123ArticleOnline Logo
Welcome to 123ArticleOnline.com!

ALL >> Computers >> View Article

Cloud Security Innovators – Q+a With Jeff Blair, Ciso, Caa

By Author: Tomas Cohen
Total Articles: 16

We are thrilled to feature a Q+A session with Jeff Blair, CISO of Creative Artists Agency (CAA) in this month’s installment of the Cloud Security Innovators blog series. Jeff works for CAA, which represents the world’s most biggest athletes and movie stars. In this fast-paced and creative enviornment, Jeff is a maverick, helping lead the movement to the cloud with an innovative approach to securing cloud data and systems.

Q. How do you view the cloud? Friend? Foe? Necessary evil?
A. For us, the cloud is certainly a friend. That friendship helps to make us a better IT department and a better organization overall, but you have to build and validate the trust given to service providers over time.

Q. Are there any advantages to using cloud apps as it relates to security?
A. Advantages start with the level of trust you have in your providers. There’s a foundation of infrastructure comprising hardware and network services that you’re going to be completely abstracted from. Once you’ve established that trust, you see advantages with APIs and access to logging information that previously wasn’t easy to get from on premise solutions.

Q. It was a while back but still an important security event: How did your IT department respond to the Heartbleed breach?
A. Externally our exposure was limited to a few appliance servers that were quickly updated. Our efforts primarily focused on employee education. How do we rapidly understand impact to our employees? How do we communicate to employees what is secure and what isn’t, and what are the steps they should take? We sent out an email instructing them on an approach for changing passwords and implementing two-factor authentication. During this process we used Skyhigh to help us understand what vulnerable services were in use at the company and provide appropriate instruction to our employees on when to update their passwords.

Q. There is a lot of press around “encryption” as the silver bullet to address security issues relating to the cloud. Do you see encryption as the panacea?
A. I don’t see encryption as a silver bullet. It’s certainly one piece of the puzzle to protect your most sensitive information but usability has to improve significantly before broad adoption takes hold. Starting with a strategy of transparent encryption where keys are controlled by the enterprise is a great first step. This keeps your IaaS provider honest, protecting in those areas where you’re abstracted from the providers’ operations.

Q. What exactly do you mean when you say “transparent encryption”?
A. The application doesn’t know about the encryption. If you’re running workloads in Amazon, Microsoft or some other Iaas, then you need to own the key that encrypts the data on those disks. If information is mishandled by the provider, we need to ensure that data isn’t accessible. There’s a lot of complexity and management overhead that comes with encryption, and the higher up in the stack you move encryption, the more likely it impacts usability of the system. Initially you want to focus at the lower layers where it’s transparent to users and the applications and as the technology matures move further up the stack to provide additional protections where needed.

Q. There’s a phrase going around in the press right now: “user-centric IT.” Your department seems very user-centric.
A. We have to be; we have seen many examples where an IT-centric approach has resulted in low adoption of our applications. Usage of these systems quickly declines following deployment and users find other ways to get their job done outside of the managed systems. We’re not into building applications that people don’t use, and, with so much choice available today, we know employees will go around IT. Our efforts to build usage monitoring directly into our systems has allowed us to trial changes and has focused us on building features that are truly used and wanted. This direct monitoring of application usage combined with our use of Skyhigh to highlight gaps in our application coverage have been core elements in guiding user centric IT.

Q. As you look into your crystal ball, how will Cloud Security evolve over the next two or three years?
A. One of the greatest challenges around cloud right now is ensuring consistent identity. I see identity provisioning and authentication standards becoming far more solid over the next two to three years to the point where you can ensure your on premise directories and access policies are going to match up exactly with what is available in the cloud. Along with that, you will see mature, consistent APIs to allow logging data to be centralized and correlated across cloud providers. The biggest challenge today is most services provide the ability to collect usage and administrative information, but each service provides different logging APIs or forces you to access this information through their administrative portal; creating significant up front costs for integration. Increased standardization across security and identity integration models will bring us to new levels of security in the cloud in the next two to three years.

Author:
Tomas Cohen is a security enthusiast and analyst covering the most significant security topics and trends prevalent worldwide. He also involves in the technology related to Cloud Security, Data Loss Prevention, Cloud Data Security etc.,

Total Views: 219Word Count: 875See All articles From Author

Computers Articles

1. Settle Error 1335 Of Ms Office - Resolve Microsoft Office Error 1335 From Pc
Author: setupoffice

2. Get Great Features With Microsoft Office 365 Home Promo Code
Author: Christine Bleakley

3. Identity And Access Management: 5 Reasons Your Company Needs It Today!
Author: William Davis

4. Secure Health Information: 6 Best Practices To Maintain Data Privacy
Author: William Davis

5. Professional Script Design Enhances The Success Of Your Hyip Business Online
Author: eadricvinson

6. Why To Opt Dell Printer Tech Support Service?
Author: Technical Support

7. Surface Pro 4 Promo Code To Save Up To $320 On Surface Pro 4 Essentials Bundles
Author: Christine Bleakley

8. Learn Sap Course In Online
Author: Mind Q Online

9. Norton Tech Support
Author: Norton Phone Number

10. Custom Web Solutions By Uship Clone Script 2017
Author: sawati rawat

11. The Hunting Apps For Android Make Life Interesting In The Wilderness
Author: adsonronie

12. Instructions To Easy Way To Renew Your Own Mcafee Subscription Package
Author: Elina Jones

13. How To Fix The 1304 Error - Working Office Installation 1304 Error Fix
Author: setupoffice

14. 8 Golden Success Secrets For Small Businesses
Author: Amenda Ray

15. Solutions To A Series Of Most Common Norton Installation Errors
Author: Andrew Clark

Login To Account
Login Email:
Password:
Forgot Password?
New User?
Sign Up Newsletter
Email Address: