? How much do you reevaluate your use of VPNs in general? Mehta: I would be remiss to say you can completely do away with VPNs. If you go back in time and see why VPNs were created, the overall framework was created for secure access for certain applications. Since then, for whatever reasons, VPNs became the only way people communicate from working at home, for example. So the way we look at this is, for applications that are not extremely limited to a few people, you should look at options wherein you don’t necessarily need a VPN. You could therefore look at a solution like Unisys Stealth. And then if there are certain applications that are extremely sensitive, limited to only a few folks for whatever reason, that’s where potentially you could consider using an application like a VPN. Gardner: Let’s look to the future. When you put these Zero Trust services into practice, into a hybrid cloud, then ultimately a fully cloud-native environment, what’s the next shoe to fall? Are there some things you gain when you enter into this level of micro- segmentation, by exploiting these newer technologies? Can this value be extended to the edge, for example? Does it have a role in Internet of things (IoT)? A role in data transfers from organization to organization? What does this put us in a position to do in the future that we couldn’t have done previously? Machining the future, securely McIntyre: You hit on two really important points. Obviously devices, IoT devices, for example, and data. So data increasingly -- you see T-shirts out and you see slogans, “Data is the new oil,” and such. From a security point of view there is no question this is becoming the case, when there’s something like 44 to 45 zettabytes of data projected to be out there for the next few years. You can employ traditional security monitoring practices, for example label-free detection, things like that. But it’s just not going to allow you to work quickly, especially in I would be remiss to say you can completely do away with VPNs.
  • 11. Page 11 of 13 an environment where we’re already challenged with having enough security workforce. There are not enough people out there, it’s a global talent shortage. It’s a fantastic opportunity forced on us to rely more on modern authentication frameworks and on machine learning (ML) and artificial intelligence (AI) technologies to take on a lot of that lower-level analysis, the log analysis work, out of human hands and have machines free people up for the higher-level work. For example, we have a really interesting situation within Microsoft. It goes around the industry as well. We have many organizations go into the cloud, but of course, as we mentioned earlier, it’s still unclear on the roles and responsibilities. We’re also seeing big gaps in use of cloud resources versus security tools built into those resources. And so we’re really trying to make sure that as we deliver new services to marketplace, for example, IoT, that those are built in a way that you can configure and monitor them like any other device in the company. With Azure, for example, we have IoT Hub. We can literally, as you build an IoT device, make sure that it is being monitored in the same way as your traditional infrastructure monitors. There should not be a gap there. You can still apply the same types of logical access controls around them. There shouldn’t be any tradeoffs on security for how you do security -- whether it’s IT or IoT. Gardner: Sudhir, same question, what is use of Stealth in conjunction with cloud activities get you in the future? Mehta: Tagging on to what Mark said, AI and ML are becoming interesting. We obviously had a very big digital workplace solutions organization. We are a market leader for services, for helpdesk services. We are looking at the introduction of a lot of what you would call as AIOps in automation as it leads to robotic process automation (RPA) and voice assistance. So one of the things we are observing is, as you go on this AI-ML, there is a larger exposure because you are focusing more around the operationalization in automation or AI-ML and certain areas where you may not be able to manage, for instance, the way you get the training done for your bots. So that’s where Stealth is a capability we are implementing right now with digital workplace solutions as part of a journey for AIOps automation as an example. The other area we are working very closely with some of other partners, as well as Microsoft, is around application security and hardening in the cloud. How do you make sure that when you deploy certain applications in the cloud you ensure that it is secure and it is not being breached, or are there intrusions when you try to make changes to your applications? There shouldn’t be any tradeoffs on security for how you do security – whether it’s IT or IoT.
  • 12. Page 12 of 13 Those are two areas we are currently working on, the AIOps and MLOps automation and then the application security and hardening in the cloud, working with Microsoft as well. Gardner: If I want to be as secure as I can, and I know that I’m going to be doing more in the cloud, what should I be doing now in order to make myself in the best position to take advantage of things like micro-segmentation and the technologies behind Stealth and how they apply to a cloud like Azure? How should I get myself ready to take advantage of these things? Plan ahead to secure success McIntyre: First thing is to remember how you plan and roll out your security estate. It should be no different than what you’re doing with your larger IT planning anyway, so it’s all digital transformation. First thing to do is close that gap between security teams. All the teams – business and IT -- should be working together. We want to make sure that our customers go to the cloud in a secure way, without losing this ability to access their data. We continue to put more effort in very proactive services -- architecture guidance, recommendations, things that can help people get started in the cloud. It’s called Azure Blueprints, a configuration guidance and predefined templates that can help an organization launch a resource in the cloud that’s already compliant against FedRAMP or NIST or ISO or HIPAA standards. We’ll continue to invest in the technologies that help customers securely deploy technologies or cloud resources from the get-go so that we close those gaps and configuration and close the gaps in reporting and telemetry as well. And we can’t do it without great partners that provide those customized solutions for each sector. Gardner: Sudhir, last word to you. What’s your advice for people to prepare themselves to be ready to take advantage of things like Stealth? Mehta: Look at a couple of things. One is focus on trusted identity in terms of who you work with, who you give access to. Even within your organization you obviously need to make sure you establish that trusted identity. And how you do it is you make sure it is simple. Second, look at an overlay network agnostic framework, which is where Stealth can help you. Make sure it is unique. One individual has one identity. Third is make sure it is refutable. So it’s undeniable in terms of how you implement it, and then the fourth is, make sure it’s got the highest level of efficacy, whether it’s related to how you deploy and it’s also the way you architect your solution. So, the net of it is, a) trust no one, b) assume a breach can occur, and then c) respond really fast to limit damage. If you do these three things, you can get to Zero Trust for your organization. a) trust no one, b) assume a breach can occur, and then c) respond really fast to limit damage.
  • 13. Page 13 of 13 Gardner: I’m afraid we’ll have to leave it there. You have been listening to a sponsored BriefingsDirect discussion on how cloud deployment planners need to be ever-vigilant for all types of cybersecurity attack vectors. And we’ve learned how Unisys helps Microsoft Azure users take the right precautions for better cloud and distributed users’ safety. So please join me in thanking our guests, Mark McIntyre, Senior Director of Cybersecurity Solutions Group at Microsoft, and Sudhir Mehta, Global Vice President of Product Management and Strategy at Unisys. Thank you so much. And a big thank you as well to our audience for joining this BriefingsDirect data security insights discussion. I’m Dana Gardner, Principal Analyst at Interarbor Solutions, your host throughout this series of Unisys- and Microsoft-sponsored BriefingsDirect discussions. Thanks again for listening. Please pass this along to your community and do come back next time. Listen to the podcast. Find it on iTunes. Download the transcript. Sponsors: Unisys and Microsoft. A discussion on how cloud deployment planners need to be ever-vigilant for all types of cyber security attack vectors and make their data and processes safer and easier to recover from security incidents. Copyright Interarbor Solutions, LLC, 2005-2020. All rights reserved. You may also be interested in: • How Unisys and Microsoft team up to ease complex cloud adoption for governments and enterprises • How Unisys and Dell EMC head off backup storage cyber security vulnerabilities • Data-driven and intelligent healthcare processes improve patient outcomes while making the IT increasingly invisible • Data-driven and intelligent healthcare processes improve patient outcomes while making the IT increasingly invisible • How The Open Group Healthcare Forum and Health Enterprise Reference Architecture cures process and IT ills • The next line of defense—How new security leverages virtualization to counter sophisticated threats • Expert Panel Explores the New Reality for Cloud Security and Trusted Mobile Apps Delivery • How IT innovators turn digital disruption into a business productivity force multiplier • How the Citrix Technology Professionals Program produces user experience benefits from greater ecosystem collaboration