Secure DevOps Before DevSecOps
Technical
October – Art Poghosyan
Privileged access has been one of the most complex issues organizations have had to address. Breaches of privileged access can have profound impact on IT infrastructure, expose large volumes of confidential data and cause devastating consequences for the business. The rapid evolution of the public cloud technologies in the past few years has introduced even more complexity and has challenged the existing methods and tools for securing privileged access. As a result, we are witnessing an exponential increase in cloud access breaches that leave terabytes of confidential data exposed and cost businesses billions of dollars every year.
In this talk, we will review key examples of how the growing public cloud ecosystems have re-defined privileged access security requirements which, in turn, created the need for new and innovative approaches to securing privileged access. We will also review the best practices for cloud privileged access governance that are already emerging and are being adopted by the industry leading organizations. We will conclude with recommendations for security professionals to help identify their cloud privileged access exposures and define a methodical approach for addressing this critical risk in their environments.
Speaker: Art Poghosyan
Art has spent nearly two decades of his professional career in Information Security. The first 8 years of his career Art spent at Big 4 firms, serving global enterprises across many industries. In 2010, Art co-founded Advancive, a market leading brand for Identity & Access Management (IAM) consulting and solutions implementation. Art led the company’s exponential growth and eventual acquisition by Optiv Security in 2016. At Optiv, Art built and launched Optiv’s first managed IAM service offering focused on Privileged Access Management (PAM). In 2018, Art left Optiv to start his next business venture, Britive, where he is serving as the CEO. Art is a frequent industry contributor, recognized for sponsorships and speaking engagements at events such as Identiverse, RSA Charge, ISSA LA Summit, and ISACA Orange County conference. He is a regular volunteer and contributor at (ISC)2 CISSP and ISSAP certification exam development workshops.
July – Gary Asplund
Topic: My CEO Told Me We Have To Move Our Datacenter to the Public Cloud…So, What’s the Big Deal?
Abstract:
Consider the following:
– You don’t own any of it but, it is your responsibility to control and secure everything in it
– You don’t own any of it, but you critically depend on what’s in it
– You don’t maintain any of it, but you trust all of it is properly maintained at all times
– You can’t touch any of it, but it’s up to you to completely orchestrate, control and secure what’s in it
– You can’t physically walk in anywhere but you (and anyone else on the planet with the right access) can virtually access from everywhere
At first blush, a seasoned and experienced network / security director may not fully appreciate the significant differences and challenges his/her staff will experience in trying to fulfill their job duties when their datacenter is in the public cloud. The old strategy of ‘lift and shift’ – creating VM’s of all of your current/existing hardware and ‘shifting’ it to the cloud – will fail. Further evidence of the urgent need for purpose-built tools to secure public cloud infrastructures can be seen in the multiple and repeated data leaks and misconfiguration compromises we have seen in the last year – According to Gartner, “Through 2022, at least 95% of cloud security failures will be the customer’s fault.”
And in a world which is rapidly becoming completely ‘software defined’ new skills and tools are required.
In this session, we will discuss why today’s IT organizations require mature and complete native tools – built in the cloud for the cloud – which provide:
– Complete visibility
– Configuration management – Identity protection
– Secure DevOps
– Compliance Automation
– Governance Enforcement
– Environment Lockdown
We will discuss the subtle yet profound differences in operating your datacenter in the public cloud vs operating your own datacenter. We will discuss the ’Shared Responsibility Model’ and what it really means to you and your IT department as you expand the number of workloads you move to the public cloud. And, as your sophistication increases, and you expand your use of PaaS and IaaS, the complexities follow in tandem. We will show how today’s IT organizations require new, purpose-built tools designed and capable of ’speaking the same language’ as the public cloud infrastructures and built to leverage the extensive API’s they provide.