Tag Archives: security

Security Challenges Encountered by Data Centers

Security Challenges Encountered by Data CentersLord Hewart coined the phrase “Not only must justice be done; it must also be seen to be done” way back in 1923. With a little adaptation, Lord Hewart’s words are as relevant in the corporate data center as they once were in the courtroom. What we end up with is something like “Not only must security controls be implemented; they must also be seen to be implemented.”

This sounds logical in an old-fashioned, non-virtualized data center, where physical wires connect everything, and the firewall controls, which servers can talk to each other. We can create VLANs to isolate network traffic and make access control lists to allow inter-server chat. Add-in IDS, vulnerability scanners and perhaps NAC for good measure and you have good control over your network. What’s more, we can pretty much see how it working.

The problem is that this is not what a modern data center looks like anymore. Over the last five or so years there has been a rapid transformation to the type of data center that is common today: one with many virtualized servers, and one in which 50% or more of all ports are virtual ports. There are no longer physical wires between each server, and the rate of growth in virtual ports is probably twice that of physical ones, so the process is only accelerating. The upshot is that virtualization has made network security and compliance very difficult to achieve, the old ways are no longer appropriate.

Data Centre Security Challenges:

The major challenge a Data Center encounters, even more than technology issues, is the human problem.

  • Implementing Security Controls is Time-Consuming. Many Organizations say it takes up to 4 hours to create a firewall rule for every new network application. Moreover, it takes days or weeks to update security services.
  • Network security is prone to human error resulting in a compromise on the data center services. Security vulnerability, or performance issue, and service interruption was tied to configuration errors.
  • It’s hard to change Security controls after the fact as majority of the organizations have expressed that they have no method for removing expired ACLs or firewall rules. Besides, removing expired ACLs or firewall rules is too time consuming.
  • Data center segmentation can help but only a few of them are doing it actually. Better segmentation will help solve the problem of criminals moving laterally across their data center.
  • Organizations need visibility of the security visibility into traffic flowing from one application to another. While all the organizations do want to use automation and orchestration to accelerate application deployment, most of them do not have the ability to do so.

Organizations are using multiple technologies to protect their data center servers and storage have multiple barriers – the details of which are shown in the image below.

Security Management Model

The security management models for cloud computing that cloud service providers must consider are required to cover the below aspects to make it effective and efficient:

  • People Security: A formal charter should be established for the security organization and program. Clearly outlined roles will guarantee in better understanding of the expectations of all team members.
  • Security Governance: A security steering committee must be in place, whose objective would be to focus on giving guidance regarding security initiatives and alignment with business and IT strategies.
  • Risk management: Risk management require identification of technology assets; recognition of data and its links to business processes, applications, and data stores; and assignment of possession and custodial responsibilities.
  • Risk assessment: Security risk assessment is essential to helping the information security organization build informed decisions when equalization the dueling preferences of business utility and protection of assets.
  • Data governance: This framework should describe who can decide what actionssolidated to multiple virtual machine instances on virtualized servers.
  • Disaster Recovery: Customers depend heavily on access to their services round-the-clock and any interference in access can be destructive. Using the virtualization software, virtual server backup is easily done.
  • Third party Risk Management: Third-party Risk Management Program helps in protecting the provider’s reputation and control revenue losses.
  • Vulnerability Assessment: Classifies network assets to greater efficiently prioritize vulnerability-mitigation programs, like patching and system enhancement.

Security Image Testing:   Virtualization-based cloud computing gives the ability to develop “Test image”, which gives the capability to maintain security up to date and decrease exposure by patching offline.

Making Secure Enterprise Mobility a Reality


Making Secure Enterprise Mobility a Reality

Enterprise mobility is taking the IT world by storm. One of the most prominent trend shifts over the last year has been the wide-ranging adoption of enterprise mobility in the business world. An on-the-ground transformation of this trend has been the shift away from the tunnel-like focus on mobile applications. A complete digital transformation is required within the enterprise, and enterprise mobility is a definite way forward. Continue reading

Internet of Everything – Security Concerns In a Connected Era


securing IoT

Imagine a world where every aspect of your life is connected. What you do is recorded by a growing number of connected devices you touch, interact and encounter every day. And then the collected data is shared over a network. Our world is becoming a central nervous system running on a network of connected devices.

By 2020, the number of internet-connected devices will reach 50 billion. Mathematically, that’s around 8 connected devices per person. And this indeed creates a simple but a dangerous dilemma. While our ability to collect data will grow via connected devices, there is hardly any adequate security system in place to protect and secure this data. Continue reading

Mobile & Cloud – The Top Security Concerns of 2016


top security concerns of 2016Mobile security challenges:

The mobile has taken center stage in all aspects of life, but its influence is perhaps most noticeable in the corporate sector where the influx of mobile technologies has brought a sea change in the way enterprises operate. The proliferation of mobile has naturally led to concerns regarding security.

Today, 2 out of 3 employees use their mobiles for work-related activities. More and more companies are adopting BYOD’s at their workplace. Mobiles have become a mine of sensitive corporate information and a probable entry point in the IT. In the event of a mobile getting lost or stolen, there is a high chance of sensitive data falling into the wrong hands. For example, according to OCR, there were 253 breaches affecting more than 500 individuals, and running into a combined loss of over 112 million records in healthcare sector. And in Japan, at least 2.07 million sets of personal data were stolen or feared leaked from 140 organizations in 2015, according to a Kyodo News survey. In automobile sector, Mercedes has filed a lawsuit against Benjamin Hoyle (the company’s former employee) for stealing confidential information before leaving to join a rival company. These are perilous security incidents that corporates and companies cannot overlook.
Continue reading

Educating Security Professionals on Virtual Technologies


education security

Network systems and applications are advancing in terms of technology every day. To keep an organisation safe from the threats related to data security, it is essential for security professionals to get a hands-on experience of the latest applications and software.

Data protection solutions discover and control information access by active users. Professionals who constantly keep track of the data security need to learn and understand new software programs that help in better data management. A robust plan on the use or application of technologically advanced software will help security professionals to keep their organisation safe from threats. Continue reading

Threats Due to Technological and Social Trends


Cyber-crimes are a fast developing reality. The year 2014 recorded the highest number of cyber threats and data ruptures. And the risk of cyber-crimes is only expected to increase this year.Here are some major threats associated with technology and social media.

BYOx at workplace

The“bring-your-own” trend is commonly seen in many organisations and few have developed policies to deal with it. Since the trend of bringing mobiles, applications and other devices is popular among employees, there is a high risk of security being compromised. The risk involved in unauthorised access can be a cause of both, internal and external threats. Other causes of threats would include unreliable business applications and misuse of the device. Continue reading

Building a Sustainable Mobile Infrastructure


According to a new mobile phone forecast from the International Data Corporation (IDCWorldwide Quarterly Mobile Phone Tracker, worldwide smartphone shipments reached a total of nearly 1.3 billion units in 2014, representing an increase of 26.3% over 2013. Looking ahead, IDC expects 1.4 billion smartphones to be shipped worldwide in 2015 for a 12.2% year-over-year growth rate. Continue reading

5 Key Aspects for a Robust Enterprise Security Management Strategy


Consider these alarming statistics:

  • Studies have revealed that on an average, companies are attacked about 16,856 times every year[1]
  • In 2013, between 68% and 82% of the S&P 500 companies had their internal systems compromised with external eventualities[2]

If you psychologically analyze an enterprise, you will observe that most organizations scale up their security infrastructure only after a breach! As to why they behave the way they do, is because of the issue of disrupting the functioning business critical operations. Continue reading