xto387

Lowering the Barrier to Security and Compliance in the Cloud Copyright © 2010 Honeycomb Xtalks Inc.
Philip Lieberman, Founder and CEO, Lieberman Software Corporation
Steve Staso, Cloud Computing Strategist, Field and Wave Solutions
Featured Speakers:

Copyright © 2010 Honeycomb Xtalks Inc. Lieberman Software The company released its first commercial product in 1994, but traces its roots back to 1978 when it was founded as a software consultancy. Since its inception, Lieberman Software has been a profitable, management owned firm. It has consistently provided unique solutions that fill the niche of managing local and domain security. For years, Lieberman Software products have been the choice of organizations concerned with locating and remediating problems occurring within the IT infrastructure, where rapid and comprehensive response is crucial. Lieberman Software pioneered the privileged account password management space by releasing the first product to this market in 2001. Since then, the company has regularly updated and expanded its privileged password solution set while growing its customer base in this vibrant and emerging market. Lieberman Software is a managed Microsoft Gold Certified Partner and also works with Oracle, Cisco, RSA, nCipher, Novell, Red Hat, Hewlett-Packard, IBM, Intel, and ArcSight in varying capacities. The company is headquartered in Los Angeles, CA and maintains an office in Austin, TX. All product development, testing, and support operations are based in the United States. For more information, please visit us on the web at www.liebsoft.com Sponsoring Partner:

Copyright © 2010 Honeycomb Xtalks Inc.
Steve Staso, Cloud Computing Strategist, Field and Wave Solutions
Steve Staso is the President of Field and Wave Solutions, an independent consulting organization that enables clients to gain a competitive advantage with cloud computing, web, and internet technologies. Steve is known as a strategic thinker and high level communicator. Equally familiar with the business drivers of both enterprises and startups, he applies best practices from both types of organizations to help solve complex business challenges using leading edge information technology. During the latter portion of his 13 years at Sun Microsystems, he pioneered a leading market position for scalable web infrastructures by conceptualizing the corporate strategy; driving the global sales engagement campaign and socializing the story through business partners and technical grassroots communities. Many websites such as LinkedIn, Facebook, SmugMug, Sina, Zhengtu and Betfair have all benefitted from Steve's technical leadership. Lowering the Barrier to Security and Compliance in the Cloud

Copyright © 2010 Honeycomb Xtalks Inc.
Philip Lieberman, Founder and CEO, Lieberman Software Corporation
Philip Lieberman, the founder and president of Lieberman Software, has more than 30 years of experience in the software industry. In addition to his proficiency as a software engineer, Mr. Lieberman is an astute entrepreneur able to perceive shortcomings in existing products on the market, and fill those gaps with innovative solutions. He developed the first products for the privileged identity management space, and continues to introduce new solutions to resolve the security threat of privileged account credentials. Mr. Lieberman has published numerous books and articles on computer science, has taught at UCLA, and has authored computer science courses for Learning Tree International. He has a B.A. from San Francisco State University. Lowering the Barrier to Security and Compliance in the Cloud

Steve Staso Cloud Computing Strategist Field and Wave Solutions

Trends in Cloud Computing
Review of NIST’s Cloud Computing
Deployment Models
Service Models
Cloud Security
Special Offer for Attendees

Cloud Computing can Drastically :
Lower Cost
Improve Time to Market
Increase Security
Increase Availability

Spending Growth: Worldwide market for Cloud computing is increasing from $45B in 2009 to $150B in 2013. And, by 2012, “20% of businesses will own no IT assets.” Gartner
Enterprise Spending: $17 billion of the $359 billion of worldwide IT spending for 2009. IDC
Prices – down, Options – up, Standards – up
Barriers to Adoption
Security, Privacy
Performance
Compliance

Cloud computing is a model for enabling convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, servers, storage, applications, and services) that can be rapidly provisioned and released with minimal management effort or service provider interaction. This cloud model promotes availability and is composed of five essential characteristics, three service models, and four deployment models.
Source: NIST

On-demand Self-service
Broad Network Access
Resource Pooling
Rapid Elasticity
Measured Service
Source: NIST National Institute of Standards and Technology (NIST) is an agency of the U.S. Commerce Department

Software as a Service (SaaS)
Use provider’s applications over a network
Platform as a Service (PaaS)
Deploy customer-created applications to a cloud
Infrastructure as a Service (IaaS)
Rent processing, storage, network capacity, and other fundamental computing resources
To be considered “cloud” they must be deployed on top of cloud infrastructure that has the key characteristics
Source: NIST

SaaS Gmail Google Apps MS Office Live SalesForce.com NetSuite RightScale AutoTask Kaseya Exchange Defender Efolder Datto Storage Guardian cTera PaaS MS Azure Google AppEngine Force.com IaaS Amazon Web Services Rackspace Go Grid

Private cloud
Enterprise owned or leased
Community cloud
Shared infrastructure for specific community
Public cloud
Sold to the public; mega-scale infrastructure
Hybrid cloud
Composition of two or more clouds
Source: NIST

Source: NIST

Security Responsibilities
Top Threats
Remediations

Different Clouds Require Different Security Responsibilities
Public Clouds – Provider: Physical, Network Perimeter, Multi-Tenancy, etc.
IaaS – Consumer: OS, Apps, Data, I/O
PaaS – Consumer: Apps, (Data)
SaaS – Provider: OS, Apps, Data
Private Clouds – Cloud Architect: Entire Infrastructure

Abuse and Nefarious Use of Cloud Computing
Insecure Application Programming Interfaces
Malicious Insiders
Shared Technology Vulnerabilities
Data Loss and Leakage
Account, Service & Traffic Hijacking
Unknown Risk Profile
Source: Cloud Security Alliance

Require transparency into overall information security and management practices, as well as compliance reporting.
Promote strong authentication and access control for administrative access and operations.
Prohibit the sharing of account credentials between users and services.
Disclose applicable logs and data.
Disclose partial/full details of infrastructure.
Source: Cloud Security Alliance

Infrastructure Transparency
Well-managed Administrator Authentication
Controlled Auditing

Open Source
Open Source != Free
Developed publicly to review, comment, and change
Transparency leads to
Better security
Quicker access to remediations
Examples: Linux and Java

White Paper: “Privileged Identity Management in the Cloud - Scalable Security Practices for Cloud Providers”
Download Link in Event Follow-up Email

Lowering the Barrier to Security and Compliance in the Cloud Privileged Identity Management Philip Lieberman, President & CEO

Agenda
The Problem : Unrestricted, Unaudited Access to Privileged Accounts
The Solution : Privileged Identity Management
Solution Overview: Enterprise Random Password Manager (ERPM)
ERPM in the Cloud
About Lieberman Software
Q&A

The Problem: Unrestricted, Unaudited Access to Privileged Accounts The Problem : Unrestricted, Unaudited Access to Privileged Accounts The Solution : Privileged Identity Management Solution Overview: Enterprise Random Password Manager (ERPM) ERPM in the Cloud About Lieberman Software Q&A

Shared or “Privileged” Accounts What are they?
Existing High Privilege Accounts:
Spread throughout your enterprise
Credentials are widely known
Shared indiscriminately
Not changed when staff turns over
Difficult to update due to lost knowledge and complexity: Nothing changes because it is too difficult or dangerous to make the required updates

Privileged Accounts in the Cloud
The Cloud adds new elements to Privileged Identity Management (PIM)
PIM will be implemented as a hybrid
Physical management is not directly controlled by the end-customer
PIM is now shared
More about this later…

Privileged Accounts What are they?
OS: Superuser, Root
Database (DBA & Apps): SA, SYSADMIN, SYS…
Mainframe: UID=0, RACF SPECIAL
Middleware: Proxies, Gateway Accounts
Application: Setup, Admin, App local
Web service accounts
VM: Hyper-visor

Privileged Accounts How Access Spreads
Application rollouts
Hardware deployments
Corporate mergers
Contractors
Job changes; staff turnover
Overlapping project roles
Failure to change default passwords
Passwords re-used across assets
Lack of password expiration, complexity
Dictionary & social attacks
Keystroke logging

Privileged Accounts Mandated Regulatory Compliance
Achieve successful security audits with Sarbanes-Oxley, PCI DSS, HIPAA, and other compliance regulations
Regularly update local and domain passwords
Log all changes
Generate real-time, audit-ready reports
Cloud auditing represents a new paradigm

The Solution: Privileged Identity Management The Problem : Unrestricted, Unaudited Access to Privileged Accounts The Solution : Privileged Identity Management Solution Overview: Enterprise Random Password Manager (ERPM) ERPM in the Cloud About Lieberman Software Q&A

Identity & Access Management vs. Privileged Identity Management
Identity & Access Management (IAM)
Controls user access to computers, applications and networks
Provisions and de-provisions users
Privileged Identity Management (PIM)
Controls administrative access to computers, applications, services, and network devices
Continuously detects and secures privileged accounts
Controls access in concert with IAM software
Provides robust auditing and alerting

Privileged Identity Management Comprehensive Credential Management Process
Automated:
Discovery of machines, process accounts, local & fire call accounts, services and tasks – and everywhere those accounts are referenced
Password Change Process for randomizing privileged accounts and propagating those changes everywhere the accounts are used to avoid lock outs
Storage of complex, random passwords in an encrypted repository
Role Based Provisioning of password access and delegation
Auditing of every password request, use and change

Privileged Identity Management Comprehensive Credential Management Process
Must control the entire life cycle of privileged accounts by:
Always keeping up-to-date and accurate systems & account lists
Immediately remove knowledge of shared credentials
Provide access to credentials on a need to know basis for the shortest time possible
Automatically change disclosed passwords
Allow organizations to change sensitive passwords without fear from outages
Automate as much as possible for low TCO and fast deployment

Solution Overview Enterprise Random Password Manager (ERPM) The Problem : Unrestricted, Unaudited Access to Privileged Accounts The Solution : Privileged Identity Management Solution Overview: Enterprise Random Password Manager (ERPM) ERPM in the Cloud About Lieberman Software Q&A

Continuous Discovery and Propagation LDAP OleDB Management Console Windows Server Web Server IIS Enterprise Random Password Manager Primary Database SQL Server or Oracle AES-256 Encryption Data Warehouse SQL Server or Oracle AES-256 Encryption Windows, Linux, UNIX, OS/390, AS/400, Network Appliances, Line-of-Business Applications, Databases, Middleware, Services, Scheduled Tasks… Managed Accounts SSH, SMB, OleDB Password Check-Out, Mgt. Workflows, Reporting Optional Two-Factor Authentication Web Access SSL Active Directory, Oracle Internet Directory, Novell eDirectory, IBM Tivoli Directory Server, OpenLDAP, any LDAP-Compliant Directory Authentication Providers BMC Atrium, IBM CCMDB, HP UCMDB, … CMDBs Zone Processors Remote Locations WAN Links High Latency / High Cost Help Desk / Trouble Ticket / SIEM / Network & Systems Mgt. Frameworks Third-Party Integration Event Sinks /SDK Zone Processors Network DMZs Firewalls

ERPM in the Cloud The Problem : Unrestricted, Unaudited Access to Privileged Accounts The Solution : Privileged Identity Management Solution Overview: Enterprise Random Password Manager (ERPM) ERPM in the Cloud About Lieberman Software Q&A

Evolving Security & Access Controls
Acknowledge entirely new threats and requirements for security evidence
Support elasticity at scale that necessitates automated security management and standardization

ERPM Software-as-a-Service (SaaS) Architecture

ERPM Infrastructure-as-a-Service (IaaS) Architecture OS OS OS OS Hypervisor Host OS Shared Hardware Division of Ownership Hypervisor Host OS Shared Hardware Hypervisor Host OS Shared Hardware Hypervisor Host OS Shared Hardware APPS APPS APPS APPS VM 1… n VM 1… n VM 1… n VM 1… n ERPM Cloud Client Audit Portal ERPM Cloud VendorMgmnt Console

Audit Portal: Compliance Report

Audit Portal: Password Age Report

Benefits – Cloud Vendors
Fully enroll each VM instance with unique Root/Admin passwords before releasing to client
Protect against loss of information
Reduce administration overhead
Facilitate global accessibility and delegated workflows
Enable transparent security practices
Increase consumer confidence: create digital trust and ease apprehensions of adoption for new clients
Audit all activities and generate compliance reports

Benefits – Cloud Clients
Manage privileged accounts securely
Document and verify controls and objectives
View access logs of all Cloud vendor administrative access to your virtual instances (patches, updates, etc.)
Generate standard or custom compliance reports on demand for your organization or auditors

About Lieberman Software The Problem : Unrestricted, Unaudited Access to Privileged Accounts The Solution : Privileged Identity Management Solution Overview: Enterprise Random Password Manager (ERPM) ERPM in the Cloud About Lieberman Software Q&A

About Lieberman Software
Founded in 1978
Originators of Password Randomization & Recovery for Privileged Identity Management going back to 2001
US-based, management-owned & profitable
No FOREIGN interests
Los Angeles headquarters, Austin support office and sales offices throughout the US
Technical partnerships include:

900 Enterprise Customers

Thank You!

Questions

Xtalks, part of the Honeycomb Worldwide Group of Companies, distributes live web conferences via this site and does not have an opportunity to monitor or review the contents of communications in advance of their transmission.
Xtalks does not endorse or confirm the validity of the information set out in its web conferences. The communications made during Xtalks web conferences are the views of the particular speaker or author, and are not the views of Xtalks or any entity associated with this site. Xtalks makes no warranty or representation, whether express or implied, with respect to the accuracy or completeness of the statements made during its web conferences and is not responsible for their content.
Reproduction of this broadcast is strictly prohibited without the express, written consent from Honeycomb Xtalks Inc.
Disclaimer Copyright © 2010 Honeycomb Xtalks Inc. This has been an Xtalks presentation, the archive of the event is available at www.xtalks.com

http://xtalks.com	12
http://www.xtalks.com	2
http://static.slidesharecdn.com	1

xto387

by xtalks

Accessibility

Categories

Upload Details

Usage Rights

3 Embeds 15

Statistics

xto387 Webinar Transcript