Skip navigation
CA, Inc.
TwitterLinkedInShare Smart Enterprise
Home Business Technology Innovation Business Technology Strategy Business Technology Execution Professional Development Smart Groups Smart Enterprise Magazine


5 Posts tagged with the mobility tag

Advocates and adversaries of cloud computing have long debated if the environment can provide adequate or in some cases exceptional security for enterprise IT, data and assets.


Of course, cloud environments vary among private, public and hybrids of both. But recent cloud survey research shows for many of 542 IT decision makers polled, today’s cloud computing options offer better security that some IT organizations can provide in house. The study found that 98% of enterprises surveyed believed the cloud met or exceeded their expectations for security, and the finding was true across several flavors of cloud – IaaS, PaaS and SaaS. Nearly one-third also indicated that “security has been less of an issue than originally thought.” And “enhanced security” was cited by many as a primary objective when implementing IaaS (38%), PaaS (38%) or SaaS (41%).


The study’s findings stand in direct opposition of the much publicized belief that security poses one of the most significant barriers to cloud adoption. (It must be noted that the same study did reveal that 46% of those surveyed cited security as the primary reason they will not move an application to the cloud.) That being said, the findings still mark a shift in the cloud/security debate, which was touched upon recently in a #TechViews Twitter chat (hosted by @TrendsinTech) on cloud and mobile security. The chat drew some 52 contributors and more than 465 Tweets on the topic.



To learn more about this shift, the chat asked: “Some say security is a hindrance to cloud, a recent study showed some say cloud security is a top benefit of cloud. Why would this be?” Responses pointed to the very nature of IT security and the risk of data living on mobile devices, cloud environments and even within enterprise data centers.  The chat proved there is no one answer.


When it came specifically to cloud, several of the chat participants said cloud is not the problem with security and vice versa. Ron Miller, a freelance technology journalist that participated in the chat, said the negative perception of cloud security is part of a broader miscommunication on the topic.


“Part of it is an ongoing flood of cloud security FUD. It’s self-perpetuating like the Bermuda Triangle story,” Miller tweeted. And he then followed up with, “It’s maddening really that these myths live on. There are breaches everywhere: cloud and private data centers.”

Cloud security could in fact be better when provided by vendors building data centers to serve and secure data from multiple clients, chat members pointed out. The security of the environment depends on many factors, one of which might not be whether or not it is in the cloud or the enterprise.


In fact, some IT organizations could find the security expertise at a cloud provider more advanced than their own in-house capabilities if budget or staff constraints have them working with the “do more with less” mentality.  The problem lies in the attention public cloud outages get and the very real ramifications of putting customer data at risk. Still chat participants said the number of public cloud outages is far fewer than the number of incidents that happen within enterprise companies that also put critical data at risk.


And the chat revealed more of the shift that the study uncovered earlier this year: IT needs to change its mindset to embrace today’s disruptive trends.


Implementing cloud represents letting go of some control, but it doesn’t necessarily mean it is also increasing security risk. These risks reside everywhere; think of the numerous public breaches revealed to be insider attacks. IT needs to find better ways to secure data that also enable end users and customers to embrace new technologies. And to do that, IT needs to evolve its security approach – because in reality, the feeling of control when it comes to IT security could be just an illusion in some IT organizations today.


Read the entire #TechViews Twitter chat on cloud and mobile security here.


#TechViews TweetChat 1 PM ET – Tuesday, October 29, 2013


IT security professionals need to stay ahead of disruptive trends such as mobility and cloud to mitigate risk and ensure assets – including critical and confidential customer data – remain protected. And while vendors work to provide the technologies needed to better lock down amorphous environments that extend to public cloud and onto handheld devices, IT security continues to evolve and advance to enable innovation while also managing risk. techviews.jpg


Here is a preview of the questions that will be addressed in the #TechViews Security TweetChat:

  1. What is the biggest security risk mobility poses?

  2. What is the most important mobile element to secure: device, application or backend?

  3. How is the management and security of APIs fundamental to any mobile app or cloud security project?

  4. Some say security is a hindrance to cloud, a recent study showed some say cloud security is a top benefit of cloud. Why would this be?

  5. How can businesses leverage mobility to enhance security?

  6. How can IT enable the business with new security capabilities (not just to prevent bad things from happening)?


To learn more about mobile security prior to the chat, please read the TechViews Blog: What’s the Biggest Security Risk Mobility Poses? And please download the calendar invite to the #TechViews Security TweetChat here.


Apparently the folks in charge of mobile security at large organizations these days don’t trust anyone.  Or anything.  And I’m betting that’s not such a bad approach.


We ran a webcast recently about mobile data security and asked a few questions about the state of mobile security that ended up being pretty telling.


We asked how far along organizations are in providing mobile access to their corporate applications for employees.  There were two sets of outliers:  4.6% didn’t allow mobile access at all.  About the same number called themselves “mobile ninjas” – claiming everyone in their org was happy. But these extremes were definitely the exception.


Mobile application access for enterprises: “taking it slow”


The biggest percentage allowed mobile access, but from corporate-owned devices only (43.7%).  Interestingly, almost a third (31.2%) had made it a step farther:  they had secured an app or two for BYOD.  This was done tactically, however, and the attendees who had done this said they were “taking it slow.”


Another 9.3% had “opened Pandora’s BYOD box” but were not sure what to do next.  The remaining 6.2% felt they had secured their app portfolio for BYOD, but “users are not pleased.”  Uh oh.  Hide the pitchforks.


The majority of the results here describe companies in some of the very early stages in their journey toward mobile access and enabling BYOD.  They’re starting some of the messy internal conversations that frankly need sorting out pretty quickly.


So, why is there such restricted progress on mobile access to enterprise applications? First off, enabling tablets in an enterprise environment has a lot of hurdles (here’s a post I did on a few of those mobile-specific hurdles).  But secondly, we were asking security folks how far they had progressed in giving what feels like unfettered enterprise access to untrusted devices.  Progress is going to cautious and guarded no matter how good these folks are feeling.


In fact, we also asked them which things on the list below they (officially) trusted.  The numbers were as expected – but still made me chuckle.


Miniscule numbers of respondents felt things like Dropbox, SugarSync storage, and Google Mail were to be trusted with enterprise data.  Users, according to our attendees, were also suspect: only 3.9% thought users should be trusted to “do the right thing.”  Even worse, exactly zero attendees thought native browsers on mobile devices were trustworthy.


On the other hand, 45% of respondents felt safe with encrypted software vaults or containers with remote wipe options.


And 45% said they trusted, well, “nothing.”


Sounds severe, but for several of us who worked on the webcast from Framehawk, the results made sense given what we’ve been hearing from customers.


In fact, when we asked attendees to identify IT’s biggest hurdle to get a mobile experience for an organization’s entire application portfolio, data security was the overwhelming favorite (45.9% of respondents picked this option).  Cost (24.5%) and intuitive native user interface and gestures (18%) were also significant, but definitely second-tier worries.  Time-to-market and the application’s click-response performance were both in single digits.


No question, then:  mobile access to enterprise applications is something that enterprise IT and their security watchdogs take very seriously, regardless of how interesting those mobile devices are for users.  Trust us.


For a summary of our recent webcast, download our new white paper called “How to Avoid Data Leakage from Mobile Enterprise Applications: Use the Cloud.”


This blog was originally posted on


Uniqueness is Powerful in CloudViews

Posted by Carrie Gates Feb 28, 2013

Vint Cerf gave an interesting keynote at RSA, where he covered identity and authentication, all using basic cryptography, leading up to allowing an Internet of Things interaction where devices have authenticated to each other and work together. During his talk, he made a particularly interesting observation: "Uniqueness is powerful."


But why is uniqueness powerful? Because, in essence, uniqueness is *identity*. This is what every person with pink hair, or funky clothes, or exciting hobbies, implicitly knows. This is why we can mix up identical twins - they are not unique enough. Identity is a very personal thing, and very important in the physical world.


But what about in the online context? Here it becomes more complicated - *why* do you want to identify someone? Or, as Dr. Cerf mentioned, devices? Ultimately, we often don't actually care about *identity* (even though we call it that), but about *accountability*. We don't care who someone is, but rather what they have done, and if we can tie that action back to a physical person (or device) that we can ultimately hold accountable.



We have technologies for identity management, and for authentication, and audit capabilities for tying "identities" to actions. And we are developing technologies that better authenticate devices, and allow for cooperation and interaction. But we are ultimately missing that final step - who do we hold accountable? And *this* is why uniqueness is powerful.


Carrie Gates speaking with Andrew Spoeth at the RSA Conference.



Strong Authentication and Pseudonymity on the Internet - Vint Cerf




The cloud is having an impact on everything: how your users are accessing applications, where your data lives, and now, even on the enterprise wireless network.


These days, organizations dealing with an onslaught of wireless devices — and the growing infrastructure demands they create — are also looking at how the cloud may help them manage such tasks as provisioning, configuring and managing network infrastructure through a single, centralized interface. Hosted Wi-Fi might also support capacity requirements better with greater visibility into application consumption and prioritization. And it can save some of the CapEx (capital expenditures) of rolling out access to branch offices and teleworkers. Business continuity benefits are also gained when the infrastructure is protected by a cloud provider’s architectures for backup, security and redundancy.


Keeping Students Connected

This may sound like a lot to promise, but cloud-based Wi-Fi is gaining ground. For instance, at institutions of higher education, where pervasive Wi-Fi is increasingly a selling point for the schools and the “always-on” generation attending them, wireless LAN management challenges are common.

“Many people are carrying around smartphones about as powerful as a computer was eight years ago,” says Peter Souza, Director of Networking, Telecommunications and Technical Support at Roane State Community College in Harriman, Tenn. “[Wi-Fi] is an essential service to provide customers.”


Enterprises considering Wi-Fi-in-the-cloud options can explore different solutions, as Souza did, to find the right fit. Some vendors, such as Meraki propose moving both controller and management functionality to the cloud, for example. Others tout benefits that result from distributing controller functions to intelligent access points and using management software that can be installed on site as either a virtual or physical appliance, or alternatively, that can run in the public cloud.


Cost Savings Add Up

The distributed controller option comes with Software-as-a-Service (SaaS) advantages, including automated backup and recovery and the security of redundant data centers. Souza opted for this approach offered by Aerohive Networks when he replaced the college’s existing wireless network with 802.11n Wi-Fi. From a TCO perspective, Wi-Fi cloud-networking approaches — beginning with removing the expense of installing separate physical controllers in the infrastructure — should show savings. These costs can add up when an enterprise supports multiple locations, as does the cost of labor expended on maintaining, troubleshooting and upgrading the devices when more access points are added than a controller model can support. While larger enterprises may enjoy bigger IT budgets and staff, very few organizations have been immune to cost controls and labor reductions over the last few years.


Souza, and Assistant Network Manager Allen Foster, support nine campuses and thousands of users located a good distance apart. Tech staff can’t be at each site all the time, so avoiding the hassles and costs of purchasing, managing, troubleshooting, backing up and powering controllers at each location seemed like a good idea. At Roane State, the cloud approach eliminated wireless traffic crossing the WAN to a controller in order to be managed and firewalled. “Everything is controlled at the edge,” says Souza. Remote management in the cloud comes from the Aerohive HiveManager Online SaaS solution, which offers simple policy creation and centralized network management options regardless of location. “Being able to find a problem and fix it when you’re in a hotel room or at home in the evening is a big advantage,” says Foster. As for security, its features include 802.11i (WPA2), a wireless intrusion detection system (IDS), 802.1X authentication and rogue AP detection for more secure communications


While the wired LAN will retain a place in most large companies for a long time, many mobile devices no longer even have wired ports on them. As it becomes more important to support a robust Wi-Fi network, it is also increasingly important to support it in a way that reduces CapEx expenditures and the burdens of managing it in a pervasive-device world. For this, as for so many other reasons, the cloud may be calling.


Smart Enterprise Exchange is interested in your cloud applications. Have you considered hosting Wi-Fi? Other network apps? Would security concerns deter you from trying this approach? Share your stories with us and your peers.

Contact Us

We encourage your feedback. Reach out via the "Contact the Editor" and "Contact the Concierge" services for any needs, questions or comments. We look forward to serving you!

Paula Klein, Smart Enterprise Exchange Editor
Ellen Lalier, Smart Enterprise Exchange Concierge

TwitterLinkedInShare Smart Enterprise