Bait Phone
You may be familiar with the truTV program Bait Car, where the police place a vehicle equipped with hidden cameras and radio trackers in various areas to catch a would be car thief in the act. It’s kinda fun to watch people ‘check out’ the car, check out the surroundings and decide to jump in and drive off. You get to see their excitement as they think that they’ve just won the jackpot along with the utter despair as officers remotely kill the car and the thief is surrounded. Even the excuses as to why they are driving it are hilarious. ‘I was just moving it for my friend, so they wouldn’t get a ticket, whose name I forgot and I also can’t remember where they live.’ In the UK, they got something similar except with mobile phones called ‘Operation Mobli.’ Plain clothes police purposely left "bait" phones embedded with tracking devices in nine pubs and bars across the towns of Hastings and St Leonards in Sussex. I’m not sure what makes and models of phones were left for the taking but none of the baited devices were stolen. In every case, an honest patron noticed the ‘forgotten’ phone and turned in to the bar staff. Some might describe this sting as a failure but according to the Sussex Police’s press release Sgt Ché Donald said, ‘This was an excellent result and my faith has been restored as the phones were honestly handed in.’ I often write about the potential perils of losing a smartphone crammed with private data and all the unfortunate circumstances that follow. If it gets into the wrong hands then that is the case yet we must also remember that there are plenty of good, honest folks out there who will do the right thing when they find something that doesn’t belong to them. Maybe they’ve seen police sting shows, maybe they’ve lost something themselves, maybe their parents raised them right or maybe it’s simply kindness and honesty that’s built into every one of us. Human’s are capable of the greatest good and the nastiest of evil, it’s all how we decide to play it. ps References: Operation Mobli deters mobile phone thieves in Hastings Police mobile phone sting fails when.. err.. no handsets stolen Mobile-phone 'sting' reveals honesty of Sussex pubgoers Police Sting Operation Yields No Mobile Phone Thefts It's legal: cops seize cell phone, impersonate owner What’s in Your Smartphone? Freedom vs. Control BYOD–The Hottest Trend or Just the Hottest Term Will BYOL Cripple BYOD?You Are the Device in 2016
… and the controller and data generator. Were you surprised with that new car in your driveway sporting a huge bow this holiday season? Yea, me neither. But we did get a new gaming console that doesn’t require you to hold a controller in your hand. You know The One. It has a camera that picks up your body movements and turns that into action on your screen. It’ll even scan your face and create a digitized, animated You right in front of your eyes. You can then choose your You to play games. Now I realize some of you have had these for several years but we’ve been stuck in 2010 at our house…at least with gaming consoles. For 2016, You are now the device, controller and data generator. The Consumer Electronics Show (CES) is this week and plenty of new gadgets are being unveiled to interact with our lives. Starting at the bottom, smart shoes might be the next big thing to hit stores this year. According to the manufacturer, you’ll be able to control the temperature of the shoe with a mobile app and it’ll count your steps more accurately than the thing you wear on your wrist or carry in your pocket. The temperature control idea is interesting since one of the ways to stay comfortable in the summer heat is to keep your feet cool. There’s also self-lacing shoes on display. A fitness company also unboxed smart footwear that tracks time and date, duration, distance and splits, without a runner having to carry other devices. As we move up the body, a smart belt called Belty is grabbing people’s attention. Like any other belt, it fits through your pant loops but the motorized insides will adjust loose when sitting and tighten up when you stand. You can also have it vibrate to remind you to stand every so often if you’re on your bottom too long. It keeps track, via a smartphone app, not only of your steps but also your expanding or diminishing waistline over time. Will it shame you come next Thanksgiving? Maybe not, but the sounds and sights of a roomful people unhinging their pants after a big meal might become an era gone by. There are also new fitness trackers, smart shirts, smartwatches, gesture controlled cars, grocery shopping fridges, and even a digital laser hair treatment that you put on your scalp for 90 seconds every night and the company claims that it’ll restore thinning hair. Home hubs will be built into smart televisions and fridge cams will allow you to see if the light really goes out when you close the door. Sensors in our society have become commonplace and while in the past they’ve been used to track weather, traffic conditions and how much we weigh, they are now attached to our bodies gathering information about us and reporting back. Forget about BYOD, we’re back to the old, ever popular BYOB – Bring Your Own Body. ps Related: Wearables Head to Tail Oh, Is That The Internet You're Wearing? The Digital Dress Code Connecting the Threads IoT Influence on Society Our Five Senses on Sensors Hacking the Internet of Things looms over CES Technorati Tags: f5,iot,things,ces,sensors,wearables,silva Connect with Peter: Connect with F5:
새로운 모바일, 하이브리드 세상의 접근 관리
This post is adapted from Jay Kelley's original entry. 기업 환경에 완전히 새로운 세상이 출현함에 따라 ‘새로운 표준’들과 새로운 기회가 생겨나는 반면, 기업들은 조직 전체에 전광석화처럼 다가올 새로운 도전과제들과 마주하게 되었다. 오늘 날 그리고 미래의 근무환경은 계속해서 모바일 중심으로 나아갈 것이다. 모바일 근로자의 수만큼 모바일 디바이스가 두 세배로 증가하게 될 것이라는 전망은 말할 것도 없는 명백한 사실이다. IDC가 2015년 연말에 이르면 전 세계 노동력의 37%가 모바일 근로자가 될 것이라고 분석하였고 이는 전 세계적으로 13억 명의 모바일 근로자가 올해 안에 생긴다는 뜻이다. 오렌지 비즈니스 서비스(Orange Business Services)에 따르면, 2018년에 이르면 전 세계 IP 트래픽의 55%가 모바일 비즈니스 인터넷 트랙으로 인해 발생할 것이라고 한다. 즉, 모빌리티는 현재 진행되고 있으며 우리 생활의 일부가 되었음을 알 수 있다. IDC는 아시아 태평양 지역의 BYOD(Bring your own device) 디바이스 시장이 계속해서 활발한 성장세를 이어나갈 것으로 예상했다. 2014년 아태지역 내 BYOD 관련 디바이스의 숫자는 스마트폰 1억 5천 5백만개, 태블릿PC 4백만개 이상을 기록하였다. 이는 전년 대비 각각 40.4%, 62.7%씩 성장한 숫자이며 현재 급증하고 있는 웨어러블 디바이스는 포함되지 않은 수치라는 것을 감안했을 때 매우 큰 수치이다. 모바일 인력이 빠르게 증가하고 기업 내에서 사용하는 스마트폰, 태블릿PC, 웨어러블 기기들이 폭발적으로 증가함에 따라, 기업 내에서 사용하는 클라우드 및 SaaS 기반 애플리케이션의 증가 속도 또한 맹렬하게 치솟고 있다. 클라우드 애플리케이션 제공업체인 스카이하이 네트웍스(Skyhigh Networks)의 최근 조사에 따르면, 오늘 날 기업들이 사용하고 있는 클라우드 서비스는 759개에 달한다고 한다. 가장 당혹스러운 것은 현재 사용 중에 있는 클라우드 애플리케이션 및 서비스의 규모가 크다는 점이 아니다. 클라우드 보안 연맹(Cloud Security Alliance)의 연구에 따르면, 문제는 대부분 기업의 IT 부서는 그들이 사용 중인 클라우드 기반 애플리케이션이 50개 이하라고 생각한다는 것이다. 즉, 기업마다 평균 700개 이상의 클라우드 애플리케이션 및 서비스를 사용하고 있지만 아무도(사용자 또한) 애플리케이션 및 서비스에 대한 관리를 하고 있지 않으며 어떠한 기업 정보도 공유되지 않고 있다는 사실이다. 문제는 이렇게 알지 못하는 문제점에 대해서는 예방조차도 되지 못한다는 사실인 것이다. 결국, 기업들에게 있어 “새로운 표준”이라는 혼란스러운 퍼즐의 마지막 조각은 바로 호스티드 프라이빗, 공공 및 클라우드 인프라와 함께 데이터센터와 클라우드 기반 애플리케이션 및 데이터가 절묘하게 조합된 하이브리드 네트워크이다. 가트너는 “실제 하이브리드 클라우드 컴퓨팅의 구축 사례는 찾아보기 어렵고, 대기업들의 4분의 3은 2015년 이내에 하이브리드 클라우드를 구축하길 기대한다”고 분석했다. 모바일 인력이 인프라 변화를 가져오는 것을 감안할 때 더욱 다양한 디바이스 생태계의 문제 해결에 대한 필요성도 제기되고 있다. 모빌리티를 해결한 인프라는 팽창하고 있는 디바이스 생태계를 지원하기 위한 클라우드 기반의 애플리케이션 및 서비스에 대한 더 큰 규모의 투자를 필요로 한다. 그러므로, 당분간 가까운 미래 네트워크의 트렌드는 하이브리드 형태가 될 것이라는 것을 알 수 있다. 모빌리티, 클라우드 및 하이브리드 네트워크의 “새로운 표준”을 통해 네트워크, 애플리케이션 그리고 데이터 접근성을 어떻게 해결할 수 있을까? 모바일 디바이스이자 기업 통제 아래 있는 새로운 디바이스들은 넘쳐나고, 애플리케이션 및 데이터는 네트워크와 다양한 클라우드 및 SaaS 구축 기반에 흩어져 있는 상태에서 기업들은 어떻게 신속 적합하고 인증 및 승인된 접근을 확인할 수 있을까? 이렇게 다양한 변수들 속에서도 변함없는 한 가지는 바로, 개인정보이다. 사용자 그리고 그들의 개인정보는 현재 그리고 앞으로도 기업에게 있어 틀림없는 “새로운 경계선(방어선)”이 될 것이다. 기존 네트워크 경계가 사라지거나 대부분의 경우 여러 부분으로 흩어지면서 새로운 경계로 등장한 것이 바로 개인정보이다. 애플리케이션, 데이터 그리고 네트워크까지 클라우드로 빠르게 나아감에 따라, 사용자가 관리하고 BYOD가 주도하는 모바일 생태계는 기하급수적으로 팽창하고 있다. 또한 기업의 관리는 더욱 어려워지고 광범위해졌으며 외부에 더욱 의존하게 되었다. 문제는 이들 외부업체가 대부분 보안에 대한 충분한 지식이 없거나 무관한 업체라는 점이다. 그럼에도 사용자 개인정보 문제는 전혀 개선되지 않고 있다. AAA 기술(authentication, authorization 및 accounting)의 뒷받침으로 개인정보는 이제 안전한 기업 접속 방어의 최전선에 위치하고 있다. 그러나, 개인정보는 접근권의 새로운 매개변수를 관리하는 방법의 일부분이다. 사용자 접근 요청의 내용, 접근 요청 시의 환경은 개인정보에 버금가며, 논의할 것도 없이 개인정보처럼 적합한 접근을 보장하는 것과 관련된 것이다. 누가, 언제, 어디서, 무엇을 어떻게, 왜라는 육하원칙을 해결하는 능력이 네트워크, 클라우드, 애플리케이션, 데이터 등이 어디에 있고 어떻게 구성되어있던 간에 안전한 접근을 보장하고 강화하고 차별화한다. 사용자의 개인정보를 네트워크, 클라우드, 애플리케이션, 데이터 등 어디에서나 효율적이고 안전하게 공유될 수 있게 보장하는 것은 이제 필수적인 사항이 되었다. 그러나 여전히 개인정보 사일로(silo), 클라우드 기반 그리고 SaaS 기반 애플리케이션 및 데이터 등의 온프레미스 개인정보 그리고 여러 사용자 이름과 비밀번호로 사용자들을 피로하게 하는 암호 피로도와 같은 해결과제들이 남아있다. 바로 이 지점에서 개인정보 브릿지가 활용될 수 있다. 페더레이션은 SAML과 같은 업계 표준을 통해 네트워크, 클라우드, 애플리케이션 등의 양자간의 신뢰할 수 있는 사용자 개인정보 망을 구축해준다. 개인정보 디렉토리의 번거로운 중복과 삽입은 더 이상 불필요한 사항이 되었다. 개인정보와 접근은 기업과 클라우드 및 SaaS 제공업체들 사이의 인증을 통해 기업에 의해 관리되고 있다. 일시적인 사용자 인증과 만료는 한 곳으로 집중되어 기업이 관리할 수 있다. 아이덴티티 페더레이션은 접근 가시성과 관리 기능을 함께 제공해준다. 기업들에게 접근 관리를 위한 개인정보보호 활용과 개인정보보호 브릿지 설정은 이제 반드시 거쳐야 하는 단계가 되었다. 애플리케이션이 기업 도메인의 외부로 이동하고 내부 인력과 디바이스가 모바일화되어 기업 내부에 머무르지 않으면 기업 도메인 또한 이동했기 때문이다. 모빌리티, 클라우드 및 하이브리드 인프라. 기업들이 피해나갈 수 없는 이 “새로운 표준”을 위한 보다 적극적인 기업의 준비와 전략이 필요한 때이다.
新行動化混合世界的存取控制
This post is adapted from Jay Kelley's posthere. 企業正跨入一個嶄新的世界。許多新的典範和「淘金熱潮」般的新機會出現在眼前，但同時也伴隨著新的挑戰，它們如同閃電般的貫穿企業組織。 今天乃至於未來的工作人口仍將繼續朝行動化發展。根據IDC調查，全球37%工作人口將在2015年底邁入行動化。這相當於全球有13億行動工作者，當然行動裝置數量將是這個數字的二或更多倍。再者，Orange Business Services報告指出，到了2018年，全球55%的商業IP流量將屬於行動商業網際網路流量。行動化時代已來臨，並且將繼續存在。 IDC預期亞太地區的攜帶自有裝置(bring your own device; BYOD)市場將繼續呈現強大成長。根據2014年調查，亞太區估計有1.55億支智慧型電話和超過400萬台平板電腦在使用中，而年成長率分別為40.4%和62.7%，形成支撐BYOD趨勢的基礎。而且，這項預測還沒包括新興的穿戴式裝置。 行動人口如火箭衝天般的加速成長，智慧型電話、平板電腦和穿戴式裝置大量湧現，這些現象使得雲端和軟體即服務(SaaS)應用數量呈現令人驚訝的成長速度。根據SkyHigh Networks最近的調查，今天的企業平均使用759種雲端服務。然而，最讓人困惑的並不是這些雲端應用與服務的數量。根據Cloud Security Alliance的一項調查，大多數企業IT團隊相信他們使用中的雲端應用少於50種。也就是說，平均超過700種雲端應用與服務在企業內使用 - 但除了使用者本身之外，沒有任何人可控制那些應用、服務、以及在其上分享的企業資訊。問題是，你無法捍衛那些你並不知道的東西！ 最後，企業新典範的最後一片拼圖就是混合網路(hybrid network)，亦即藉由一些代管私有、公共與雲端基礎設施，將資料中心與雲端應用和資料混合在一起。Gartner報告指出「儘管實際的混合雲端運算部署相當稀少，但將近四分之三的大型企業預期將在2015年擁有混合部署」。行動工作人口將帶動基礎設施改變，需要處理更分散化的裝置生態系統。而支援行動化的基礎設施則需要在雲端應用與服務方面投入更大的投資，以支援擴充中的裝置生態系統。因此，可以預見的是，混合網路將在可見的未來成為主流。 面對新典範的行動化、雲端與混合網路，企業如何解決網路、應用與資料存取問題？如此眾多行動化但僅受到公司有限度管控的新裝置，加上散佈在網路、各種雲端與SaaS環境的應用與資料，企業該如何確保快速、適當、驗證與授權的存取？ 在這麼多變數當中，有一項常數仍維持不變：身分識別。使用者(和他們的身分識別)將成為今天與未來的企業「新疆界」。 傳統網路邊界已被破除、斷片化、甚至瓦解成許多小片段，身分識別因此變成新的邊界。應用、資料、甚至網路都快速朝雲端轉移，使用者控制的BYOD行動生態系統呈指數成長，這些無不使得企業管控變得更為困難、分散、並且必須仰賴他人維護 - 而很多情形下，這裡所指的「他人」正是那些對於安全性欠缺警覺或者不關心的使用者。然而，使用者身分識別永遠不會改變。透過認證、授權與計費(authentication, authorization, and accounting; AAA)機制，身分識別已成為現在確保企業存取安全的第一道防線。 不過，身分識別只是管控存取的先頭部隊。使用者請求存取的當下情境，以及他們提出存取請求時所處的環境，同樣都是確保安全存取的要素。若能夠適當的管控「何人」、「何事」、「何時」、「何地」、「為何」與「如何」，就可以確保、強化和區分使用者對網路、雲端、應用與資料的安全存取，而不論那些資源駐留在何處或如何組成。 確保有效率且安全的在網路、雲端、應用程式和資料之間分享使用者身分識別(不論他們身在何處)，是現在的一項必要工作。然而，這有許多挑戰，例如身分識別孤島、雲端與SaaS應用和資料的企業內部(on-premise)身分識別、以及使用者密碼疲勞(導致較弱的使用者名稱與密碼)等都很容易被破解。解決之道就是要構築一個身分識別橋梁。聯合識別(federation)透過業界標準例如SAML，在網路、雲端、應用程式之間建立一個信任的鏈結，不再需要繁雜的身分識別目錄複製與插入。身分識別與存取由企業管控，並且在企業、雲端與SaaS服務供應商之間進行認證。企業能夠集中化的管控使用者認證與終止。聯合識別提供了存取能見度與管控能力。 利用身分識別進行存取控制以及識別橋梁的建立，是企業現在必須做的工作，因為應用程式轉移到企業領域之外，工作人口和他們的裝置日趨行動化並且群體離開企業，而企業領域本身也已移動。這就是新典範。
Access Control in the New Mobile, Hybrid World
There is a brave new world dawning for the corporate world. There are many “new norms” – and a gold rush of new opportunities, but also new challenges with which they come – streaking like lightning throughout organizations. The workforce of today and into the future is, and will continue to be mobile. Consider that according to analyst IDC, 37 percent of the worldwide workforce will be mobile by the end of 2015. That’s about 1.3 billion mobile workers, worldwide – not to mention there will be two or more times as many mobile devices as mobile workers! – by the end of this calendar year! Then, consider this: According to Orange Business Services, 55 percent of worldwide business IP traffic will be mobile business Internet traffic by 2018. Mobility is here, and it’s here to stay. (In the Asia Pacific region, IDC anticipates the bring your own device (BYOD) market will continue its robust growth. There were an estimated 155 million smartphones and over 4 million tablets in use supporting BYOD initiatives across the region last year (2014), with year-on-year growth of 40.4 percent and 62.7 percent, respectively. And, that’s not even considering the burgeoning area of wearable devices, either.) As the mobile workforce accelerates like a rocket into the stratosphere, cascading torrents of smartphones, tablets, and wearables across organizations in its wake, the number of cloud- and SaaS-based applications used within organizations is also skyrocketing at a breakneck pace. According to a recent study sponsored by SkyHigh Networks, there are on average 759 cloud services in use by today’s organizations. The most puzzling piece isn’t the magnitude of in use cloud apps and services. Instead, its that, according to a Cloud Security Alliance study, most organization IT teams believe they have fewer than 50 cloud-based apps in use. That means that over 700 cloud apps and services on average are in use within enterprises – but no one (but the user) has control over those apps and services, and any corporate information shared with them! The problem is, you cannot defend what you don’t know about! Finally, the last piece of the “new norm” puzzle for organizations is the hybrid network, an eclectic mix of data center and cloud-based apps and data, with a stew of hosted private, public and cloud infrastructures. According to analyst Gartner, “while actual hybrid cloud computing deployments are rare, nearly three-fourths of large enterprises expect to have hybrid deployments by 2015.” Consider that a mobile workforce will drive infrastructure changes, needed to address a more diverse device ecosystem. Then consider that infrastructure addressing mobility requires greater investment in cloud-based apps and services to support that expanding device ecosystem. So, as you can see, the future of the network fabric for the foreseeable future will be hybrid. So, with a “new norm” of mobility, cloud, and hybrid networks, how can organizations address network, application, and data accessibility? With so many new devices that are mobile and are under limited corporate control, and applications and data scattered about the network and in various clouds and SaaS deployments, how can an enterprise be assured of fast, appropriate, authenticated and authorized access? With so many variables, there is one constant that remains: Identity. The user – and their identity – is, arguably, the “new perimeter” for the enterprise, today and onward. As the traditional network perimeter has been broken, fragmented, and in many instances shattered into many pieces, identity has become the new perimeter. As applications, data, and even networks move faster toward the cloud, and the user-controlled, BYOD-driven mobile ecosystem expands exponentially, corporate control has become more difficult, dispersed, and dependent on others – and many times, that’s the security uninformed and apathetic user. User identity, though, never changes. And, backed by authentication, authorization, and accounting (AAA), identity is now the first line of defense for secure corporate access. But, identity is just the tip of the spear for controlling the new parameters of access. The context of a user’s access request, and their environment at the time of access request, follow identity; inarguably, they have as much to do with securing appropriate access as identity. The ability to address the 5 w’s and 1 h (who, what, when, where, why, and how) assures, enhances, and differentiates secure access to networks, clouds, applications and data – wherever they may reside and however they are comprised. Insuring user identity is efficiently, securely shared between networks, clouds, applications, and data – wherever they live – is now a necessity. Yet, there are challenges: Identity silos, on-premise identity with cloud- and SaaS-based apps and data, and user password fatigue leading to weak user names and passwords – which are easily compromised. That’s where building an identity bridge comes in. Federation builds a trusted chain of user identity between two entities – networks, clouds, applications, etc. – through industry standards, such as SAML. The cumbersome duplication and insertion of identity directories becomes unnecessary. Identity and access is controlled by an enterprise, with authentication occurring between the enterprise, and cloud and SaaS providers. Instant user authentication and its termination is centralized and under enterprise control. Identity federation delivers access visibility and control together. Leveraging identity for access control, and building identity bridges are now imperative for organizations, as applications move outside the enterprise domain, the workforce and their devices are more mobile and leave the enterprises in droves, and the enterprise domain, too, has moved. It’s the “new norm”.
Did you know that F5 BIG-IP can help smartly scale BYOD policy services ?
Does your corporate IT like to smartly address secure device identity management for BYOD endpoints ? Does your enterprise like to deploy device policy management solutions that are highly scalable ? Then you are sure to benefit from what we have to offer. It is a no brainer that the trends of Mobility and workload migrations to Cloud are an added impetus for increased profiling, monitoring and administrative traffic pertaining to devices connecting to the Network. This applies not just at a corporate headquarters site but also at geographically distributed sites, large Branches and Provider-hosted facilities, which get the services delivered out of the provider data center housing identity management solutions. F5 LTM can now be deployed with Cisco Identity Service Engine (ISE), which is a market leading Network access security policy management platform, to load balance identity services traffic What scenarios need load balancing of Cisco ISE traffic ? As we look at ways to provision thousands of BYOD endpoints, ISE devices need to be clustered so the policy service nodes (which offer run time network device services such as posturing, profiling, guest web services, AAA) can effectively address up to about 250,000 endpoints. Identity management is much more than basic RADIUS authentication and includes device profiling, endpoint posturing, administrative activities, monitoring, troubleshooting and data logging. Once basic authentication is complete, these devices - which could be static such as in the case of a video IP surveillance camera or mobile such as in the case of an employee owned smart tablet – need to be continuously postured, policy administered and monitored. The policy service node in the ISE persona handles run time traffic, which increases as the number of endpoints handled increases. How does F5 LTM specifically help ? As you cluster the ISE devices, traffic needs to be load-balanced and in cases such as device profiling, flow persistence with the same policy service node needs to be ensured. The F5 BIG-IP LTM enables load-balancing for the ISE policy node clusters and helps with health monitoring of the same ISE servers. Most importantly, customizable F5 iRules can be created to handle ‘persistence traffic’ differently and ‘Persistence profiles’ can be applied across Virtual servers. What benefits can this Solution provide ? Customers deploying the F5 LTM and Cisco ISE solution can • Significantly improve performance, scalability and availability for secure corporate LAN access traffic (ISE RADIUS, Profiling, and Web Service) • Optimize corporate LAN authentication, profiling, and database replication traffic by ensuring stickiness with same node in the ISE cluster that services requests • Enable Health monitoring and High availability of ISE servers using F5 load balancer probes • Simplify configuration for network devices and facilitate addition, changes and removals of the same for centralized servers Solution demo at Cisco Live Milan Stopby the F5 Networks booth (stand P2) at Cisco Live Milan 2015 to chat with technical experts and see a demonstration of the solution and its benefits. To Learn Further Please visit www.cisco.com/go/ise for more on Cisco ISE and https://f5.com/products/modules/local-traffic-manager for F5 BIG-IP LTM.
Saudi Cybersecurity Threat Landscape “More Intense and Complex Than Ever”
Leading Saudi IT decision-makers agree that cybersecurity threats are growing in intensity and scale across the Kingdom. The situation is putting businesses at risk of hits to both reputation and bottom line. A new survey commissioned by F5 Networks found that nearly seven in ten of surveyed businesses (68%) regarded cybercrime as a “severe” threat. 75% of respondents said that their business’ sales and marketing efforts would suffer most from an attack. Worryingly, only 15% are confident their organisation has consistent IT security measures across its entire IT network. 84% claimed that it has become harder in the past three years to maintain a consistent security posture. This is partly due to the rise of cloud, off-premise IT and trends such as Bring Your Own Device (BYOD). 58% of respondents described the degree to which fear of cybersecurity threats had increased in the past two years as “tremendous” or “very strong”, whereas 66% reported that it is more difficult than ever to protect their organisation against cybersecurity threats. Common cybersecurity threats include distributed denial of service (DDoS) attacks, phishing/spear-phishing emails, data theft, “zero-day” software assaults, web application exploits, and website defacement. “Traditional security methods such as next generation firewalls and other reactive measures are losing the fight against a new breed of attacks,” said Mamduh Allam, Saudi Arabia Country Manager, F5 Networks. “Security is now very much about the protection of the application, enforcement of encryption the protection of user identity, and less about the supporting network infrastructure. Organisations need a security strategy that is flexible and comprehensive, with the ability to combine Domain Name System (DNS) security, DDoS protection, network firewalls, access management, and application security with intelligent traffic management.” The Kingdom’s burgeoning cyber security market size is indicative of the new cybersecurity threat landscape. According to MicroMarket Monitor, the market is expected to grow from US$1.51 billion in 2013 to US$3.48 billion in 2019 at a CAGR of 14.50% for the period 2013 to 2019. For the wider region, MarketsandMarkets suggests that the Middle East cybersecurity market is on course to grow from US$5.17 billion in 2014 to US$9.56 billion in 2019 at a CAGR of 13.07%. In its 2014 Global Economic Crime Survey, PrincewaterhouseCooper identified cybercrime as the second most common form of economic crime reported in the Middle East. The top cybersecurity challenges listed in F5 Networks’s survey include the complexity of managing a variety of security tools (50%), the shift from data-centre focused infrastructure to the cloud (48%), desktop and server virtualisation (42%), BYOD (40%), the growing desirability and flexibility of web-based applications (33%) and the increasing complexity of threats (32%).As a result, 61% called for greater consolidation of security tool management. 61% also wanted to see a stronger focus on security from management. When asked about desired coping solutions, the decision-makers’ wish-lists included improved tracking and tougher actions on cybercriminals by authorities (54%), better understanding of the wide variety of live security threats (43%) and more context-awareness for devices accessing networks (28%). “With multi-dimensional or 'cocktail' style attacks - DDoS attacks combined with application layer attacks and Structured Query Language (SQL) vulnerabilities –organisations really need to look at a multi-stack security approach, combined with a process to handle internal control,” said Allam.The Digital Dress Code
Coming to an office near you. If you thought the Bring Your Own Device (BYOD) craze was a headache, just wait until button cameras, smart watches, and spy glasses (already here) are a daily occurrence in the office. Workplace #wearables will be a huge challenge in the coming years as more devices, clothing and pretty much any 'thing' with a chip or sensor become commonplace in our society. The device explosion with IoT (Internet of Things) will be much larger than any of these mobile phones we carry around. A couple new reports examine the impact of IoT on businesses. PricewaterhouseCoopers (PwC) released a report on wearable technology after surveying 1,000 consumers, 314 of which use some form of wearable, as part of "The Wearable Future" report. Some key findings included that 77% of respondents thought that a top benefit of wearable technology is the potential to make employees more productive and efficient. Honestly, when I read that I immediately thought of my boss's hologram standing behind me in my home office watching my work. 70% expect that their office should allow the use of wearables...probably the same folks who wanted to bring their own tablet and 46% felt that organizations should fund wearables rather than the dreaded BYOD. The idea is that if the technology is simple to use and integrates with other devices, that should boost productivity and lift profits. Even so, there needs to be significant investment to ensure the camera shirt buttons can talk to Exchange, ya know. The biggest concerns, according to PwC, include the risk of security breaches, invasion of privacy, tech dependence, having too many devices and on a more human level, not being able to relate to others or simply looking silly with all those attachments. PwC also looked at the industries that will capitalize on the wearable market. Entertainment will be more 'immersive and fun'; Social Media gets more real time updates from your clothes; Gaming can be more visually and physically engaging; Advertisers will want the space on your back; Healthcare will track your vitals; and Retail could offer “pleasant, efficient” shopping experiences. Business Insider recently released a report looking at the device growth They feel that by 2019, IoT devices will more than double the size of the smartphone, tablet, PC, wearable and connected car combined. That's huge. All the software, hardware, maintenance and management of IoT could add $1.7 trillion to the global economy by 2019. They also feel that the main benefit of IoT will be the efficiencies and cost savings by giving the user more control. But, there are sill few standards and even less compatibility so that needs work, not to mention the security risks inherent in these nouns. The processing power, storage, cameras, sensors and everything else will far surpass the USB-stick risks of years past, plus the potential of all this corporate data getting stored in personal clouds could spell big trouble. And how are all these nouns going to found on the internet? DNS of course! Once all these various wearables hit the office, DNS will be the thing that allows us people to find them threads. I truly feel that DNS will be one of the most strained technologies as more connections happen in the office and will be discussing this trend at the ThingsExpo - which is part of SYS-CON Media's CloudExpo in Santa Clara this week. ps Related: Employees Excited, Concerned About Wearables in the Workplace Medical Devices: Safeguarding the Healthcare Revolution How Smart, Connected Products Are Transforming Competition The 'Internet of Things' Will Be The World's Most Massive Device Market And Save Companies Billions Of Dollars As Wearables Get Hot, These 6 Industries Are Poised to Capitalize Why the Internet of Things will turn data computing on its head My Sensored Family The Internet of...(Drum Roll Please)...Band-Aids?!? The Breach of Things Technorati Tags: iot,things,wearables,workplace,sensors,silva,devices,byod,smart,f5,big data,privacy Connect with Peter: Connect with F5:CloudFucius Wonders: Can Cloud, Confidentiality and The Constitution Coexist?
This question has been puzzling a few folks of late, not just CloudFucius. The Judicial/legal side of the internet seems to have gotten some attention lately even though courts have been trying to make sense and catch up with technology for some time, probably since the Electronic Communications Privacy Act of 1986. There are many issues involved here but a couple stand out for CloudFucius. First, there is the ‘Privacy vs. Convenience’ dilemma. Many love and often need the GPS Navigators whether it be a permanent unit in the vehicle or right from our handheld device to get where we need to go. These services are most beneficial when searching for a destination but it is also a ‘tracking bug’ in that, it records every movement we make. This has certainly been beneficial in many industries like trucking, delivery, automotive, retail and many others, even with some legal issues. It has helped locate people during emergencies and disasters. It has also helped in geo-tagging photographs. But, we do give up a lot of privacy, secrecy and confidentiality when using many of the technologies designed to make our lives ‘easier.’ Americans have a rather tortured relationship with privacy. They often say one thing ("Privacy is important to me") but do another ("Sure, thanks for the coupon, here's my Social Security Number") noted Lee Rainie, head of the Pew Internet and American Life Project. From: The Constitutional issues of cloud computing You might not want anyone knowing where you are going but by simply using a navigation system to get to your undisclosed location, someone can track you down. Often, you don’t even need to be in navigation mode to be tracked – just having GPS enabled can leave breadcrumbs. Don’t forget, even the most miniscule trips to the gas station can still contain valuable data….to someone. How do you know if your milk runs to the 7-Eleven aren’t being gathered and analyzed? At the same, where is that data stored, who has access and how is it being used? I use GPS when I need it and I’m not suggesting dumping it, just wondering. Found a story where Mobile Coupons are being offered to your phone. Depending on your GPS location, they can send you a coupon for a nearby merchant along with this one about Location-Based strategies. Second, is the Fourth Amendment in the digital age. In the United States, the 4th Amendment protects against unreasonable searches and seizures. Law enforcement needs to convince a judge that a serious crime has/is occurring to obtain a warrant prior to taking evidence from a physical location, like your home. It focuses on physical possessions and space. For instance, if you are committing crimes, you can place your devious plans in a safe hidden in your bedroom and law enforcement needs to present a search warrant before searching your home for such documents. But what happens if you decide to store your ‘Get rich quick scheme’ planning document in the cloud? Are you still protected? Can you expect certain procedures to be followed before that document is accessed? The Computer Crime & Intellectual Property Section of the US Dept of Justice site states: To determine whether an individual has a reasonable expectation of privacy in information stored in a computer, it helps to treat the computer like a closed container such as a briefcase or file cabinet. The Fourth Amendment generally prohibits law enforcement from accessing and viewing information stored in a computer if it would be prohibited from opening a closed container and examining its contents in the same situation….Although courts have generally agreed that electronic storage devices can be analogized to closed containers, they have reached differing conclusions about whether a computer or other storage device should be classified as a single closed container or whether each individual file stored within a computer or storage device should be treated as a separate closed container. But, you might lose that Fourth Amendment right when you give control to a third party, such as a cloud provider. Imagine you wrote a play about terrorism and used a cloud service to store your document. Maybe there were some ‘surveillance’ keywords or triggers used as character lines. Maybe there is scene at a transportation hub (train, airport, etc) and characters themselves say things that could be taken as domestic threats – out of context of course. You should have some expectation that your literary work is kept just as safe/secure while in the cloud as it is on your powered down hard drive or stack of papers on your desk. And we haven’t even touched on compliance, records retention, computer forensics, data recovery and many other litigating issues. The cases continue to play out and this blog entry only covers a couple of the challenges associated with Cloud Computing and the Law, but CloudFucius will keep an eye on it for ya. Many of the articles found while researching this topic: The Constitutional issues of cloud computing In digital world, we trade privacy for convenience Cloud Computing and the Constitution INTERNET LAW - Search and Seizure of Home Computers in Virginia Time to play catch-up on Internet laws: The gap between technology and America's laws hit home last week in a court decision on network neutrality FCC considers reclassification of Internet in push to regulate it Personal texting on a work phone? Beware your boss High Court Justices Consider Privacy Issues in Text Messaging Case Yahoo wins email battle with US Government How Twitter’s grant to the Library of Congress could be copyright-okay Judge Orders Google To Deactivate User's Gmail Account FBI Warrant Sought Google Apps Content in Spam Case State court rules company shouldn't have read ex-staffer's private e-mails District Took 56,000 Pictures From Laptops Can the Cloud survive regulation? Group challenging enhanced surveillance law faces uphill climb Watchdogs join 'Net heavyweights in call for privacy law reform Digital Due Process Judge's judgment called into question Dept of Justice Electronic Evidence and Search & Seizure Legal Resources Electronic Evidence Case Digest Electronic Evidence Finally, you might be wondering why CloudFucius went from A to C in his series. Well, this time we decided to jump around but still cover 26 interesting topics. And one from Confucius himself: I am not one who was born in the possession of knowledge; I am one who is fond of antiquity, and earnest in seeking it there. ps The CloudFucius Series: Intro, 1
Why F5 Synthesis realizes 'Leave no Application Behind'.
The proliferation of Bring Your Own Device (BYOD) or the ability to respond to spurs in Internet or Web traffic is driving a shift in end-user expectations and business demands. According to Frost and Sullivan, the number of connected devices that are encompassed within the Internet of Things will be close to 80 billion by 2020 globally. The number of applications delivered within an enterprise is anywhere up to 1,000 according to Morgan Stanley. The increasing number of applications infiltrating the enterprise will in turn have security implications for businesses, both from a data and device perspective. In particular, we are also witnessing the evolution of a new era of cybercriminals who are becoming increasingly sophisticated and targeted in their approach through distributed denial-of-service (DDoS) attacks, network, and more recently around application layer attacks. This paradigm shift we are witnessing across the IT landscape is dramatically changing the way data centers are delivering applications to any device. This is driven largely by the disintegration of the network perimeter with cloud, mobility and security quickly becoming the norm. The challenge for businesses is to ensure they can deliver applications from anywhere, to anyone, at any time. Especially as people and global organizations increasingly rely on the Internet and web-enabled devices, which inevitably spurs innovation and an ever increasing volume of data traffic. In response we are seeing a wave of software-defined technology emerge, for example Software Defined Networking (SDN), stemming from a need for greater operational efficiency and management simplicity. This has been attracting a lot of attention from IT teams, especially as networking technologies are becoming a real bottleneck today. For example, with pressures such as frequent changes and expansion of infrastructure, and rapid deployment of new services, changes in networking take the longest to be completed, hence the bottleneck. Through software-defined technology, this issue can be resolved. Now you can see why everybody is excited with SDN! Although, there is a critical element missing to this equation – the application layers, also known as L4-L7. In an apps world, it is essential that the performance of delivery and the security of applications in the enterprise is optimized at all times to help organizations seamlessly overcome the challenges outlined above. F5 has taken this a step further by taking the same principles applied to SDN (which primarily addresses Layers 2-3 in the network),and deploying them to the application layers (Layers 4-7), providing Software Defined Application Services™ (SDAS). These are services deployed in the network between the end-user and the application to ensure apps, networking, and application services come together and provide application owners with the ability to address application mobility, security, access and identity, performance and availability challenges architecturally. The magic of SDAS lies in the fabric, which can be deployed on a combination of hardware, software, and virtual form factors, as well as beyond the data center boundary into cloud environments. This allows the elasticity and operational consistency needed to scale and manage services in any environment. Each service can gather a breadth and depth of information about the user, the application, and the network in real-time. With such scalability, enterprises no longer need to choose which applications to be optimized, accelerated or protected over others. In summary, no application will be left behind!
