Hi! David Mortman here. I’m enStratus’s Chief Security Architect and I’ll be periodically blogging here to cover issues related to security and the cloud. One of the themes I’ll be hitting a lot over the coming months is the power of automation and how that makes your organization not only more efficient but also more secure.
Case in point, multiple studies have shown that one of the biggest contributors to downtime at companies is human error (Visual Ops, Visual Ops Security by Gene Kim et al.). Automation can remove much of the human element from this equation and especially in the case of repeatable actions, ensures that those tasks are done the same way every time. This is hugely helpful during the audit process for compliance regimes.
Similarly, as we’ve learned from the Verizon DBIR, one of the biggest contributors to security breaches over the years is the failure by organizations to change or revoke access to resources after individuals change or leave jobs. This is yet another place where automatic processes can be very helpful.
Once you have automation in place, you can start doing some really interesting things very efficiently. For example, deployment of patches becomes even simpler, as does the provisioning (and de-provisioning) of users across machines. You can also start automating the handling of encryption keys or other sensitive data. This means that you can now reduce the number of employees who need access to that sort of data even more. And, as an added bonus, all of these actions are logged by default which also helps with audit and compliance concerns be it from customers, partners or regulators.
More on the power of automation in a later post.
David Mortman is the enStratus Chief Security Architect and has been doing Information Security for well over 15 years. Most recently, he was the Director of Security and Operations at C3. Previously, David was the CISO at Siebel Systems and the Manager of Global Security at Network Associates. David speaks regularly at Blackhat, Defcon and RSA amongst other conferences. Additionally, he blogs at emergentchaos.com, newschoolsecurity.com and securosis.com. David sits on a variety of advisory boards such as Qualys and Igie. He holds a B.S. in Chemistry from the University of Chicago and bakes, cooks and juggles in his spare time.
i think this will not protect you at all! my idea is use two or more systems to protect!
Posted by: freelance writers | 01/30/2012 at 04:59 AM