Security and Risk Management Strategies Blog

Consumerization's Impact on IT : Risk of Vendor Lockin

Analyst Blogger: Trent Henry

Consumerization. It's an emerging IT trend that we're watching with great interest. Although it may not be consistently defined, at the very least consumerization is a blend of user-owned devices deployed in the enterprise (think iPhone) and IT departments handing out stipends for users to purchase their own work-related gear. The idea--no surprise--is to reduce cost and lower overhead. This has been going on for several years, but the newest crop of handheld devices and moves from the likes of Citrix (see "Citrix Tries BYOC") have energized discussion.

Last week I read the article, "Assembling the Android army: a sticky platform", and it made me realize there's an aspect of consumerization I haven't heard people discuss: vendor lock-in. When dealing with Burton Group's enterprise clients, we talk until blue in the face about reducing switching costs, rejecting proprietary protocols, using standards where possible, and so forth. However, consumer-facing technologies try their best to be sticky: keep consumers working on their platforms, applications, and environments; they generally make it as difficult as possible to change.

My colleague Jack Santos argues that lock-in and stickiness aren't quite the same thing, and I agree with him. Lock-in means there are clear economic consequences: penalties for switching, extra unexpected expenditures to get the same feature, etc. Stickiness means just that--a sticky affinity to the platform or software that captures your imagination. Similar functionality may even be delivered on another platform for free, but where a user first uses a compelling feature wins the day because there is not a sufficiently compelling reason to switch (even if there is no cost in doing so).

Whether it's stickiness or lock-in, however, consumer devices pose new challenges for enterprises, including difficulty in moving users from a problematic platform (for whatever reason) onto another one. Whatever the advantages of consumerization, this is a detractor that organizations need to keep front-of-mind.

As security practitioners, the last thing we want is for users to cling rigidly to software, devices, or environments that are known to be risky. If one day Microsoft makes an Xbox with a terminal services client, I don't necessarily want users to spend their corporate stipend on that device for corporate email access. But this is a potential logical conclusion for consumerization and the stickiness of platforms and user experience. Time to start writing some user device acceptance policies I do believe....

The New IT Reality, Security and the Role of Vendors

Bloggers this week: Eric Maiwald, Phil Schacter, Dan Blum, Trent Henry, Ramon Krikken

This week’s blog post features another discussion between Burton Group security analysts on the new IT reality and how this impacts security.

Eric kicked off the discussion with this thought-provoking list of questions for the team to consider.

 One question we have not asked is “who (which vendor) is best positioned to help our clients in the new IT reality?” The new reality I’m speaking of includes cloud computing, virtualization, consumerization of IT, etc. We know that things are changing and we also are guessing that the economy will accelerate some of the technology changes. We have themes that talk about security organization and about technology (ie. security for data in transit, data stored on mobile devices, and data that is transiently resident in virtualized and cloud-hosted IT infrastructures) but which of the many security vendors (or non-security vendors) is best positioned to help deal with this? And just as important – what makes that vendor or those vendors best positioned? Is it technology? Integration of technology? Services? Services and technology? Size? Stability? What about reach into non-security areas of IT?

I (Phil) piped up with the following comment. Even figuring out what attributes to look for in a cloud vendor, or the related discussion of what terms to look for in the SLA from your favorite cloud vendor will be new and somewhat controversial ground to consider. I recall a few years ago when Microsoft tried to offer Passport as an identity solution for the cloud, and of course it failed – perhaps because of the issue of placing trust in any vendor, especially a vendor that’s always been aggressive in the market, such as Microsoft.

Next, Dan entered the fray with an examination of IT’s shifting reality, and offering a series of insights on how we might measure vendors and their capabilities to help organizations deal with their IT challenges.

Is there a new IT reality? We’ve had clouds and ASPs and SLAs and revolutions against IT and downturns before. However, virtualization is more disruptive than anything I’ve seen since the web and WiFi which are still disrupting, and web services/SOA seems to at least moderately disruptive. Reality is always in the process of reinventing itself but perhaps we do have a bit more of a new reality in IT than usual. I’ll grant you that.

Ok, so you wish to assess which vendors will thrive (and enable customers to thrive) on this new IT reality? It occurs to me that the discussion of the vendors is premature, since we had not defined the yardsticks by which to assess them.

The yardstick might include measures of financial, organizational, market and technological strength for the vendors. In terms of technological strength the vendor must enable customers to provide:

• Web-centric computing
• User centric experiences
• Mobile computing
• Resource dynamism, and
• Fine grained understanding and control of information

These are all things we could attempt to measure. And yet…the ticklish distinction between being some kind of IT vendor versus some kind security vendor (or both), the fact that customers are so different and have thousands of alternatives for how to protect their IT environments, and the long tail phenomena that keeps the market in a structural state of permanent disruption all suggest to me that it may be a futile exercise to try and assess the big vendors in security at this level of abstraction.

Trent was the next analyst to join the discussion.

When you used the word “disruptive,” Dan, it got me thinking. We could have an entire discussion on that alone. My own thought is that the introduction of the personal computer was the most disruptive thing I ever saw—a move from centralized to distributed computing paradigms. Ironically, virtualization plays a role in returning us to centralization once again.

Which vendors actually introduce disruptive technologies or “new ways to work?” It’s never the security vendors, IMHO. Often, technology vendors simply respond to innovation or changing business requirements in customer environments. And security vendors tend to follow even a step (or two, three) behind them. But elements of consumerization, cloud computing, new-fangled collaboration, etc are spearheaded by vendors on occasion. With investments in R&D labs to conduct fundamental research, Google, IBM, Microsoft, and others are not merely reacting to new trends but are creating the vision (and tools) to realize the future. How does this figure into an evaluation equation? (And what does it mean when former research heavies like DEC  or Xerox—whose PARC has been greatly minimized—are no longer as important?)

Ultimately, this discussion has to rise above just security unless we narrow the question to “How are vendors going to successfully help organizations protect information and infrastructure?” But ultimately, that’s just one piece of the larger, “How can IT enable business?” question.

As often seems to happen lately, the last word fell to Ramon.

I’m also inclined to think that the PC was most disruptive from a security perspective. While we used to have a centralized system with a few terminals and printers, the number of inputs and outputs, as well as the complexity and unpredictability of the environment greatly increased with large-scale adoption of distributed computing. And although many of the basic virtualization concepts really don’t differ much from how it was implemented on the mainframe, coupling it with distributed computing complicates things: yes, it does allow a certain amount of centralization on hardware, but increased mobility capabilities through connectivity and hardware in all forms will mean that from a risk perspective this will likely show up as a more decentralized, complex, and unpredictable environment (SaaS, cloud, mobile devices, etc.) It is a potential second wave of disruption to security, but this is one where we’re (security) actually involved in trying to shape the wave.

If vendors only respond to customer demand, then it makes sense that security vendors are at least second in line. After all, few security controls are used as a direct business tool. The exceptions are those systems used by security teams, who are in the business of providing security services (and so this is where, for example, innovation can happen in the ‘GRC’ market or in something like SIEM.) In most other cases I can think of, security controls are a constraint on ‘regular’ business processes, and security vendors will naturally have to respond to what their customers (the makers of the business tools) need.

The unpredictability of the future environment makes it incredibly difficult to assess which fundamental security technologies will work. What seems most difficult at this point is that we have a number of emerging concepts such as consumerization, the cloud, ubiquitous connectivity, and persistent storage, but we have no clue on how, for whom, and to what extent these are going to take off. All of these impact the level of control one has over the environment. The amount of control determines the ease of implementing the trusted path, and the trusted path determines on how well you can implement use control.

On the nature of perimeters and shifting defenses to endpoints and data

Analysts contributing to this blog post: Dan Blum, Eric Maiwald, and Phil Schacter

A recent TechTarget article prompted a discussion within the Burton Group security analyst team that we wanted to share with our blog readers. The discussion centers around the notion that network perimeters are losing their effectiveness as a primary enterprise defense mechanism, and this trend focuses more attention on securing desktop and other mobile devices that access protected IT assets.

Eric responded to the article with this statement:

The shifting of focus to the desktop security defense runs counter to the “consumerization of IT” trend that includes a strategy of allowing employees to bring their own computer to work. If we don't own the end point device, how do we enforce software/application/configuration controls on them? If we don't own the end point, I think that virtual desktop infrastructure (VDI) and information-based controls will have to be used and the perimeter shrinks even more (down to the data).

Continuing the thread and adding his experiences to the discussion, Dan added:

I wrote about the perimeter shrinking down to data 9 years ago in the first version of Burton Group’s “Securing the Virtual Enterprise” report. Then it was prognosticating on one possible and somewhat distant future -- now it is just incredibly hard. The recent partnership between Microsoft and EMC/RSA, is one of the first inroads into making this practical on a large scale. EMC/RSA will provide the data discovery and policy management; Microsoft will provide the policy enforcement point - just enterprise DRM at this point. Many more PEPs and actions are needed, and they've skirted around interoperability by not working the standards angle on a policy language (when I asked them about policy language and classification metadata standards they fell back on the self-serving and debatable proposition that the security market is consolidating).

On a related subject, I had an interesting discussion with one of Burton Group’s customers yesterday. This customer is among the vanguard on expanding the scope of unified endpoint security. Whereas I forecast a unified endpoint anti-malware suite in 2006, I underestimated the speed at which unified endpoint protection would come to embody not only comprehensive anti-malware and NAC but also device control, drive encryption, and DLP. These are the requirements that will be in this customer’s forthcoming RFP. One of the key features on this customer’s wish list is a single management console that integrates all of the endpoint’s defense mechanisms. The customer recognizes that current integration is spotty and functionality is immature, but wants to put the RFP out there, see how far they can push the envelope, see how the vendors stack up, and what tradeoffs they should make.

I pointed out that tradeoffs - such as do you pick McAfee for its endpoint DLP integration or Symantec for its dis-integrated but market leading Vontu DLP - would be best informed by a security architecture and migration strategy that put some stakes in the ground.

I also pointed out there are some limitations - even with all the heavy desktop security there will still be leaks; for example, Cisco's endpoint DLP searches for strings like credit cards but a malicious advisor will soon learn to hide the telltales once he understands DLP is resident. The customer is planning a very heavy dose of endpoint protection that will be low surety and expensive to maintain, whereas a locked down desktop plus VPN backhaul will buy you more protection than all the third party add-ons in the world.

The customer agreed, and said they could lockdown and backhaul the corporate desktop, but that half of their desktops belong to "independent contractors." These contractors own their desktop, have admin rights, and are only contractually required to put the customer’s endpoint security software on the desktop. They can't lockdown or backhaul these desktops; network protections won't cover them on the road.

I noted they might benefit from an information-centric security strategy, which should include corralling the data in centrally controlled repositories through the use of terminal services and applications that handle it remotely. Then the DLP, device control, and encryption mechanisms become less critical although protection against keyloggers and screen capture is still important.

What if the user is offline, the customer countered? I pointed out that for a three year architecture plan it may now be more reasonable to assume users are almost-always-connected. Did you see the commercial where AT&T "found the Internet" in the Himalayas (land of the abominable snowman?)

The customer agreed that users might be almost-always-connected, but pointed out that their independent advisors own their contact lists and if they want to have them on their endpoints then this is permitted within their contract. Since salesmen cling to their contact lists like NRA diehards to their guns, they aren't likely to give up control over this data. All that the customer can do is try to restrict them to only their own data and help them not do anything stupid with it.

We didn't actually get to discussing VDI, which you mentioned. Sometimes I've brought that up on other calls, but only to say that I'm not yet sure its ready for prime time - the surety, compatibility, reliability, and performance of the user experience are uncertain but what is certain is the requirement for lots of expensive servers and storage back in the data center where organizations must still maintain a real perimeter.

Bottom line - perimeter around the data is low surety, high cost and fraught with problems. The customer should be able to apply a calibrated set of information-centric, locked down desktop, network, heavy endpoint security controls so as to optimize the defense in depth that's necessary for different situations and make a more informed procurement tradeoff.

And at that point the discussion ended with Dan getting in the last word, although I’m sure that the team will continue to delve into the issues raised in our research and writing in the coming months and years.

iPhone and iTunes: The Thin Edge of Consumerization’s Wedge

Blogger: Dan Blum

You may have thought iTunes was just a music program for Macs, Windows, and iPhone systems but lately we’re hearing questions about whether iTunes is required on enterprise desktops. Behind this interest is Apple’s use of iTunes on the desktop to deliver updates to the popular iPhone. With iPhone now connecting to organizational mail systems such as Microsoft Exchange, iTunes has come to have a business purpose.

Absent the iPhone update requirement, organizations would probably want to discourage iTunes deployment on business systems and networks for the following reasons:

1) iTunes expands workstation attack surfaces
    a. The program has 13 vulnerabilities listed on the National Vulnerability Database dating from 2005 and 2008; that versions before 6.0.5.20 did not verify authenticity of updates raises particular concerns about whether security was even considered in the program’s original design
    b. The Bonjour service advertisement protocol that iTunes uses could also be used by a compromised system as an attack vector against other LAN-connected systems
2) Malware could be introduced through iTunes, especially on Windows systems
3) iTunes may be used to facilitate copyright violations by sharing unlicensed music or content over LANs, raising liability issues for the organization
4) iTunes is not an enterprise product – it has no enterprise management features that might, for example, be used to disable every function that was not business relevant (potentially everything except for iPhone update); thus organizations are stuck with the whole ball of wax if they allow iTunes to be deployed

Considering the requirement to support iPhone – a useful device that may be extremely popular for large elements of the organization’s workforce – organizations have the following alternatives.

1) Put iTunes on the organization’s standard desktop and (as with everything else) try to mitigate the risk through third party patch management, anti-malware,  intrusion prevention, and other security products
2) Allow individual workers to put iTunes on the organization-owned computers that have been issued to them, and provide users with general education on basic endpoint security concepts such as patching systems, not working in the admin account on a daily basis, and maintaining anti-malware software
3) Ban iTunes but allow end users to update their iPhone from the iTunes on their home computers, or not update their iPhone
4) Ban iTunes and de-authorize iPhone for the organization’s data communications because it cannot be properly updated

iPhone and iTunes - the thin edge of a consumerization wedge - may be just one of the first consumer applications forced on the enterprise. iPhone and other mobile devices are providing a platform for social networking and other chatty applications. And with Apple’s Application Store bursting at the seams, there is more to mobile system update than meets the eye.

Regardless of the choice you make on iTunes today, it is a good idea to push Apple and other vendors to furnish simple, locked down enterprise management utilities to update organization-approved smart phones and the applications that run on them. Engage in a conversation about how we get out in front of consumerization with other organizations in your industry as well as with the vendors. There should be plenty of opportunities for vendors to grow their market share, improve protection, and provide for basic security management needs when their technologies come into business use.

Security on the Move

Blogger: Eric Maiwald

We are in a time of rapid change – of course this is not news to anyone working in IT. Virtualized environments, cloud computing, software as a service, and mobile workers have changed much of what was normal in the world of IT. If these things haven’t reached you yet, they will soon as the economic downturn forces executives to look for ways to cut costs.

There is one thing that all of these technologies and trends have in common – information or data is moving. Our information is no longer safely locked away in a database on a huge mainframe in a physically secure data center some place. Instead, the information is moving from server to server, data center to data center, and vendor to vendor. Even our own employees are moving information all over the place as they extract information into spreadsheets and store it on local hard drives, USB sticks, and handheld devices. All this mobility is enough to give a security guy the shakes.

Let’s take a quick look at the major new technologies and trends and see what can help:

Virtualization
Virtualization means that applications can be placed on different physical hardware so as to utilize the hardware more efficiently. Specific applications will not live on specific servers any longer. Moving applications around will impact network zoning and other static controls. We can look for security tools that live within the virtual environments but they are only beginning to appear. An alternative is to package some controls with the application (make them a part of the virtual environment that moves with the application). Controls such as host intrusion prevention might help here. Process and procedures may also help. Define risk levels or control requirements for each application and use that criterion as the basis for determining which physical machines are appropriate for different applications.

Cloud Computing
Cloud computing encompasses a lot of things including hosting services and SaaS (I’ll deal with SaaS in a moment). If servers and applications are hosted at someone else’s data center you may not be able to install all of the network controls that you have at your own data center. So here again, moving the controls into the server (or virtual machine or the part of the application that you control) may alleviate some of the problems. Take for example, web application firewalls (WAFs) – you may not be able to deploy a WAF in front of your servers at a hosting facility. If you need the WAF functions, you might look for vendors offering software solutions that load on to the server rather than residing in a separate appliance. Contracts and SLAs are also important if your enterprise is considering hosting facilities. Make sure you check on what they are really providing and work with your legal department to include the necessary language in your contracts.

Software as a Service
SaaS is sometimes considered part of cloud computing but I wanted to call it out separately as there are some unique aspects to SaaS. The biggest issue is that you will lose all management over technical controls. You will not be in charge of firewalls, IDS/IPS, web filtering, or any other security device on the vendor’s network. At the same time, all of your data will be under the control of the vendor and its employees. So what can you do? There are three big things that can be done. First, before the vendor is chosen and the contract is signed, check out the vendor. Look to see what controls are in place and what control standards the vendor is using. Verify that the controls you’re using are appropriate to protect your data. Second, have a long talk with your legal department and make them aware of the necessary protections and the risks of a breach. See if they can negotiate with the vendor regarding the right to audit the vendor. Third, once the contract is signed, do the follow up. Audit the vendor periodically. Check on what they’re doing to make sure your information is protected.

Mobile Workers
Employees are working on the road, from home, and from coffee shops. Information is stored on laptops, USB sticks, and handheld computers. You may not even know where the information is actually going as employees may put it on their home machines or personal smartphones. Any of these devices can be lost, stolen, or just given away. For computers and devices that are owned by the enterprise, use proper protection. That means use a VPN, system firewall, and malicious software controls. Try to manage the systems properly so that they are patched and that unnecessary applications are limited. For some devices, you can install a remote erase function that will remove all data if the device or computer does not check in for a certain amount of time (note that this works better on handhelds than on laptops). You can also use encrypting USB sticks that require a password to access the data on the stick (hey even a short password is better than nothing!). If your employees are going to use non-enterprise devices you can set up terminal servers so they can access their desktops (and sensitive information) without having to store too much on the local machine. This also gives you some control over what can be copied to the local machine. When you have employees that need information on non-enterprise machines that will not have reliable network connectivity, you may need to apply controls to the information itself in the form of enterprise rights management.

That was a very quick look at some of the major trends in today’s IT. All of the controls I mentioned need to be considered in the context of the larger IT environment. In other words, do your tradeoffs and identify the risks that you can accept and those that you cannot. Try to mitigate the risks that you can’t accept. Talk to the business. Talk to the other parts of IT as some of the suggestions that I made will have big impacts on networks and servers. You can’t turn back the tide but you can work with it.