Welcome!

Linux Containers Authors: Liz McMillan, Jason Bloomberg, Zakia Bouachraoui, Yeshim Deniz, Elizabeth White

Related Topics: Linux Containers, Containers Expo Blog

Linux Containers: Article

Securing the Enterprise Beyond the Perimeter

Deperimeterizing security architecture

Recent high-profile security breaches have taught us a clear lesson: organizations that rely primarily on a secure perimeter to protect sensitive data are fooling themselves. This year, hardly a week has passed without headlines about a security breach involving sensitive data.

However criminals get the data, whether through a traditional perimeter breach, use of insider credentials or outright theft of physical storage media, the lesson is the same. Organizations can no longer regard everything inside the traditional perimeter (people, machines, and networks) as "trusted," requiring only a "soft" approach to security that consists primarily of procedural controls and weakly enforced permissions.

It's an approach to IT security that's like a candy M&M: once criminals penetrate the hard shell that protects the network from the wholly untrustworthy public Internet, they can easily devour the data at the soft center. Actually they often don't have to penetrate the perimeter at all. They can simply go around it by stealing unencrypted backup tapes, for instance, out of the back of a cargo van.

Not only are attackers constantly blowing open security cracks in perimeter security, but enterprises themselves are also willingly, and often unwittingly, contributing to the perimeter's disintegration.

For example, virtual private networks frequently tunnel through the perimeter, which often provides all-or-nothing access to network resources. Web Services, which are starting to finally fulfill the early hype, are meant to interconnect business processes and often reach into the core of an enterprise network. Factor in the mass of mobile devices, wireless networks, portable media storage and off-site data archival, and it's not outlandish to suggest that there really isn't a perimeter at all. Instead, enterprises need a "jawbreaker" model in which the network is "hard" all the way through to the center.

Drivers Behind the Jawbreaker
Unfortunately the traditional perimeter model doesn't just fail to provide adequate security. It's also far too expensive and inefficient to deploy, given today's far-flung workforce. Enterprises have to manage an exploding number of network connections for employees working at home, traveling and staffing remote offices, not to mention the connections they've built to the networks of partners, outsourcers, and customers.

Enterprises need a unified management approach to the identities of users, their rights and roles, and ultimately the enforcement of those rights. The search for a unified approach has led many security experts to believe that security will soon be deperimeterized.

In a deperimeterized world, every user is "remote," whether he's on the corporate campus or in a coffeehouse halfway around the world. Instead of building a perimeter around the network, in a deperimeterized architecture there's a virtual perimeter around every user or internal system that establishes "islands" of trust that securely exchange information.

The Jericho Forum (www.opengroup.org/jericho), a security organization recently founded by corporate CIOs, is taking a stab at defining the requirements for both the short-term and long-term transition to a deperimeterized world - a unified world with an inherently less expensive, more consistent approach to identification, authentication and authorization. By and large, its vision doesn't require the development of brand new, whiz-bang technologies, but rather strings together existing technologies into a unified whole.

The Jericho Forum's vision is no pipe dream. It's already underway. Computer manufacturers like Dell, Hewlett-Packard, IBM, and Fujitsu have all made trusted platform module (TPM) technology a standard feature in their enterprise-class laptops, enabling users to securely lock away in hardware the secret digital keys that are crucial to encrypted communications. These keys let users securely encrypt and decrypt information with their laptops, and give administrators the ability to verify not only that a user is safe, but also that the user's machine is safe.

Dell, for one, has gone a step farther and has put smart-card technology in its laptops so network administrators can assign a digital identity to each user instead of relying on the notoriously insecure usernames and passwords.

Pervasive Encryption
So a world in which every user is a secure "island" raises important questions like how one know who's actually "on" each island?

The foundation of a deperimeterized security architecture is knowing whether users and their machines are who and what they should be. Enterprises will have to use strong methods of authentication such as smart cards, USB tokens and ultimately biometrics to validate users and embedded digital identities to recognize devices such as laptops, phones and even peripherals.

It also begs the question: How will these islands communicate securely with one another?

At the end of the day, the only sure way to enforce confidentiality is though encryption. No enterprise in its right mind would ever send sensitive data across the Internet without encrypting it first. That mindset is now starting to be applied to all networks. There are well-established means for securing data as it travels "outside" the traditional perimeter, means that can be re-applied in a deperimeterized world. SSL, virtual private networks, and Web Services will all be used to link up the islands protecting data "inside" as it moves between cubicles or campuses.

You also have to ask: How will enterprises protect sensitive data and the processes that use them once they've arrived on the islands?

The reality is that pockets of stored data are virtually everywhere and that much of this data is sensitive in nature. In a deperimeterized world, the situation is probably going to get worse. There is a "data at rest" problem that goes well beyond backup tapes. There will be need to be the islands responsible for protecting the data on the island - whether the data is stored in a database, file system, tape drive, or the laptop's hard drive. In some cases, tightly integrated access controls may suffice but, once again, encryption will often be used to provide a last line of defense. If all else fails, a thief's efforts will be in vain - he may have access to data, but because it's encrypted, he won't see anything except gobbledygook.

Clearly, encryption plays a pivotal role in a deperimeterized security environment. But as encryption penetrates deeper into enterprise operations, enterprises will need to deploy new systems to manage - cost-effectively - the exploding number of private keys on which pervasive cryptographic security will depend. There will have to be a mechanism for recovering lost data and separating duties.

It's a big challenge, but once deperimeterization becomes a reality, the payoff will be enormous. Not only will the headlines about security breaches recede but enterprises will be able to expand their networks efficiently and securely to include remote employees, new branches, partners, customers, and outsourcers.

It's only a matter of time before the walls fall down. The question is whether there will be systems and policies available that can raise the security bar sufficiently to cope. Life in a deperimeterized world might be a liberating experience and should certainly be less costly in the long run.

The security industry still has plenty of work to do. What seems clear is that the using cryptography will become more widespread, often under the covers, but nonetheless a fundamental component behind strong authentication and enterprise-wide data protection.

More Stories By Richard Moulds

Richard Moulds is VP of product strategy at Thales e-Security. Previously he was nCipher's vice president of marketing. He has a bachelor's degree in electrical engineering from Birmingham University and an MBA from Warwick University in the UK.

Comments (0)

Share your thoughts on this story.

Add your comment
You must be signed in to add a comment. Sign-in | Register

In accordance with our Comment Policy, we encourage comments that are on topic, relevant and to-the-point. We will remove comments that include profanity, personal attacks, racial slurs, threats of violence, or other inappropriate material that violates our Terms and Conditions, and will block users who make repeated violations. We ask all readers to expect diversity of opinion and to treat one another with dignity and respect.


IoT & Smart Cities Stories
The challenges of aggregating data from consumer-oriented devices, such as wearable technologies and smart thermostats, are fairly well-understood. However, there are a new set of challenges for IoT devices that generate megabytes or gigabytes of data per second. Certainly, the infrastructure will have to change, as those volumes of data will likely overwhelm the available bandwidth for aggregating the data into a central repository. Ochandarena discusses a whole new way to think about your next...
CloudEXPO | DevOpsSUMMIT | DXWorldEXPO are the world's most influential, independent events where Cloud Computing was coined and where technology buyers and vendors meet to experience and discuss the big picture of Digital Transformation and all of the strategies, tactics, and tools they need to realize their goals. Sponsors of DXWorldEXPO | CloudEXPO benefit from unmatched branding, profile building and lead generation opportunities.
All in Mobile is a place where we continually maximize their impact by fostering understanding, empathy, insights, creativity and joy. They believe that a truly useful and desirable mobile app doesn't need the brightest idea or the most advanced technology. A great product begins with understanding people. It's easy to think that customers will love your app, but can you justify it? They make sure your final app is something that users truly want and need. The only way to do this is by ...
Digital Transformation and Disruption, Amazon Style - What You Can Learn. Chris Kocher is a co-founder of Grey Heron, a management and strategic marketing consulting firm. He has 25+ years in both strategic and hands-on operating experience helping executives and investors build revenues and shareholder value. He has consulted with over 130 companies on innovating with new business models, product strategies and monetization. Chris has held management positions at HP and Symantec in addition to ...
DXWorldEXPO LLC announced today that Big Data Federation to Exhibit at the 22nd International CloudEXPO, colocated with DevOpsSUMMIT and DXWorldEXPO, November 12-13, 2018 in New York City. Big Data Federation, Inc. develops and applies artificial intelligence to predict financial and economic events that matter. The company uncovers patterns and precise drivers of performance and outcomes with the aid of machine-learning algorithms, big data, and fundamental analysis. Their products are deployed...
Dynatrace is an application performance management software company with products for the information technology departments and digital business owners of medium and large businesses. Building the Future of Monitoring with Artificial Intelligence. Today we can collect lots and lots of performance data. We build beautiful dashboards and even have fancy query languages to access and transform the data. Still performance data is a secret language only a couple of people understand. The more busine...
Cell networks have the advantage of long-range communications, reaching an estimated 90% of the world. But cell networks such as 2G, 3G and LTE consume lots of power and were designed for connecting people. They are not optimized for low- or battery-powered devices or for IoT applications with infrequently transmitted data. Cell IoT modules that support narrow-band IoT and 4G cell networks will enable cell connectivity, device management, and app enablement for low-power wide-area network IoT. B...
The hierarchical architecture that distributes "compute" within the network specially at the edge can enable new services by harnessing emerging technologies. But Edge-Compute comes at increased cost that needs to be managed and potentially augmented by creative architecture solutions as there will always a catching-up with the capacity demands. Processing power in smartphones has enhanced YoY and there is increasingly spare compute capacity that can be potentially pooled. Uber has successfully ...
SYS-CON Events announced today that CrowdReviews.com has been named “Media Sponsor” of SYS-CON's 22nd International Cloud Expo, which will take place on June 5–7, 2018, at the Javits Center in New York City, NY. CrowdReviews.com is a transparent online platform for determining which products and services are the best based on the opinion of the crowd. The crowd consists of Internet users that have experienced products and services first-hand and have an interest in letting other potential buye...
When talking IoT we often focus on the devices, the sensors, the hardware itself. The new smart appliances, the new smart or self-driving cars (which are amalgamations of many ‘things'). When we are looking at the world of IoT, we should take a step back, look at the big picture. What value are these devices providing. IoT is not about the devices, its about the data consumed and generated. The devices are tools, mechanisms, conduits. This paper discusses the considerations when dealing with the...