Category Archives: Technology

Cloud Access Management: Access Everywhere

Cloud Access Management: Access Everywhere

Cloud Access Management

As the utilization of cloud applications has become a standard of using in nearly every industry, there needs to be solutions available to help manage these applications. One way for admins to effectively manage their organization’s applications is to use an automated account management solution for both in house and cloud applications. This ensures ease of provisioning, making changes and de-provisioning user accounts, while also ensuring security by ensuring correct access rights.

While this ensures ease of use for account admins, what about for the end users? They also need a way to easily manage, and access, their cloud applications. Think about a user who has numerous applications they use on a daily basis. They need to open a new page for each application and then sign in. In today’s work environment, in virtually every industry, employees frequently access work applications outside of the company network. While this might not be so much an inconvenience in the office regularly, for those who are working on the go it can be extremely annoying. Solutions are available to allow users to easily manage and access their applications from any location.

(Image Source: Shutterstock)

How does it work?

A web-based single sign-on (SSO) solution is one method ends users can to easily handle cloud applications. Users can easily access a portal where all applications they can access are available. They simply provide a single set of credentials for authentication and can then access any of their applications by simply clicking on the icon. This allows them to easily access their applications from anywhere that they are working, whether inside or outside of the company’s network from one place.

This is extremely convenient for users who are using mobile devices. Think of an employee who is quickly trying to gain access on their smartphone or tablet. To open each application in a new tab and enter credentials is an extremely time consuming process. Many vendors offer the ability for users to download an app on their device and the app will prompt the user to enter a single set of credentials to get to the portal where they can access their applications. For users who are on the go and use tablets or smartphones this can be a tremendous help. They can access what they need, from anywhere, at any time, without having to be inconvenienced.

A cloud SSO solution is helpful in many different types of organizations. For example, in education, students complete a large majority of their work outside of the school’s network and often use many mobile devices. In the healthcare industry, clinicians will be going room to room visiting patients. Sometimes caregivers are logging into terminals, other times they may use a tablet and need to quickly access the applications and systems they need. For a sales associate for a large organization, they may be meeting customers at their office or other locations and need to access customer information. Many industries nowadays have employees who are not working from one single computer and need quick convenient access.

How Can This Actually Enhance Security?


A major concern of every organization when implementing any type of solution is also security. While yes, they want their employees to be more productive and be able to more easily perform task and access resources they need, they don’t want this to interfere with the security of their network.

The first big concern people always have with SSO solutions is that they are nervous that it leaves the network unsecure, as users only use one set of credentials. Think, though, about the user who has several sets of complex credential for the multitude of applications that they need. Chances are that they write them down or save them in their phones to remember these passwords. It is actually more secure to have a single set of credentials that the user does not need to write down since they can easily remember them.


If security is a top priority, this type of solution can be customized to ensure additional levels of security measures. In some industries certain employees handle highly sensitive information so security is the utmost concern. For example, for an employee working in the financial department handling company or customer finances, it is very important to add additional security methods while it may not be as important to ensure security for applications that an intern uses. Depending on the level of security needed there can be different methods of authentication required.


For the user working in the financial department, the solution can be set up so that it can be required that they enter their credentials and then have to provide a second form of identification. This can be some a one time use PIN, access card or maybe a biometric method such as a fingerprint or face scan.

Cloud SSO solutions can also be customized to meet the needs of the many different groups and positions which many organizations have. For example, it is obvious that certain departments within the organization use different applications than others. The organization can easily add and delete applications for each group. They can also break down groups differently depending on their organizational needs. Different levels of employees within a department will probably need different access to systems and applications. The company can easily develop groups so that each employee only has the applications in their portal that they need.

Cloud single sign-on solutions allow employees to easily see which applications they have, and access them with a single click and one set of credentials. This improves efficiency and productivity while also keeping the organization happy by ensuring security.

By Dean Wiech

Cloud Services Providers – Learning To Keep The Lights On

Cloud Services Providers – Learning To Keep The Lights On

The True Meaning of Availability

What is real availability? In our line of work, cloud service providers approach availability from the inside out. And in many cases, some never make it past their own front door given how challenging it is to keep the lights on at home let alone factors that are out of your control. But in order to effectively provide quality services with the focus on the customer, providers need to ensure availability from all perspectives, this is what we like to call real availability. Real availability captures the real user experience from end to end. This includes everything within our control (our infrastructure and network) and things out of our control (customer or third party providers).

It’s not enough to only consider the factors within our own infrastructure that might lead to more down time or further disruption. Even when achieving 100 percent uptime within your own network, you have to recognize the services being used by the customer are only as good as the weakest point in the process. A hardware failure on the customer side or an outage at the internet service provider are all factors that impact the overall availability of the services. And while you should do all you can to not be the weak link, from a customer’s point of view, a disruption is a disruption regardless of the source.

Looking Through the Eyes of the Customer


(Image Source: Shutterstock)

By shifting your focus to see the situation as the customer sees it, and providing a real world view of their availability, cloud service providers should take the necessary steps to change the way the industry looks at and measures availability. To determine real availability for your customers, providers need to look at every incident that results in a customer disruption. In our experience, incidents in a customer’s network fall into one of the following four categories:

Service provider’s infrastructure This includes any and all disruptions that occur on the service provider’s end, within their infrastructure.

Software on a service providers’ platform – Additional software programs from the service provider that experiences a glitch or outage.

Third-party provider Includes third-party solutions such as a customer’s internet service provider or your chosen data center management or hosting services provider.

The customerWhen customers have internal network issues, authentication issues, or when they use the service providers’ offering in ways that impacts their own service.

Moving From Supplier to Partner is Good Business

Where you come in is helping your customers manage the situation when those disturbances occur, including identifying the source. By considering all points of the process when identifying factors that could lead to downtime, you are proactively partnering with your customers. This partnership and transparency is critical to your customer relationships and will dramatically improve the customer experience.


(Infographic Source: Kissmetrics)

By evolving your status from supplier to a partner dedicated to a customer’s success also makes good business sense. While many cloud providers focus on new customer/user acquisition, industry studies show it can cost 7x more than customer retention. Broadening a focus to the real availability and health of a cloud service can pay off for providers in the long run.

By Allan Leinwand

What’s Ahead For Predictive Analytics And Why It Matters For Businesses

What’s Ahead For Predictive Analytics And Why It Matters For Businesses

What’s Ahead For Predictive Analytics

Predictive analytics is the practice of looking for patterns within systematically compiled data in order to anticipate behaviors and trends that businesses can learn from and make actionable decisions with.

In many marketing and CRM circles, it’s a very popular buzz term receiving a lot of hype. Marketing and CRM professionals want a way to leverage big data to learn more about their customer base and how they can further engage with them.

Predictive analytics can also help marketing professionals build customer profiles and models to learn and aide in the decision making process. They can also use the information obtained from predictive analytics services to not only increase sales, but to also retain profitable consumers and have a better understanding of customers that aren’t a fit in the sales cycle.

Better understanding big data can help business owners  accomplish many objectives including:

  • Detecting customer buying patterns
  • Accurate customer targeting
  • Predicting customer behavior
  • Driving strategic decision making
  • Providing a deeper understanding of your customer base

Soliant Consulting has put together an infographic that provides a bit more information about this exciting field.

By Glenn Blake

Big Data Analytics – $50 Billion Dollar Market By 2019

Big Data Analytics – $50 Billion Dollar Market By 2019

Big Data Analytics Market

Big data analytics, the employment of advanced analytic techniques against enormous and diverse data sets, enables researchers, analysts, and business operators to more quickly make better decisions. Techniques include predictive analytics, text analytics, machine learning, data mining, stats, and natural language processing, and with the rapid advancement of big data analytics organizations can now tap previously unexploited data sources for significant insight. Says Jeremy Waite, Head of Digital Strategy at EMEA Salesforce Marketing Cloud, “In 2015 we learned that 90% of the world’s data had been created in the previous 12 months… The big data motto for 2016, therefore, needs to be ‘we must create more value from data than we capture’.”

The Big Data Progression


(Infographic Source: Wipro)

Though the term ‘big data’ is relatively new, the concept is not, and even in the 1950s basic analytics were used to discover relevant trends and insights. As the computing environment has advanced, as well as access to new forms of data through sensors, monitors, IoT applications, and wearables, data analytics has taken on a more prominent role. A few years ago, analytics would have provided information for future decisions, but today businesses can use big data analytics to support immediate decision-making processes. Big data analytics in its most recent form allows organizations to work quickly and with agility, promising improved products and services along with reduced costs.

Essential Big Data Components

The benefits of big data are much lauded, but actually bringing these benefits into a business requires detailed planning and infrastructure provision. Cloud computing has reduced the entry requirements for effective use of big data analysis, but it’s still necessary to invest in features such as data collection and storage, and data analysis and output.

Collection & Storage

The array of collection devices is almost endless with innovators daily finding new means of gathering records, facts, numbers and statistics. Social media and customer feedback serve the essential role of personalizing data, while beacons, wearables, and IoT sensors capture endless bytes of seemingly meaningless data. In its raw form, this data can be overwhelming and incomprehensible, and often post-collection is simply stored safely away. Businesses with effective big data analysis tactics in place are careful not only to install necessary collection devices but implement storage systems that are accessible and supportive of the following phase.

Data Analysis & Output

Processing and analyzing data extracts insights through programming languages and platforms, including software from vendors such as Google, Oracle, Amazon Web Services, Microsoft, and IBM. Add to this, a host of startups have entered the market, often with simpler but more focused solutions. No matter the chosen tool, the data analysis process first requires that the data is cleaned and formatted. Following this, the analytic model is built, and finally, inferences are made. Once this analysis is complete, it’s important that the results are properly communicated to the relevant business departments and given the value they merit. Better a summary of recommendations with key substantiating figures for prompt action than a heap of restructured data easily ignored. Useful data output is as essential as each step which precedes it, and the effort put into making it attractive and easily understood shouldn’t be underestimated.

Big Data Trends

In 2014, big data analytics in the cloud was making waves; today it’s the norm. This year, analysts are predicting high growth rates, and the IDC expects the worldwide big data technology and services market to grow to $48.6 billion in 2019. The International Institute for Analytics believes that automated data curation and management will play a bigger role, with an ease in the analytics talent crunch, and analytical micro services facilitating embedded analytics. The IDC, however, believes this specific skills shortage will persist due to increased demand for such expertise, and Forrester echoes their expectation, suggesting the growth in degree programs launched globally will not be enough to meet the ‘huge demand.’ Today, big data analysis is promising more value to organizations, but the next few years will require a higher level of input and collaboration as businesses attempt to constructively engage with it.

By Jennifer Klostermann

Why Organizations Move To Amazon AWS

Why Organizations Move To Amazon AWS

Maximization of Cloud Opportunities 

Sponsored series by CloudMGR

When linked with the correct choice of provider, visibility and control in the cloud provide organizations with security as well as cost savings, speed, agility, efficiency, and innovation. Amazon Web Services (AWS) is one such provider which allows for the maximization of cloud opportunities, promising scalability, the elimination of capital expenses, and no latency.

Why Organizations Move to AWS

Economics & Infrastructure

Pay-per-use models are attractive to both small startups and gigantic corporations, and significant cost savings are available for those with unique and individually defined computing needs. Moreover, AWS requires no investment in physical hardware or space due to their globally distributed data centers, and when implementing AWS, organizations benefit from enhanced performance and improved disaster recovery.


While AWS provides a self-service model, organizations typically don’t require the same quantity and level of IT staff. Tasks such as data center maintenance are managed by Amazon, and many organizations make use of management providers for superior optimization and governance.

Innovation through Responsiveness & Agility

Organizations are working hard to out-perform, out-deliver, and out-innovate their competitors, and with its majority cloud market share, Amazon is one of, if not the, fastest innovators in its space. Further, AWS lets companies develop and deploy applications quickly with instant access to nearly limitless computing power. It is an enabler of corporate innovation due to the fact that companies running AWS can move faster and be more agile than their competitors.


While AWS provides a self-service model, organizations typically don’t require the same quantity and level of IT staff. Tasks such as data center maintenance are managed by Amazon, and many organizations make use of management providers for superior optimization and governance.


Responsiveness & Agility organizations to quickly increase capacity, reduces downtimes, encourages rapid experimentation and innovation, and increases global reach. Additionally, AWS lets companies develop and deploy applications quickly with instant access to nearly limitless computing Security

With security one of the biggest concerns in all of IT, Amazon holds a range of the most essential certifications, including HIPAA, PCI, ISO, and Sarbanes-Oxley. It also maintains separation of logical and physical access to data for further protection, and it’s unlikely that more than a handful of businesses around the world are able to match Amazon’s provisions.

data centers are distributed across the world, and multiple, independently operated data centers per region provide different failure domains. When implementing AWS, organizations benefit from enhanced performance and improved disaster recovery.

5 Steps to Organization-Wide Visibility & Control of AWS

craig-devesonThough the choice drivers for AWS adoption are clear, organizations often fail to realize the promised benefits of cloud due to a lack of visibility and control of their cloud infrastructure at each stage of their cloud adoption journey.

Craig Deveson, founder, and CEO of CloudMGR, suggests a five-step plan for organization-wide visibility and control of AWS:


  1. Develop a visibility framework
  • Determine what’s actually running.
  • Bring visibility to cloud consumption with tools such as AWS console, AWS API, 3rd party billing, and cost management devices.
  • Standardize which services are used so that business units can build on and adapt them.
  • Control shadow IT.
  1. Tap into the partner ecosystem
  • Use technology partner tools to simplify billing and cost management, set up a self-service portal, and perform optimization tasks.
  • Leverage the consulting partner network to perform migration tasks, develop governance practices, and outsource service management.
  1. Move culture from CapEx to OpEx
  • Because CapEx has long been the central budgeting mechanism for businesses, OpEx will require a change in thinking from IT and finance: establishing comfort with distributed access, resource responsibilities beyond IT, and avoiding “out of sight, out of mind” thinking.
  1. Create a governance structure
  • Needless to say, maintaining compliance with best practices, corporate governance requirements, and security by corporate users and service providers is essential. Develop a usage and control policy, control risk with cloud governance, manage access and permissions, and review compliance via regular audits.
  1. Build self-service capability
  • Finally, giving teams the agility to experiment and be innovative, provide controlled access that lets team members manage their own resources. This includes on-demand access, automation tools, and cost control mechanisms


CloudMGR’s objective is to “give businesses the visibility and control required to get the most from their cloud” by connecting all of an organization’s important systems into a single platform. CloudMGR develops a visibility framework and allows the creation of a central control dashboard. This means moving from a CapEx to OpEx culture with chargebacks and cost centers, as well as the development of self-service capability through the CloudMGR White Label service. Making it easier for teams and leaders to understand cloud resource usage, CloudMGR recognizes that a move to the cloud doesn’t guarantee full exploitation of its many benefits and so provides the tools companies need to achieve maximum operational efficiency from their cloud environments.


By Jennifer Klostermann

Do Not Rely On Passwords To Protect Your Online Information

Do Not Rely On Passwords To Protect Your Online Information

Password Challenges 

Simple passwords are no longer safe to use online. John Barco, vice president of Global Product Marketing at ForgeRock, explains why it’s time the industry embraced more advanced identity-centric solutions that improve the customer experience while also providing stronger security.

Since the beginning of logins, consumers have used a simple username and password to secure their sensitive information across the Internet. This approach made do in the early days of ecommerce, but with the rampant growth of phishing and other fraudulent activity, it’s time for a new industry standard. For businesses everywhere, this need for change has created important questions about how to protect sensitive information in a cost-effective manner, without diluting customer usability and convenience.

Everyone is on mobile, which calls for more security on-the-go

cloud_200The mass adoption of mobile devices presents the most obvious need for greater online security control. The sheer number of mobile devices around the world means organizations can implement more robust, two-factor or multi-factor authentication systems without having to worry about the high cost of providing the devices to consumers themselves. Under a two-factor authentication system, traditional usernames and passwords remain the first step in identity verification, but users are then required to input a second authentication factor to further verify who they are. This involves sending a unique code or password to a user’s mobile device; the user must input this along with his or her credentials to be granted access. Multi-factor authentication systems such as the Apple iPhone TouchID add a biometric factor such as a fingerprint.

Mobile-based authentication, which is gradually becoming the benchmark standard for online businesses, gives peace of mind to consumers. However, such authentication is not without its issues. Mobile devices are not always secure, and unfortunately, a growing volume of malware is specifically programmed to target them. Such malware can allow criminals to scrape verification codes directly from devices if the codes are sent over data networks. The impact of mobile-based authentication on the user experience is also a concern, as many consumers do not want to have to enter multiple passwords every time they access their online accounts.

Next-gen security goes biometric

Adding biometric layers such as fingerprint or facial recognition technology, or messaging-based authentication processes could be the answer to the woes of mobile-based authentication. Biometrics could further boost security, with minimal impact on the user experience. As pointed out in a recent Gartner report, “Smartphone devices can make use of network-based push notification services that provide a secure out-of-band authentication channel. Authentication servers send notifications via the smartphone OS vendor. These messages are routed to a preregistered device and awaken a local app that can further authenticate the user via contextual information, PIN/password or biometric method. After successful local authentication, the app notifies the requesting authentication service of success, which completes the out of band (OOB) loop.” High-end smartphones offer these capabilities, but until they are more widely available, biometric authentication is unfortunately unlikely to be a viable solution for the majority of consumers.

Another alternative is to add extra layers, such as push authentication, to the two-factor process; this increases security but does not impact the customer experience. When first-time consumers sign into a website that uses push authentication, they will be asked to scan an on-screen Quick Response (QR) code with their mobile devices. This creates an ‘ID tether’ between users and their devices. The next time the user logs in, a push notification is sent to his or her device; all the user has to do is tap ‘approve’ in order to proceed. Importantly, these messages are usually sent over a different network, usually the cellular network, making interception by malware or other criminal monitoring of data activity extremely difficult.

Behavior-based monitoring will become an industry standard


(Image Source: Shutterstock)

End users’ demand for multifactor authentication has accelerated in recent months, and businesses are more aware of the threats posed by online criminal activity, which makes major news headlines almost daily. Multifactor authentication, however, still relies upon a lock and key approach to online security. This means that once someone is through the front door (i.e., they have gained entry to the account), there are usually no other obstacles between them and the sensitive data contained within. For these reasons the most forward-thinking organizations are looking to implement solutions that offer adaptive risk authentication and continuous security.

Adaptive risk authentication and continuous security provide an on-going view of online security. Which means that just because someone has gained access to an account, it does not mean they have full and free access to the data within the account. Adaptive risk authentication scores user behavior based on key criteria such as IP address, device ID, number of failed login attempts and more to establish if the behavior is consistent with established ‘normal’ user behavior patterns. Any deviations outside of the norm result in a higher risk score, which triggers additional security questions, re-authentication or, if necessary, the removal of the token assigned to the online session. Most importantly, algorithms responsible for scoring each session run silently in the background. Users are only made aware of them if their behavior is deemed to be suspicious. The user experience is not compromised in any way, despite the higher levels of security in place.

Usernames and passwords are not dead just yet. They will continue to have their place online for a while, but it is increasingly obvious that in isolation, they are no longer enough to keep sensitive information safe. Thankfully for consumers, advanced security such as multifactor authentication, adaptive risk and continuous security is on the horizon. Inevitably, even the most robust lock-and-key solutions will give way to more reliable behavior-based monitoring, as the fight to keep sensitive data secure online continues to evolve.

By John Barco

John Barco, ForgeRock _headshotJohn Barco is vice president of Global Product Marketing at ForgeRock. John has 20+ years of experience building innovative products for enterprise customers, focusing on identity and access management for the last 12 years. Prior to joining ForgeRock, he served as Senior Director of Product Management for the Identity Management group at Sun. John has also held leadership positions at iPlanet, Silicon Graphics, NComputing, and IronKey. He holds a degree in industrial engineering from Missouri State University.

3 Developing Expectations For The IoT

3 Developing Expectations For The IoT

IoT Expectations

The Internet of Things, or IoT, has received a lot of attention from tech analysts and curious consumers lately, in large part because its concept is so promising and exciting.

The IoT is based on the idea that all kinds of household objects could have embedded Wi-Fi capabilities, allowing them to go online and communicate with each other. Let’s take a look at a few things people have speculated about that might occur soon, all thanks to the IoT.

1. Prevention and Management of Chronic Diseases Could Improve

Healthcare is characteristically an industry crippled by high costs. It’s also a sector that could greatly benefit from the IoT. Such technology could prevent people from becoming chronically ill, plus improve care management for patients already diagnosed with ongoing illnesses.


(Image Source: Shutterstock)

Most of the nation’s healthcare budget goes toward treating chronic diseases, so it makes sense that programs which encourage smoking cessation, weight loss or other healthy lifestyle choices are a big business opportunity. Even so, most chronic diseases are treated reactively, rather than proactively, and the IoT could change that.

Wearable devices, like those offered by Apple, Fitbit and Withings, currently make it easy and fun for people to set and reach their wellness goals. A company called Omada Health also offers similar devices to pre-diabetic patients, urging them to lose weight in hopes of avoiding chronic blood sugar issues.

Another way the IoT could improve the healthcare industry is through the use of “smart” devices that are worn on the body and are able to detect abnormalities. Theoretically, these gadgets could alert the wearer that something may be amiss with his or her health, allowing the person to seek medical intervention before it’s too late.

Furthermore, data collected by the devices could be automatically sent to the cloud via API, so healthcare providers might examine it without the device’s user having to do anything. That means the IoT could also play a role in helping healthcare workers make more informed and relevant decisions about the treatment plans of their patients.

The IoT could help physicians make diagnoses more efficiently, too. This will become possible when emerging technology leads to a decrease in the manufacturing costs of expensive equipment, such as MRI machines.

2. Inadequate Cyber Security Measures Could Adversely Impact Health-Related Benefits

Despite the exciting possibilities discussed above about chronic illness management, some experts still have concerns about patient data getting compromised. Analysts warn it may be very hard to implement proper security measures on very tiny devices. Furthermore, IoT gadgets are going through such a rapid revolution that they could be used on a massive scale within just a few months.

ksenia-votinovaKsenia Votinova, Technology Entrepreneur & Chief Marketing Officer at Le VPN, says that Virtual Private Networks (or VPNs) could be used to keep personal data secure as it gets transferred from users’ home devices to the cloud:

Installing a VPN on a home router would allow people to secure the internet connection of all their devices that connect to this router – like computers, mobile devices, smart TVs, game consoles, etc

It works like this: a VPN encrypts the internet connection of all the devices, making any online activity secure and private. This is done through the most sophisticated encryption algorithm (AES-256), which is impossible to hack. Therefore nobody can hack all the devices that are connected to the router secured by a VPN

So, even though security concerns about the IoT have arisen, we can acknowledge that tech has also been developing to counteract potential security threats imposed by IoT.

3. Some Jobs Will Become Obsolete, While New Careers Get Created

New technologies can create jobs, or take them away. When smartphones became popular, there was a sudden need for people who could design and test apps for mobile platforms, for example.

On the other hand, as technology improves, it can make some jobs irrelevant. That happened to many grocery clerks and baggers when self-checkout stations became popular. Although most grocery stores still have human staff members at the checkouts, self-checkout lanes often dominate those workers, especially during certain hours of the day.

We can expect the IoT will reduce the need for low-skilled workers engaged in repetitive jobs. However, the IoT doesn’t solely spell bad news for people in the job market. Target is one well-known retailer that recently offered a position for someone to be in charge of using the IoT to develop consumer solutions.

Another new job title you can expect to see soon is Chief IoT Officer. That person will likely set out the framework for a company’s IoT strategy, and then implement the associated technology that aligns with current business goals. Additionally, the worker will gather data from IoT devices and make decisions based on those analytics.

These are just three likely outcomes driven by the IoT. In the weeks and months to come, there will surely be many more fascinating possibilities to ponder.

By Kayla Matthews

Despite Record Breaches, Secure Third Party Access Still Not An IT Priority

Despite Record Breaches, Secure Third Party Access Still Not An IT Priority

Secure Third Party Access Still Not An IT Priority

Research has revealed that third parties cause 63 percent of all data breaches. From HVAC contractors, to IT consultants, to supply chain analysts and beyond, the threats posed by third parties are real and growing. Deloitte, in its Global Survey 2016 of third party risk, reported that 87 percent of respondents had faced a disruptive incident with third parties in the last two to three years.


In May this year, Ponemon Institute published the results of a 617 person survey that revealed that 75 percent of IT and security professionals said the risk of a breach from a third party is serious and increasing.

The infamous Target breach that occurred during the 2013 holiday shopping season is a prime example of a catastrophic third party data breach. Target confirmed that payment card information from roughly 40 million customers was stolen, as well as 70 million customer records. The root cause of the data breach was compromised network credentials that linked back to the company’s third party HVAC systems subcontractor. The breach cost Target millions of dollars, damage to its brand and reputation, and the resignation of both its CEO and CIO. In the past 12 months, organizations represented in the Ponemon report spent an average of $10 million each to respond to a security incident that was the result of negligent or malicious third parties.

Despite these warnings, a recent study conducted by the Soha Third Party Advisory Group, which consists of industry security and IT experts from Aberdeen Group; Akamai; Assurant, Inc.; BrightPoint Security; CKure Consulting; Hunt Business Intelligence, PwC; and Symantec, found that just two percent of respondents consider third party access a top priority in terms of IT initiatives and budget allocation. The report, which surveyed over 200 enterprise IT and security C-Level executives, directors and managers from enterprise-level companies, uncovered a few reasons for this apathy.

Breaches Happen to Other Organizations

Data Breach Comic

While CVS, American Express and Experian are just a few of the recognizable organizations that have recently suffered through a significant third party breach, the negative news stories published about them and others has not done much to motivate today’s IT personnel. Sixty-two percent of respondents to the Advisory Group report said they do not expect their organization to be the target of a serious breach due to third party access, but they believe 79 percent of their competitors will suffer a serious data breach in the future. Interestingly, 56 percent acknowledged they had concerns about their ability to control and/or secure their own third party access.

Providing Third Party Access Is Difficult

The complexity of providing secure access to applications spread across many clouds or in multiple data centers, and to contractors and suppliers who do not work for you, using devices IT knows nothing about, is a challenge. The Third Party Advisory Group report found that most of those polled believe that providing third party access was a complex and tedious process. The survey found IT needs to touch five to 14 network and application hardware and software components to provide third party access. Fifty-five percent said providing third party access to new supply chain partners or others was a “Complex IT Project,” and on average, they have to touch 4.6 devices, such as VPNs, firewalls, directories, and more. Forty percent described the process as tedious or painful, and 48 percent described it as an ongoing annoyance. This is a problem that will not go away anytime soon, as 48 percent of respondents saw third party access grow over the past three years, while 40 percent said they see growth continuing over the next three years.

People Are Not Afraid of Losing Their Jobs

When the Advisory Group survey asked IT professionals “If a data breach occurred in your area of responsibility, would you feel personally responsible,” 53 percent said they would, because they felt it would reflect poorly on their job performance. However, only 8 percent thought they might lose their jobs if a data breach occurred during their watch. The survey showed that IT professionals takes their jobs seriously, but it is unclear who is being held accountable for data breaches and how this ambiguity might affect attitudes and behavior in ensuring organizations are safe from outside threats.

Four Must-Have Features for Secure Third Party Access

When evaluating a secure third party access platform, it’s important the solution be able to navigate and manage a complex maze of people, processes and technologies. The solution should provide a convenient, simple and fast way to manage the platform, policies and security. And at minimum, the solution under evaluation should include the following four features:

  • Identity Access: Identity Access confirms that the third party vendor accessing the IT network has the right to do so. The goal is to provide authenticated end user access only to the specific applications the vendor needs, not to the whole network.
  • Data Path Protection: Rather than building a unique access string through an organization’s firewall, data path protection allows existing security measures to stay as they are, without having to be altered. This feature provides a secure pathway for vendors to access the parts of the network that they need for work purposes. And in the event that credentials are compromised, the direct pathway prevents outside attackers from scanning through the network.
  • Central Management: Keeping track of vendor access can be a challenge, but a centrally managed solution allows organizations to manage and control third party access in a simple and uncluttered fashion. The elimination of complexity means easy, functional connections that provide fundamentally better security that allows for detailed audit, visibility, control and compliance reporting.

The divide between IT priorities and the need to mitigate third party data breaches affects all industries. IT professionals must recognize that the threat from third parties accessing their infrastructure is very real. The good news is that with the right access platform with the appropriate feature sets, organizations can significantly mitigate their risk.

0015Soha-Mark-June-2015-head-shotBy Mark Carrizosa, chief information security officer (CISO) and vice president of security for Soha Systems.

Mark joined Soha in 2015 from Walmart, where, as principal security architect, he developed and implemented the company’s global e-commerce security architecture framework. Prior to Walmart, Carrizosa was operational risk consultant at Wells Fargo, where he analyzed the company’s infrastructure and application compliance to improve the security risk posture of both customer-facing and internal systems.

CloudTweaks Comics
Update: Timeline of the Massive DDoS DYN Attacks

Update: Timeline of the Massive DDoS DYN Attacks

DYN DDOS Timeline This morning at 7am ET a DDoS attack was launched at Dyn (the site is still down at the minute), an Internet infrastructure company whose headquarters are in New Hampshire. So far the attack has come in 2 waves, the first at 11.10 UTC and the second at around 16.00 UTC. So…

Cloud Infographic: Security And DDoS

Cloud Infographic: Security And DDoS

Security, Security, Security!! Get use to it as we’ll be hearing more and more of this in the coming years. Collaborative security efforts from around the world must start as sometimes it feels there is a sense of Fait Accompli, that it’s simply too late to feel safe in this digital age. We may not…

The DDoS That Came Through IoT: A New Era For Cyber Crime

The DDoS That Came Through IoT: A New Era For Cyber Crime

A New Era for Cyber Crime Last September, the website of a well-known security journalist was hit by a massive DDoS attack. The site’s host stated it was the largest attack of that type they had ever seen. Rather than originating at an identifiable location, the attack seemed to come from everywhere, and it seemed…

The Conflict Of Net Neutrality And DDoS-Attacks!

The Conflict Of Net Neutrality And DDoS-Attacks!

The Conflict Of Net Neutrality And DDoS-Attacks! So we are all cheering as the FCC last week made the right choice in upholding the principle of net neutrality! For the general public it is a given that an ISP should be allowed to charge for bandwidth and Internet access but never to block or somehow…

Are CEO’s Missing Out On Big Data’s Big Picture?

Are CEO’s Missing Out On Big Data’s Big Picture?

Big Data’s Big Picture Big data allows marketing and production strategists to see where their efforts are succeeding and where they need some work. With big data analytics, every move you make for your company can be backed by data and analytics. While every business venture involves some level of risk, with big data, that risk…

3 Keys To Keeping Your Online Data Accessible

3 Keys To Keeping Your Online Data Accessible

Online Data Data storage is often a real headache for businesses. Additionally, the shift to the cloud in response to storage challenges has caused security teams to struggle to reorient, leaving 49 percent of organizations doubting their experts’ ability to adapt. Even so, decision makers should not put off moving from old legacy systems to…

How Formal Verification Can Thwart Change-Induced Network Outages and Breaches

How Formal Verification Can Thwart Change-Induced Network Outages and Breaches

How Formal Verification Can Thwart  Breaches Formal verification is not a new concept. In a nutshell, the process uses sophisticated math to prove or disprove whether a system achieves its desired functional specifications. It is employed by organizations that build products that absolutely cannot fail. One of the reasons NASA rovers are still roaming Mars…

The Rise Of BI Data And How To Use It Effectively

The Rise Of BI Data And How To Use It Effectively

The Rise of BI Data Every few years, a new concept or technological development is introduced that drastically improves the business world as a whole. In 1983, the first commercially handheld mobile phone debuted and provided workers with an unprecedented amount of availability, leading to more productivity and profits. More recently, the Cloud has taken…

Using Cloud Technology In The Education Industry

Using Cloud Technology In The Education Industry

Education Tech and the Cloud Arguably one of society’s most important functions, teaching can still seem antiquated at times. Many schools still function similarly to how they did five or 10 years ago, which is surprising considering the amount of technical innovation we’ve seen in the past decade. Education is an industry ripe for innovation…

The Cancer Moonshot: Collaboration Is Key

The Cancer Moonshot: Collaboration Is Key

Cancer Moonshot In his final State of the Union address in January 2016, President Obama announced a new American “moonshot” effort: finding a cure for cancer. The term “moonshot” comes from one of America’s greatest achievements, the moon landing. If the scientific community can achieve that kind of feat, then surely it can rally around…


Sponsored Partners