Blog Posts From The Data Stack Tagged With secure_server

Invitel Builds a Secure, High-Performing Platform for Delivering Cloud Infrastructure Services

webadmin@intel.com — Sat, 06 Apr 2013 00:19:58 GMT

Hungarian company Invitel needed to develop a new cloud infrastructure service to offer its enterprise clients a simple and high-performance way to enhance their IT hardware and software resources. The technology behind the service had to handle the simultaneous demands of thousands of clients and let Invitel guarantee the security and independence of customers’ data in a multi-tenanted IT environment.

The company chose servers from Dell powered by the Intel® Xeon® processor E5 family, running a virtualized computing environment based on software from VMware and Microsoft Windows* Server 2012. Intel® Trusted Execution Technology (Intel® TXT) ensures the integrity of the virtualized operating environment by protecting against intrusion attempts on BIOS, firmware, and other pre-launch software components. And Intel® Advanced Encryption Standard New Instructions (Intel® AES-NI), built into the processors, supports powerful encryption of data at rest, in applications, and when being transmitted--without impacting performance. The new secure, high-performance infrastructure has helped Invitel stay responsive to its growing customer base and get ready to expand outside Hungary.

“Basing our cloud offering on the processing performance of the Intel Xeon processor E5 family has enabled us to deliver the dependable service our business customers require, with data security protection in place to ensure compliance with Hungary’s laws and regulations," explained Gyongyver Gerlei, interim CSO for corporate business at Invitel. "The technology allows us to plan for the future expansion of the service, knowing that our platform offers the scalability and reliability to achieve this.”

To learn more, download our new Invitel business success story. You can find more like this one on the Intel.com Business Success Stories for IT Managers page or the Business Success Stories for IT Managers channel on iTunes. And to keep up to date on the latest business success stories, follow ReferenceRoom on Twitter.

*Other names and brands may be claimed as the property of others.

DuPont Increases Security with Intel-Based Encryption

webadmin@intel.com — Sat, 16 Mar 2013 00:49:30 GMT

Download Now

IT engineers from DuPont and Intel collaborated to explore the performance benefits of Intel® Xeon® processor-based servers with Intel® Advanced Encryption Standard New Instructions (Intel® AES-NI). In a proof of concept and extensive laboratory testing, the engineers saw performance improvements of up to 300 percent in encryption and decryption.

The Intel Xeon processor E5 and E7 families, with the hardware acceleration of Intel AES-NI, can dramatically reduce the overhead associated with encryption and decryption while making encryption stronger. These solutions can help companies like DuPont protect their information while maximizing the return on their hardware investments.

For the whole story, download our new DuPont white paper. You can find more business success stories like this one on the Intel.com Business Success Stories for IT Managers page or the Business Success Stories for IT Managers channel on iTunes. And to keep up to date on the latest business success stories, follow ReferenceRoom on Twitter.

Cloud Security Frameworks: Security by Design

webadmin@intel.com — Fri, 18 Jan 2013 15:30:06 GMT

Every company operates with some level of uncertainty and ambiguity. What separates the winners from the losers is how the company responds. For example, I once worked at a company where their (DBA) described them this way:

Think of company x as a ship floating on a large sea. The ship has no rudder and tends to get thrown around by the waves. Be assured, though, that wherever the ship lands, it is exactly where it needs to be.

As someone who believes in the value of planning, the vision of this helpless ship being tossed about is alarming. On the other hand, the company continues to thrive today—so perhaps the way it handled risk was acceptable.

Is Security Strategy, by Necessity, Random?

When I think about the state of many security programs, particularly from a systems engineering perspective, it's hard not to see a typical enterprise security strategy as eerily similar to the ship my DBA colleague described so many years ago.

What's particularly troubling to somebody like me, an admitted newbie to this topic, is that there seems to be broad consensus that security is, and is forever ordained to be, reactive in nature. (See my Information Week blog for more on this topic.)

Companies seem to spend their security dollars to prevent platform breaches ("I buy product X to protect my mobile devices, product Y for data center, and product Z for my networks") rather than it being part of a more holistic strategy. While this approach may have been acceptable (or perhaps excusable) when everything resided under one relatively friendly roof, it's not sustainable as you move your infrastructure, software, and data to locations outside your immediate control.

So what can you do?

Security by Design

Throughout 2012, I worked with Intel’s CISO, spent some time talking with a senior director at McAfee, and listened to some wisdom provided by the Ponemon Institute, LLC. The goal was to try to craft a security approach that changes the fundamental way an enterprise views and implements security.

As it turned out, the answer is deceptively simple and even somewhat intuitive. You just have to view and manage security like you do any other business investment. The challenge is to get your CEO, CFO, and CIO to view security using the same fundamental criteria.

So what is Security by Design?

As you might expect from someone with a systems engineering and enterprise architecture background, I believe Security by Design understands that security is first and foremost, a business issue. This is necessary to align the goals of your CEO and CFO (who control the budget).

The Security by Design framework is explained using three categories:

1. Current state of enterprise security

2. Security by design

3. Defense in depth

I can't detail the entire security framework in this blog. But I can provide the important elements you can use to start building your own strategy.

First, divide enterprise security into four topics:

1. Organizational

2. Controls

3. Approach to risk

4. Funding and cost efficiency

Make a brutally honest assessment of where corporate power lies, where security decisions are made (think many decision pockets), conflicting enterprise security goals, and hidden security expenditures.

Figure 1 shows the building blocks of security by design.

Figure 1. Security by Design Elements

The elements of this framework make a very nice picture. But in reality, few (if any) companies actually have all of them in place. If you're going to have any control over your security strategy, it's important to recognize that you need to formally document (and regularly reference) at least some of these elements. If you don't, you're like that ship without a rudder.

You also need to base your framework on four security investment rules which were based on a foundation provided by Intel’s CISO:

· Rule 1: Security solutions have no intrinsic value unless you can demonstrate savings or cost avoidance.

· Rule 2: You need more information than “Who did what to what (or whom), with what result?”

· Rule 3: Intelligent security investment requires a cohesive, defensive strategy to answer four simple questions:

1. Whose actions affected the asset?

2. What actions affected the asset?

3. Which assets were affected?

4. How was the asset affected?

· Rule 4: There can be only one individual/office responsible for end-to-end security investment; authority cannot be separated from responsibility.

(Learn more about an earlier version of these rules in a blog I wrote for Information Week.)

Organizational Impacts and Common Language

As you might expect, once you begin to approach security from a system strategy perspective, there must be a paradigm shift in your IT and business units as well as with individuals. These shifts include:

· Accountability

· Policy

· Control discipline

· Awareness

Finally, as your organization moves toward a defense in depth strategy, you must establish some common terms to describe security threats. While this might sound simplistic, it's important to remember that everyone in your organization must understand the threat in universally understood terms. The entire enterprise must speak about threats using the same vocabulary.

Figure 2 shows industry-standard terminology for common categories of threats.

Figure 2. Threat Categories

Finally, the defense in depth component of your security by design strategy requires setting goals at each defensive level (following the Intel security investment model we discussed in an earlier blog).

To learn more about Intel's security by design framework, contact your Intel field sales representative or reach me via Twitter.

The 12 Days of Christmas in the Data Center

webadmin@intel.com — Sat, 22 Dec 2012 15:00:46 GMT

This post originally appeared in Data Center Knowledge on December 21st, 2012.

Jeffrey S. Klaus is the Director of Data Center Solutions at Intel Corporation, where he has managed various groups for more than 12 years. Klaus’s team is pioneering data center power and thermal management solutions, which are sold through an ecosystem of data center infrastructure management (DCIM) software and hardware companies around the world.

Another year’s end, and we’re in the midst of another holiday season. Besides anticipating time off, family celebrations, and gift giving, every IT professional should be anticipating—and planning for—the challenges relating to data center energy management in 2013.

On the First Day of Data Center Christmas: IT Transformation

The data center has moved from a support business to a mission-critical resource. Next year, I could argue that the data center will become the most-critical resource. The elevation of the data center is being driven by demands for transaction speed and exploding numbers of devices and applications used for sales, service, operations, HR, and practically every functional area. Business users will continue to expect more from the data center. They want to improve their productivity with increasingly self-service capabilities, customization, on-demand services, and, above all, reliability that translates to highly available data center services.

Second Day: Organizational Disconnects

Historically, the various IT and facilities teams worked separately. Rarely did hardware, software, networking, and facilities teams come together, and if they did, they rarely understood each other. The 2013 outlook, with escalating energy costs and a continued sluggish global economy, calls for increasing focus on power optimization, and that means providing tools that not only work for all of the various teams, but encourage cooperation among the teams.

Third Day: Affordability of Servers and Storage Drives Up Demand

Dramatic server/storage price reductions over the last decade have led to mass migrations of tasks to online and automated platforms, thus driving up energy consumption in the data center. Power and cooling have become significant portions of the budget; some argue power has become the single biggest expense.

Fourth, Fifth and Sixth Days: Virtualization, Clouds, and Mobility Change Energy Profiles

Rapid change is nothing new in the data center, but 2013 will see several major technology trends gaining wide-scale acceptance. Virtualization is expanding from servers into desktop infrastructure, and users are demanding the flexibility and rapid provisioning that is only possible within a private or public cloud environment. Mobility adds another layer of complexity, as employees bring their own smart devices to work, thus driving up network traffic and server workloads with apps and anytime, anywhere access to data center resources. The data center is being bombarded with service requests, and large companies are already hitting the power restrictions of their facilities as well as the limits of some local utility companies to meet their needs.

Seventh Day: Natural Disaster Preparedness

The 2011 earthquake and tsunami in Japan and this year’s hurricane season that included Sandy’s devastation of New York and surrounding states are vivid reminders that every data center should be continually refining its disaster plans. The 2013 challenge will be to ensure that disaster plans include prolonging operation with backup power supplies. Disaster recovery should be elevated to a data center best practice, supported by a management solution that offers on-the-fly server adjustments to minimize power draw.

Eighth Day: Battling Methodologies and Tools

Natural disasters are one of the driving forces fueling growth of co-location (colo) facilities. Since many colo companies position their services as insurance for any power outage situation, some are among the early adopters of intelligent energy management solutions. Others have developed their own power management tools, and these will increasingly impact off-the-shelf DCIM solutions.

Ninth Day: The Search for Holistic DCIM Solutions

The ongoing debates about energy management approaches are driving the demand for and evolution of holistic DCIM platforms. Data center teams should look for solutions based on real-time data collection versus less-accurate predictive models. With fine-grained thermal and power monitoring, a DCIM solution should enable a data collection that feeds into holistic analysis and ultimately control of energy behaviors.

Tenth Day: Budget-Restricted Technology Roll-Outs

Of course, even the best solution doesn’t automatically override the budget restrictions stemming from global economic uncertainty. Therefore, data center managers will likely aim for smaller-scale trials and proofs of concepts than originally planned. A phased-in deployment should still be designed to achieve the same results over the long term, with each phase essentially self-funding the next phase with the proven gains in energy efficiency.

Eleventh Day: Vendor Consolidation

DCIM will continue to mature and, along with economic pressures, the rapid rate of change may likely lead to vendor consolidation. This will include large vendors buying up smaller tool vendors, to accelerate the development of their platforms. Maturation ultimately benefits the customer, however, and so the challenge here will be to avoid investments in solutions that may get swallowed up by competitors.

Twelfth Day: Inability to Predict the Future

As the year comes to a close, we are left with many unknowns about the DCIM market and how energy management in the data center will look a year from now. How will the market size compare to the 2013-2014 predictions? What will it take to move the technology to the next level?

We will all be watching and analyzing market movements, but ultimately data center demand will drive the technology. And this demand is growing at a healthy pace. Slow economy or not, energy costs are not going to suddenly plummet. More likely, energy demand will drive up prices, and governments will continue to increase energy taxes. DCIM solutions that build in proactive, fine-grained energy management capabilities are the best—and perhaps only—way to keep the data center sufficiently supplied without breaking the budget.

Follow Intel DCM: https://twitter.com/IntelDCM

Cloud Security Frameworks: Big Data, Architecture and Colin Chapman

webadmin@intel.com — Thu, 13 Dec 2012 16:16:10 GMT

Please note: A version of this blog appeared on InformationeWeek.com in the Cloud Section as an Intel sponsored post

I have a passion for anything with wheels, wings and more recently, float planes. You might remember that if you’ve read any of the blog posts I wrote on enterprise cloud (or the white paper based on them). Now I’m going to use this passion to make a point about cloud security.

Who is Colin Chapman? And what can we Learn from Him?

Anthony Colin Chapman was a design engineer, inventor, and founder of Lotus Cars , a British manufacturer of sports and racing cars known for their exceptional handling and light weight. In a nutshell, Chapman’s design philosophy is “simplify, then add lightness.” In practical terms, this approach ensured his cars were fast— not only on the straights, but particularly in the corners. In fact, between 1962 and 1978, Team Lotus won seven Formula One Constructor titles, six Driver’s Championships, and the Indianapolis 500. Based on results, it seems Colin may have been onto something.

So what exactly does Colin Chapman’s philosophy on lightness and speed have to do with cloud security, big data, and IT architecture? To find out, let’s focus on your current state data architecture strategy.

Current State Data Architecture and Security

Let’s pick a data category that is (according to a white paper from the Ponemon Institute) a consistent source of security concern to enterprises worldwide: customer data.

If I were to audit your enterprise data architecture, how many instances of customers’ data records would I find? One? Three? Six ? M aybe more? Would you be surprised if I told you that as an IT auditor (before I worked for Intel), I would routinely find at least six distinct data records on the same customer in a typical U.S.-based company?

If you continued auditing these islands of customer data, comparing them at the record level, what do you think you might find? Would the information be consistent in content, use, and ownership? Chances of that happening are not very likely.

As an auditor, I generally found approximately 75 percent parity among these records. What about the status of the other 25 or so percent of the information? Would it reflect the nuances of whatever department owned and maintained the record? What would the value of these nuances be to a competitor, or to a bad guy who hacked the record? What would you suspect Colin Chapman might say about the impact on enterprise performance of the (debatably) needless weight of all this duplicate data?

With all this in mind, let’s move the discussion to big data and the cloud.

First, it’s important to frame big data as simply as possible (understanding that it means many things to many people). Basically, big data is about harnessing the power of analytics to mine useful business intelligence (BI) out of massive amounts of ostensibly non-related information. The amount of information is so massive that a typical enterprise data center doesn’t have the capacity to conduct this analysis inside its firewall.

If this definition is fairly accurate, then information about your customers would likely be of value to your BI effort.

Now the question becomes exactly which of the theoretical six customer data records would you use in the cloud as part of your big data strategy? Would you default to using the one record that reflects the greatest percentage of commonality among the six? Or would you simply continue to utilize all the records in the cloud?

Most companies— due to history, effort, potential organizational ownership confrontations, and related difficulties— would take the easiest route and place all six customer records in the cloud. (If your company has done something else, please let me know. I’d love to be proven wrong.)

Structural Security Implications

In Sun-Tzu’s The Art of War[ 1], the author speaks of five types of incendiary attacks. The first is to incinerate men, the second is to incinerate provisions, the third is to incinerate supply trains, the fourth is to incinerate armories, and the fifth is to incinerate formations. Let’s explore this premise using customer records.

Consider that each customer record represents a standalone formation of data provisions, all being exchanged via very long, and very exposed, supply lines. Where one record has its related security concerns, six records, containing fundamentally the same data (at least 75 percent), have more.

I suggested in an earlier blog that bad guys seem to be much more adept at taking advantage of structural security weaknesses than we are at defending them. So not only does the extra weight of these records impact performance (a la Colin Chapman), it also gives the bad guys a target-rich environment that’s easier to breach. Since continuing to move toward the cloud and big data is inevitable, what actions do we need to start— or should we already have in place— to prepare for what I call future state security?

In my next blog post, I’ll begin to define what a future state security framework (and its funding) should look like and offer suggestions on how roles and responsibilities must evolve as the boundaries of your organization expand.

Please join me as I explore the topic of cloud security across upcoming blogs. For now, and reserving the right to add or modify these topics as we move forward, here are the areas I'll address in the coming months:

1. Current State Security

2. Security as a Factor of Cost

3. Business Issues Surrounding Security

4. Evaluating New-World Security Model Investments

5. Security, Data Architecture and Big Data

6. Defense in Depth

As always, I’m interested in your feedback to learn how your organization is selecting data to include in your big data strategy. I’d also like to know if you’re planning on managing your data architecture differently than you did when it only existed inside your firewall. To join the conversation, please contact me through Twitter.

[1] Sun-Tzu, The Art of War, Translated by Ralph D. Sawyer, Fall River Press, 1994, p. 227.

Intel and Microsoft Mobilize for SAP Mobility

webadmin@intel.com — Tue, 06 Nov 2012 23:57:14 GMT

Like it or not, consumerization is a fact of life. Your company’s employees are organizing their lives with smartphones, tablets and mobile PCs. And they expect those devices to help them at work too. If you don’t take steps to support them, you risk that they will take things into their own hands, including actions that put the security of your company’s data in jeopardy.

Luckily, the pieces are falling into place to help you take advantage of the employee productivity and satisfaction inherent in the Bring Your Own Device (BYOD) model.

Consumerization stretches IT along several fronts: integration, security, and user experience. Intel and Microsoft are collaborating on underlying technologies to help you optimize all three. In particular, they are improving access to the enterprise-driving SAP applications that really engage mobile users.

The companies are working together to implement hardware-based support for SAP middleware, including the SAP Afaria mobile management solution.
They are making it much easier to employ Intel-based platforms for popular SAP mobile apps, such as SAP Customer Financial Fact Sheet and SAP Interview Assistant. You’ll find these available by the end of the year.

These initiatives utilize hardware-enhanced security to make it easier to protect the BYOD enterprise. For example, your enterprise can already use Intel® Identity Protection Technology for fraud deterrence, Intel® Anti-Theft Technology to secure data and assets, and Intel® AES-NI encryption. As you see this technology rolling out in Intel-based smartphones, tablets and Ultrabooks™ – as well as traditional laptops – you’ll know how to enable each device as part of a more secure, integrated BYOD enterprise.

The “Trust Bus” is filling up, but there is always room for more: Next stop is IDF

webadmin@intel.com — Mon, 10 Sep 2012 16:04:20 GMT

As a marketing manager for security technologies, it seems like I’ve been advocating for Trusted Computing use models for years—certainly since the mid 2010 release of the Intel® Xeon® 5600 series processor based servers that featured Intel® Trusted Execution Technology. That period really only marks the debut of the technology—and since then we’ve been working to define and align enabled use models that provide new solutions and compelling business value. The end user response to the concepts of trusted compute pools as a foundation for more secure virtualization and cloud architectures has been gratifying. It turns out that customers are indeed searching for solutions that can enhance their visibility, control and compliance capabilities in such architectures. But there were times early on when we had few real solutions to offer—our ecosystem of fellow travelers was sparse.

It is not that we were entirely on our own. From the start we’ve had some fellow travelers that readily embraced the trusted compute pools concept: Dell, NEC and other system vendors were among the first to enable their platforms for trust via Intel TXT. HyTrust was there with the first trust-aware policy enforcement appliance and has been a great collaborator on many of our early proof of concept implementations. Vmware has also been a longtime ally in our quest for more secure clouds, and reinforced this position with the recent announcement of vSphere 5.1. And Expedient Communications was an early advocate sharing our vision for trust in the cloud. But the solution stacks were fairly immature and not very broad until 2012, when more server vendors expanded the portfolio of supporting platforms by dozens of new SKUs with the Intel® Xeon® E5 series processor systems. At the same time, more software vendors such as Red Hat, SuSE and began delivering support for trusted launch of their environments and companies such as McAfee further detailed the synergies of hardware and software-based security technologies. The recent VMworld show in San Francisco gave us an opportunity to focus on the growing breadth of support—with new vendor support and cloud service providers such as Virtustream and end user testimonials.

This growing breadth, depth and diversity is the necessary and hard-won proof of our vision for trusted computing, and we’re glad to be able to share it with a strong ecosystem. We are also looking forward for our next opportunity to show the growth and maturity of the solution stacks for Trusted Pools use models: at IDF in San Francisco on Sept 11-13. We’ll have more ISVs disclosing and demonstrating solutions that build off the foundation of Intel TXT. You’ll have the chance to hear integrator perspectives on building trusted infrastructures, see a number of trust-aware cloud management infrastructures and hear and see more service provider and end user company examples of how they have benefitted from their early adoption of Trusted Pools concepts and technologies.

We’ll save you a seat on the “Trusted Computing Bus” – If you’re planning to attend IDF in San Francisco this week, please think about spending some time at the Poster Chat (SECC001: Building a Foundation of Security in Your Next Generation Data Center), Technical Sessions (CLDS005: Implementing Trust from Client to the Cloud – An Integrators Perspective and SECS005: Take Control of your Cloud: Solutions to meet Security and Compliance Needs) and various demos from Intel and our allies to learn more about how Trust and related security technologies can enhance your enterprise security posture and give you more visibility, control and compliance capabilities for your virtual and cloud infrastructures.

Cloud Security Frameworks: Introducing Intel's Security Investment Model

webadmin@intel.com — Wed, 29 Aug 2012 15:32:45 GMT

Please note: A version of this blog appeared on InformationWeek.com in the Cloud Section as an Intel sponsored blog.

In my last post, “Whac-a-Mole Funding and Going on the Offensive,” on funding cloud security I discussed the seeming paradox between what an enterprise is willing to invest in security versus what it needs to adequately address its security threats. Based on what we’re seeing worldwide, security spending is reactive (motivated by fear?)—and therefore not very effective from an enterprise viewpoint.

If you extend this philosophy as you move to the cloud, it’s simply not sustainable. The reason is simple economics. My last post showed that median security spending over the last three years has been virtually flat. We also quoted a March 2012 research note from Gartner that says security spending is a very low priority for CIOs in 2012.

So, given these considerations, how do you pay the cost of having others provide effective security for your cloud-based business—and still adequately fund your internal security needs? You simply can’t afford to protect everything well using a fear-based approach to security funding.

The Art of War and Changing Tactics

As I suggested in an earlier post, “Walking the Talk” on cloud adoption, it’s my opinion that enterprises are fighting—and losing—the security war. The enemy is large in numbers, organized, well-funded, smart, and adept at changing tactics as quickly as countermeasures are deployed.

If all this is true, maybe we need to rethink how we’re fighting the war.

Consider the advice of Sun-Tzu, a Chinese military general, strategist, and tactician who likely lived during the Warring States period. His definitive work on military strategy and tactics, The Art of War, has influenced both Eastern and Western military thinking, business tactics, and legal strategy for the last 2,000 years.

One bit of guidance in Sun-Tzu’s treatise suggests that an army “who is able to change and transform in accord with the enemy and wrest victory is termed spiritual”. The bad guys seem to be much better at embracing this concept than we are.

With this in mind, maybe it’s time to change the way we fund security. To do this, you must determine how to frame the value of security in a way that will resonate in your enterprise.

Intel’s CISO uses a very simple test to help his staff determine what security investments have the highest likelihood of being funded. Figure 1 shows this yardstick.

Figure 1: Intel’s Security Funding Yardstick

The yardstick is a first-round way to assess the chances of a specific security enhancement being approved. The user experience measurement, which is somewhat subjective, shows how valuable, easy to use, and efficient a security proposal seems. The risk benefit measurement compares the risks of the security proposal to its expected benefits. Finally, the cost benefit measurement compares the financial benefits against the negatives (costs).

Based on Intel’s experience, proposed security enhancements that score well on all three criteria have a good chance of being approved by our CFO. The fewer criteria a proposal meets, the less likely it is to be funded.

Information Security Investment Model

Intel IT has also created a new IT security investment model that helps us analyze internal security investments based on their business value to Intel. The model allows us to analyze the value of each security investment within the context of our IT environment rather than in isolation. It also provides insights to answer questions like:

What’s the typical return on an investment in any specific defense-in-depth layer?
How much residual risk applies to any particular threat vector?
Which incremental investment mitigates the most risk?
Which incremental investment drives the largest marginal return?

You can find more on this topic in the IT@Intel White Paper Measuring the Value of Information Security Investments. (Login/registration required) Intel’s security investment model presumes that your security and, minimally, your CFO organization are:

Disciplined
Resource-able, with adequate resources to respond to ongoing security needs while building a long-term strategy
TCO knowledgeable, with almost an activity-based cost understanding of your IT environment
Analytic, with the ability to provide statistical expectancy on how well layered controls work

To be honest, my greatest concern about the model is that to use it, an organization must be relatively mature in each of these areas. How does your enterprise measure up?

Please join me as I explore the topic of cloud security across upcoming blogs. For now, and reserving the right to add or modify these topics as we move forward, here are the areas I’ll address in the coming months:

Current State Security
Security as a Factor of Cost
Business Issues Surrounding Security
Evaluating New-World Security Model Investments
Security, Data Architecture and Big Data
Defense in Depth

We’d love your feedback on our investment model and whether your organization can use it, along with your reasons why or why not.

To join the conversation, please contact me through @RDeutsche on Twitter.

On Cloud Security at Vmworld: The Long View is Solutions Over Products

webadmin@intel.com — Wed, 22 Aug 2012 21:09:56 GMT

I hope I don’t sound biased when I claim that Intel is not afraid to take a long view on a technology. Sometimes we just don’t know how long our view really is! In such cases, the company has to make some tough choices, ranging from retrenchment to perseverance. I’m sure there are many times where the “right thing to do” is hardly obvious.

Intel has long been an advocate of trusted computing, and has worked hard for quite some time to make it a reality. There have been times where this investment and advocacy has been challenging. I personally have spent several years working on technology development and marketing teams to bring Intel Trusted Execution Technology to market. I’ll confess, while it has been rewarding at times it has had its frustrating moments as well. But it has brought me to an epiphany.

The frustration that many of us experienced highlights the difference between delivering or enabling a technology versus a solution. A technology can be cool and different for a visionary or an analyst, but that is pretty much it. A solution on the other hand, can be a real game-changer for businesses and end users. What I’ve learned is that it takes a lot longer to put together a solution that customers can really buy, deploy and use—especially when these solutions have a lot of moving parts provided by potentially many different vendors.

Over the last year at VMworld and IDF we showcased the growing product support for trusted computing in the datacenter with new server platforms from IBM, Cisco, Dell and others that featured Intel® Trusted Execution Technology. And make no mistake; it is always gratifying to see technologies implemented in products. And we had the ability to show hypervisor products proof of concept technology demonstrations from folks like VMware and Red Hat that supported Intel TXT and we discussed Trusted Compute Pools use models that garnered a lot of interest. That too is really cool. But these were still really products and concepts. They have been really only suitable for the early adopters and IT shops that have the time, interest and expertise to be do-it-yourselfers. From the inside, I can see tremendous progress, but more is needed to get trust into the mainstream. Hence the frustration.

Beginning at VMworld 2012, we can take a major step forward and open trust to a broader audience as there will be a growing set of enablement options to bring into public view. The biggest “new” capability is Cloud providers offering support for trusted platforms in their offerings. It will be very rewarding to be onstage with Kevin Reid, the CEO and CTO of cloud provider Virtustream will be providing a perspective on enterprise class cloud—with trust as a key customer requirement.

The session titled Whom Can You Trust? The Rationale for Cloud Security from a Service Provider (Session SPO3286) at 11AM on Wednesday August 29, 2012 will give us the opportunity for the first time to highlight more secure, trustworthy cloud solutions based on the technologies and products we’ve been enabling for months. With this, trusted computing can move from the do-it-yourselfer phase to a more readily obtainable solution for the masses. And with that, we bring our long view ever closer to a customer reality.

I invite you to learn more and interact with us on our journey towards safer computing. Visit us at Vmworld 2012 at the Intel booth (#1131) at the IQ Bar or come by session SPO3286 on Wednesday at 11AM to hear and ask questions for yourself. You can also Follow Intel on Twitter @IntelITS, on Facebook, and here in the Intel Data Stack room for updates.

Cloud Security Investment, Part 2: Whac-a-Mole Funding and Going on the Offensive

webadmin@intel.com — Wed, 25 Jul 2012 18:31:34 GMT

Please note: A version of this blog appeared on InformationWeek.com in the Cloud Section as an Intel sponsored post.

In the first part of this discussion, “Walking the Talk,” we concluded that the lamentable state of a typical enterprise security strategy is a result of uncoordinated investment in their security ecosystem.

In fact, if you want to understand the reactive way most enterprises handle data security, the Whac-a-Mole game can help you visualize the process. When a company security ecosystem is breached, the company directs money toward fixing the breach and seeing that it works. If the breach is severe or embarrassing, the CIO or CISO is asked to “do the right thing.” The company repeats this process as often as needed.

In short, most enterprises don’t seem to have any semblance of a cohesive, security strategy.

Smoke and Mirrors

When I started to understand how companies typically fund security, I kept hoping my conclusions were wrong. Unfortunately, the deeper I looked, the more obvious it became that there’s a paradox between the typical hysteria surrounding security breaches and what companies are actually willing to spend to prevent them.

Let’s take a look at Figure 1, which shows what most companies spend on data security.

Figure 1: Median Security Spending

On average, CISOs are allocated a consistent 2 percent of their organizations’ IT budgets for security spending. If IT budgets are dropping, then we can conclude that associated security budgets may be dropping as well, in real dollars.

Some caveats to this conclusion are appropriate:

First, it’s important to recognize that security budgets vary by industry vertical, and size of the company.
Also, there may be elements of security spending that are buried in specific projects and not visible as this data is collected.
Over time, the more mature the enterprise’s security strategy, the more they spend on security.

To be completely fair, Gartner’s Research Note titled: IT Security Budgets and Staffing Projections for 2012: Constant Demand and Constant Spending that was published March 8, 2012, shows a higher level of median security spending in surveys of its customers. However, it also indicates that security is ranked as a very low priority for CIOs in 2012 (No. 10 out of 11 categories).

This all seems very puzzling. To my knowledge, no group or professional body suggests we’re winning the security wars, yet related enterprise budgets and priorities strongly suggest that security is, at best, overhyped or, at worse, not a real business priority.

What gives?

Security Investment

To successfully confront cloud security, we need to understand and resolve the paradox between the need to mitigate security risk and the investment companies are prepared to contribute to it. Towards that end, let’s look at Figure 2.

Figure 2: Security Investment Paradox

First, understand that the concept behind the Security Investment Paradox is a work in progress. One component of the curve focuses on the popular perception that your first investment dollar gives you more than your last investment dollar. Thus, a CFO or LOB could rationalize that they are getting “good enough” security for what they could afford to spend. Arguably, this approach may have been acceptable when the enterprise was a self-contained security framework (i.e., in pre-cloud days), but it is absolutely not sustainable when you’re relying on others to provide security coverage.

The second concept in the model is that the two points on the curve (Affordable and Actually Needed) were both defined by factors largely outside the decision-maker’s scope. The difference between the two represents the inconsistencies between securities spending and adequately addressing the threat.

Throwing money at the issue by buying more signatures or more capable IDS isn’t as important as understanding the impact of various mitigation steps such as:

Employee education
Understanding your control bypass rate
Developing a security strategy

Measuring the Value of Security Investments

To begin to understand how to best invest in cloud security frameworks, you must recognize three rules:

Security solutions add no intrinsic value to your business unless you can demonstrate savings, cost avoidance, and improved user experience.
Security return on investment doesn’t follow the classic bell curve model that your CFO or LOB groups associate with hardware and software purchase. Expect push-back.
Breach exposure—categorized as malware, hacking, social, misuse, error, physical, and environmental—occurs across your entire defensive perimeter (i.e., data center, communications, end-user devices). To invest wisely in your defense strategy, you must understand the who, what, which, and how of these breaches and the related bypass rates.

Next, you must define risk and your defense layers. As discussed in our last post, enterprise risk is a simple concept comprised of acceptance and management. Unfortunately, you can’t affordably protect everything and you certainly can’t protect everything well once it moves to the cloud.

Almost 50 years ago, McGeorge Bundy, an advisor to President Kennedy, observed a tendency to protect all information as if were top secret.

“The moment we start guarding our toothbrushes and our diamond rings with equal zeal,” he said, “we usually lose fewer toothbrushes and more diamond rings.”[1] It seems this observation still has value.

In my next blog, I begin to explore the business issues surrounding security and introduce a means for you to approach security using an investment framework in use at Intel.

Current State Security
Security as a Factor of Cost
Business Issues Surrounding Security
Evaluating New-World Security Model Investments
Security, Data Architecture and Big Data
Defense in Depth

I’m interested in feedback regarding how your organization funds security. To join the conversation, please contact me through Twitter.

[1] Joel Brenner, “America the Vulnerable, Inside the New Threat Matrix of Digital Espionage, Crime, and Warfare, The Penguin Press, 2011, Page 211

Cloud Security Investment, Part 1: Walking the Talk

webadmin@intel.com — Mon, 02 Jul 2012 21:53:17 GMT

Please note: A version of this blog appeared on InformationWeek.com in the Cloud Section as an Intel sponsored post.

It’s hard to avoid headlines that sensationalize the latest news about a security breach at company X that compromised some enormous amount of sensitive data at an estimated cost of (insert a very large number). In fact, reports from the Ponemon Institute, Evalueserve/McAfee, the Information Risk Executive Council and Verizon/U.S. Secret Service/Politie, and others consolidate this type of information into easily digestible data. After reading these reports, you’re left with the impression that enterprises are fighting a war and—quite bluntly—losing.

In a blog I wrote for Information Week, Cloud Security Frameworks: The Current State, I discussed the discipline known as systems engineering and management. The premise of this discipline is simple:

The boundaries of any system are defined—sometimes erroneously—by the collective perspective of those participating in the effort.
The more complex the effort, the greater the interactions—and the more difficult the solution.
If you try to focus on a single technology or business component of that system and exclude others, the success and effectiveness of the effort will likely suffer.

By applying this discipline to security investment, you conclude that for an enterprise to successfully address the many challenges of effective cloud security, it must align the entire ecosystem. An uncoordinated investment of individual pieces is a recipe for even more loss—and simply extends the practice that’s most responsible for the pathetic state of most enterprise security strategies today.

With this in mind, let’s examine Figure 1 to discuss how security costs are calculated today.

Figure 1. Current State Security Costs

As the fate of the RMS Titanic teaches us, it’s generally not the visible part of an iceberg that sinks you. Instead, it’s the mass below the waterline you need to recognize, understand, and respect. The same is true of the total cost of security. In general, most costs associated with security lie beneath the waterline. And while this presents one series of challenges in a traditional framework, it presents a completely different scenario when you view this from a cloud community perspective.

In a typical enterprise, the security costs you can see coming are direct costs. These quantifiable expenses include staff, equipment, and software.

Still visible, yet a bit more difficult to quantify are indirect costs, which include training, lifecycle costs (e.g., equipment and software), and administration. In fact, security lifecycle costs are one of the greatest impediments to making intelligent investments. (We’ll discuss this in depth in part 2 of this blog.)

Inefficiency costs are generally not easily identified hard to quantify even in a closed system (i.e., a typical, non-cloud-based framework). These can range from using and maintaining outdated hardware and software to overprotecting resources against non-existent threats.

This subject is so important to cloud security, and to the effectiveness of your security strategy, that we’ll discuss it in depth in part 2 of this blog. For now, let’s focus on how your enterprise decides how to protect data today.

At the root level, data security is about two things: risk and trust.

Risk

Risk has two components, acceptance and management:

Acceptance: Balancing threat against acceptable level of risk
Management: Protecting data that really needs protecting

If you look at the model many enterprises use today, acceptance is more important than targeted data management. Why wouldn’t it be? Security costs are a sunk expense and fall into a line-item budget bucket. Management efficiency costs are never really questioned, at least until a breach occurs. This condition, sadly, negates the necessity for an enterprise to actively manage the level of security, and associated costs, that is applied to specific data categories. The challenge is that in a mature cloud community, this will likely not be the case. Stratifying data into heavy versus lighter security needs means figuring out how much you pay for the service (perhaps as a factor of usage or volume).

Today many enterprises apply security considerations uniformly, regardless of the true value of the data. This means costs are out of balance with the real threat. It goes back to the RMS Titanic and the iceberg. These costs will become much more visible in the cloud—and you’ll need to scrutinize them more than you do today.

Trust

Trust has always been binary. There are no degrees of trust. I either trust you or I don’t. What changes is the extent of trust.

If you approach trust (security) from a purely technical perspective, as a factor of remedies and infrastructure, you’ll never establish a trusted relationship with your business. While this may be okay for a closed security system (i.e., one group driving security for an enterprise with no questions asked), it simply won’t work when you expand into a mature cloud community. This inevitably leads to a question pertaining to whether trust can be bought if not earned or once that trust is violated. While you may be able to buy trust in the short term, it’s important to recognize that you would likely pay a higher price for it and perhaps it is prudent to establish trust through the broader ecosystem using more traditional approaches.

In Part 2 of this blog, besides the topics we mentioned earlier, we’ll discuss the seeming paradox between cloud security breaches and the investment enterprises are willing to commit to win the security war.

Current State Security
Security as a Factor of Cost
Business Issues Surrounding Security
Evaluating New-World Security Model Investments
Security, Data Architecture and Big Data
Defense in Depth

I'm interested in your feedback on today's topic in general and, specifically, on how your enterprise funds security investment. To join the conversation, please contact me through Twitter.

Addressing Cloud Security: Reaching base camp on an ever-growing mountain

webadmin@intel.com — Fri, 04 May 2012 16:00:27 GMT

Two questions never fail to come up whenever I’m talking about cloud computing: What are best practices for cloud security and what are you Intel folks doing together with McAfee to address it? So when we commissioned a study and cloud security survey on IT perspectives on cloud security, I didn’t think that I’d find too many surprises. Seeing that 87% of companies surveyed said that they had substantial concerns regarding public cloud security certainly didn’t surprise me, but the fact that 69% had similar levels of concern around private clouds did.

While security obviously isn’t just a challenge for public clouds, 65% of respondents believed they had a higher number of security breaches in public clouds vs private ones. I know many of the leading cloud service providers in the industry and they do a very solid job of managing security and continuously enhancing their features. But regardless of whether their security feature set is superior to the average enterprise, when it comes to purchasing decisions, perception is reality and apparently we need to help build confidence in IT’s use of public cloud services.

To address this need, we’ve been working with McAfee to develop combinations of Intel hardware-enabled features that are exposed and management by McAfee tools to enhance the security capability for both public and private clouds. In fact, we’ve taking on the joint mission to make security in the cloud as equal or better as best-in-class enterprise security.

As an example of some of the capability we’re jointly enabling, we want to enable secure, trusted server pools and allow policies and access tools to recognize when those servers have been secured. At Intel, we’ve enabled Trusted Execution Technology (TXT) in our latest Xeon E5-based platforms. This allows virtual environments to boot with hardware-enhanced security features. We’ve worked with Trapezoid Digital Security to demonstrate how TXT can be combined with McAfee’s e-Policy Orchestrator to demonstrate how to manage permissions based on whether a server has an established hardware root of trust. This is just one of the elements that we’re highlighting in our joint McAfee and Intel security briefing today. You can see some of the other solutions and highlights at www.intel.com/cloudsecurity.

Want to hear more or see how some of your peers are addressing cloud security? Then join me at Forecast 2012 – a unique event led by the Open Data Center Alliance (a group of over 300 datacenter and IT professionals) – where both your peers and solutions providers will share their latest thinking on cloud security and best practices.

Cloud Security Frameworks: The Current State

webadmin@intel.com — Mon, 23 Apr 2012 13:42:16 GMT

Please note: A verision of this blog appeared on InformationWeek.com in the Cloud Section as an Intel sponsored post.

Before we jump into discussing cloud security frameworks, I’d like to thank all who responded to my first blog on InformationWeek.com through Twitteror LinkedIn. It’s rewarding to know that you found my initial blog on cloud security frameworksworthy of comment. I hope you continue to find my ideas interesting.

Now let’s consider today’s topic. While attending the University of Southern California, I was introduced to the concept of systems engineering and management. The premise of this discipline is disarmingly simple. First, the boundaries of any system are defined—sometimes erroneously—by the collective perspective of those participating in the effort. Second, the more complex the effort, the greater the interactions and the more difficult the solution. Finally, if you try to focus on a single technology or business component of that system to the exclusion of others, the success and effectiveness of the effort will likely suffer.

In theory, this approach makes sense. But from a more realistic perspective, business, technologists and technology vendors often decide to focus on a single element of a solution and—perhaps intentionally—ignore or overlook proposing solutions from an end-to-end perspective.

I wrote about the potential impact of this approach in a blog titled Cloud Lessons and LeMans. The key takeaway was that to build a workable cloud solution framework, you must understand and react to considerations larger than IT and the data center. In many respects, cloud security requires exactly the same considerations.

Organizational Behavior

A typical IT organization has a stratification of skills, responsibilities, and associated budgets. These are generally structured along platform, operations, and increasingly, lines of business.

Stratification is an inherent byproduct of organizational dynamics and how the success of each group is measured (and, in turn, compensated). In this environment, each group becomes detached from the needs of other groups and tends to define trust and risk based on their needs.

The cloud is a community of players made up of many diverse groups. These can include cloud service providers, telco service providers, and perhaps thousands of end users running any number of platforms. If you look at it this way, you begin to understand that the business problems associated with cloud security are significantly harder to resolve than the technical challenges.

Are Security Breaches Linear?

So let’s say security breaches are linear in nature (subject to discussion). How does a typical organization defend itself? In a blog written by Billy Cox that discusses security air gapsto separate systems, one might envision this defense as a string of very strong fortifications, erected around your platforms or line of business units, which are purpose-built to keep the bad guys out. I like to call this approach the Fort Knox Syndrome. (While I wish I could claim this term as my own, that honor goes to Ed Gerck, PhD, in a paper titled End-To-End IT Security that was originally published in 2002 and later republished in 2009 by Network Middleware Applications (NMA), Inc.)

Otherwise known as the United States Bullion Depository, Fort Knox is a fortified vault in Kentucky that can hold 4,577 metric tons (147.2 million oz. troy) of gold bullion. As you might imagine security in and around the building and its grounds is impressive.

Given the stratification of skills, responsibilities, and budgets described earlier, it shouldn’t come as a great surprise that for most organizations, security means building the equivalent of a Fort Knox-type fortification around their platforms and, by default, their application portfolio.

Figure 1 shows how this might look at a platform level.

Figure 1. Typical Enterprise Security Platform

Although the slide is a bit busy, it shows how the Fort Knox Syndrome works in many enterprises today. Each component is protected by its own firewall (represented by the red line surrounding each of the blue ovals). Within each component of the framework, nobody is really concerned about how their firewall impacts any other component of the system. This acknowledges some of the group-based detachment I mentioned earlier. Each component of the model demands some level of security compliance and ultimately has the right to determine who will—or will not—play within their domain.

The small cylinders in the figure—which represent identity, policy, and compliance—are the enforcers. Think of the identity cylinder as a simple device authentication capability. The policy cylinder represents a set of rules defining who can have access, the conditions, and under what criteria a device or its user is granted access. The compliance cylinder enforces policies such as maintenance of patch levels, firewall uptime, anti-virus definitions, and configuration vulnerability throughout the infrastructure. In a centralized IT shop today, it’s likely the data center component of this framework drives compliance of the associated elements.

But even with this simple model, problems are plentiful. When was the last time your organization experienced some type of security glitch when one component was updated and perhaps not fully tested against the umbrella security framework? I think it’s safe to conclude that the more federated your framework becomes (via a cloud ecosystem), the more the problems the Fort Knox model generates.

Current state security
Security as a factor of cost
Business issues surrounding security
Evaluating new-world security model Investments
Security, data architecture, and big data
Security in Depth (E2E Frameworks)

I’m interested in your feedback on today’s blog in general and, specifically, how your enterprise is approaching E2E security and E2E cloud security. Do you consider the two topics as separate but equal or as one and the same discussion?

Better Security Drives Innovation

webadmin@intel.com — Fri, 20 Apr 2012 23:42:16 GMT

Download

To learn more about today’s most important security strategies, download “Better Security Drives Innovation,” a new white paper that explores:

The high-level evolutions enterprises and their security officers face.
Key considerations including people, devices, and data rating.
Scenarios following the information lifecycle to implement security policies in the organization.
Technologies to better secure the information technology system.
Changes in the global environment.
Indications, tricks, recommendations, techniques, and useful technologies.
How we can move from building firewalls to instilling security behaviors into each employee.

Download it here. And to learn about more enterprise IT solutions, visit the Intel.com IT Center.

Real World Database Encryption Performance with Intel AES-NI Pt 2

webadmin@intel.com — Tue, 03 Apr 2012 14:11:44 GMT

In Part I of this blog post on information security I investigated the performance of Oracle TDE with hardware acceleration using Intel AES-NI and saw significant performance gains. However, I subtly sidestepped the question of what happens when the data is cached? As we found during part I, Oracle does not cache the data at all, instead choosing to read from disk and decrypt every time the same query is run. Why does Oracle not cache the data after the first time the query is run?

Running a trace on the query and looking in the trace file helps answer the question by showing that the operation used to read the data was identified as a direct path read. This will be familiar to Oracle DBAs with Oracle parallel query experience. It means that the data is read directly into the user session's PGA (bypassing the SGA), instead of using a more familiar db file scattered read, where the data could potentially be cached but placed at the end of the LRU list and aged out more quickly if space in the buffer cache is required. Why does Oracle use a direct path read for a non-parallel query? The answer lies in Note: 793845.1 from My Oracle Support that says:

"There have been changes in 11g in the heuristics to choose between direct path reads or reads through buffer cache for serial table scans. In 10g, serial table scans for “large” tables used to go through cache (by default) which is not the case anymore. In 11g, this decision to read via direct path or through cache is based on the size of the table, buffer cache size and various other stats."

This makes a great deal of sense. Given the massive gains in platform bandwidth and latency, direct path read can be as fast as a db file scattered read and also improve scalability: There is no need to acquire a cache buffers chains latch to scan data buffered in memory to prevent that data being changed while it is in the process of being scanned. It is also beneficial in a RAC clustered environment where other nodes may be interested in the contents of the local buffer cache. As the My Oracle Support note mentions, the decision whether or not to cache the data is dependent on a number of factors. One of the most important is whether the table exceeds a size value based on the value determined by the hidden parameter _small_table_threshold. Instead of using this parameter, however, I granted the user a higher privilege and then used the event 10949 "Disable autotune direct path read for serial full table scan" to modify the default behaviour to observe its impact on clear text and encrypted data as follows:

SQL> alter session set events '10949 trace name context forever, level 1';

After doing this, re-running the same query on the clear text data does physical reads but takes slightly longer to cache.

Elapsed: 00:00:42.53

Subsequent runs shows that we have returned almost to previous performance, although not outperforming the direct path read.

Elapsed: 00:00:29.55

Now the data is cached in the buffer cache in the SGA and not read from disk.

Statistics
----------------------------------------------------------
...
0 physical reads
...

Tracing also showed that autotune direct path read was disabled and db file scattered read is being used.

I then tried setting the same event for the unencrypted data with hardware acceleration disabled. Running the query on the first occasion took slightly longer than before as the data was read from disk, decrypted, and cached in the buffer cache.

Elapsed: 00:02:25.97

However, on subsequent runs the difference was dramatic. The data was cached in clear text in memory and therefore ran considerably quicker.

Elapsed: 00:00:29.30

Similarly, with AES-NI enabled the initial read from disk and decryption took a similar length of time as before.

Elapsed: 00:00:45.30

Once the data was cached no decryption was required.

Elapsed: 00:00:29.49

To recap, the following are results when the query is cached in the SGA:

Clear Text Query cached = 00:00:29.55
Software only encryption cached as clear text = 00:00:29.30
AES-NI accelerated cached as clear text = 00:00:29.49

In other words, the result is exactly the same and entirely expected from the TDE FAQ with cached data. Once the data is in the buffer cache it is in clear text and should therefore take a similar time to read irrespective of whether the tablespace is encrypted.

For Oracle encryption performance when running queries that use full table scans once the data is cached in memory (for tablespace as opposed to column encryption) it is in clear text and therefore hardware acceleration will not be used after the first read from disk. However, as we saw in Part I it would be wrong to assume that just because we size the buffer cache adequately that a table would necessarily be cached. Additionally, at this release of Oracle (11.2.0.2), whether the data is encrypted does not impact upon how full table scans are implemented. You have the manual intervention alternative and using unsupported underscore parameters to modify Oracle's behaviour. In these simple tests I have tested for only a single user, without considering the implications of scalability or clustering. If you do modify Oracle's behaviour you will need to retest that your assumptions are correct for each and every Oracle release.

What we want with Oracle database encryption as the name TDE implies is for it to be transparent without needing to modify practices at all just because we want the data to be encrypted. What these simple tests show is the best way to do this is by using Intel Xeon processors with AES-NI for Oracle database encryption acceleration.