NC1801

NETWORKEXPERT
technologies only complicate. Hubert again, "Instead of connecting networks or locations, SD-P uses a host-based approach, connecting people
and things directly to the applications and resources they require. For example, a laptop that needs access to a server in the company data centre
will have a direct, encrypted and hidden connection directly to that server. Different devices and users can easily be granted tailored granular
permissions, without the complexity of a cumbersome access control list."
When it comes to IoT systems SD-P operates in much the same way. IoT devices are essentially quite simple, with enough logic to perform a single
function, quite often data gathering as opposed to computing. The processing, interpreting and distributing of collected data must take place
elsewhere, and SD-P can provide a secure and direct connection between an IoT device and the associated computing device or application.
Hubert again, "SD-P actually enables management and control of IoT devices from a remote location. Thanks to the direct LAN-like connection
between the IoT devices and other computers or applications, the computing to control and manage IoT devices need not take place on site." SD-P
makes it possible to set up a Virtual Cloud Network (VCN) on top of the public Internet, "In other words, an invisible, instant, private network that
functions independent of the connectivity source. Every person and each thing is cloaked, hidden from attackers in a dark cloud using the VCN's
private address space."
Hubert concludes, "Simple policies enable micro-segmentation to ensure devices and people are connected only to the users, applications and
resources to which they need access, by invitation only. This limits the attack surface and mitigates the risks of a DDoS attack."
The cloud has made it easy for those working outside of IT to deploy applications,
but this is casting a long shadow over security, compliance and best practice. S is
for Shadow IT. These are services that employees use without the knowledge of the
IT team. It's always been an issue, but the emergence of cloud-based applications has
helped employees to easily and cheaply circumvent established IT procurement process.
It's now very easy for a department to use its own resources to deploy cloud apps for
storing and sharing company data. There is the possibility that shadow IT may provide a
short-term productivity boost but it also decreases data security and hinders regulatory
compliance, as IT teams are blind without the means to monitor for data leakage.
Rich Campagna, CEO at Bitglass explains that "With unmanaged applications,
organisations must gain visibility and control over what employees are doing with
corporate cloud data. To achieve this, many companies are turning to cloud access
security brokers (CASBs). Visibility functions scrutinise firewall or proxy logs, giving IT
teams a deeper understanding of the cloud apps in use and their associated risk.
Control functions allow the organisation to take action on unmanaged applications. For
example, an organisation in financial services may need its employees to access cloud
file sharing for collaboration with their customers, but prohibit data from being uploaded
to the apps. CASBs can effectively make these apps read-only to facilitate the desired use case."
Despite this, traditional methods of shadow IT discovery are limited. In the past, CASB vendors have manually compiled
application catalogues so that their discovery tools can identify unsanctioned applications. But even with a huge dedicated resource
evaluating applications, their constant creation and revision in the cloud leaves these catalogues perpetually out of date.
Rich asserts that "The application catalogue approach can never completely defend against shadow IT. In light of this,
organisations must utilise solutions that can automatically identify, evaluate and control unsanctioned applications without human
intervention or reliance on application catalogues. These emerging techniques leverage machine learning to detect and analyse all
shadow IT as it is accessed by employees. From here, IT teams can block unsanctioned apps, provide limited levels of access or
suggest sanctioned alternatives. In the future, complete visibility and control over shadow IT will be a prerequisite when operating in
a cloud-first world." NC
20 NETWORKcomputing JANUARY/FEBRUARY 2018 @NCMagAndAwards
WWW.NETWORKCOMPUTING.CO.UK