CLOUD SECURITY INNOVATORS – Q+A WITH JEFF BLAIR, CISO, CAA

By Brandon Cook, Director of Product Marketing, Skyhigh Networks

We are thrilled to feature a Q+A session with Jeff Blair, CISO of Creative Artists Agency (CAA) in this month’s installment of the Cloud Security Innovators blog series. Jeff works for CAA, which represents the world’s biggest athletes and movie stars. We are thrilled to feature a Q+A session with Jeff Blair, CISO of CAA in this month’s installment of the Cloud Security Innovators blog series.

Q. How do you view the cloud? Friend? Foe? Necessary evil?

A. For us, the cloud is certainly a friend. That friendship helps to make us a better IT department and a better organization overall, but you have to build and validate the trust given to service providers over time.

Q. Are there any advantages to using cloud apps as it relates to security?

A. Advantages start with the level of trust you have in your providers. There’s a foundation of infrastructure comprising hardware and network services that you’re going to be completely abstracted from. Once you’ve established that trust, you see advantages with APIs and access to logging information that previously wasn’t easy to get from on premise solutions.

Q. It was a while back but still an important security event: How did your IT department respond to the Heartbleed breach?

A. Externally our exposure was limited to a few appliance servers that were quickly updated. Our efforts primarily focused on employee education. How do we rapidly understand impact to our employees? How do we communicate to employees what is secure and what isn’t, and what are the steps they should take? We sent out an email instructing them on an approach for changing passwords and implementing two-factor authentication. During this process we used Skyhigh to help us understand what vulnerable services were in use at the company and provide appropriate instruction to our employees on when to update their passwords.

Q. There is a lot of press around “encryption” as the silver bullet to address security issues relating to the cloud. Do you see encryption as the panacea?

A. I don’t see encryption as a silver bullet. It’s certainly one piece of the puzzle to protect your most sensitive information but usability has to improve significantly before broad adoption takes hold. Starting with a strategy of transparent encryption where keys are controlled by the enterprise is a great first step. This keeps your IaaS provider honest, protecting in those areas where you’re abstracted from the providers’ operations.

Q. What exactly do you mean when you say “transparent encryption”?

A. The application doesn’t know about the encryption. If you’re running workloads in Amazon, Microsoft or some other Iaas, then you need to own the key that encrypts the data on those disks. If information is mishandled by the provider, we need to ensure that data isn’t accessible. There’s a lot of complexity and management overhead that comes with encryption, and the higher up in the stack you move encryption, the more likely it impacts usability of the system. Initially you want to focus at the lower layers where it’s transparent to users and the applications and as the technology matures move further up the stack to provide additional protections where needed.

Q. There’s a phrase going around in the press right now: “user-centric IT.” Your department seems very user-centric.

A. We have to be; we have seen many examples where an IT-centric approach has resulted in low adoption of our applications. Usage of these systems quickly declines following deployment and users find other ways to get their job done outside of the managed systems. We’re not into building applications that people don’t use, and, with so much choice available today, we know employees will go around IT. Our efforts to build usage monitoring directly into our systems has allowed us to trial changes and has focused us on building features that are truly used and wanted. This direct monitoring of application usage combined with our use of Skyhigh to highlight gaps in our application coverage have been core elements in guiding user centric IT.

Q. As you look into your crystal ball, how will cloud security evolve over the next two or three years?

A. One of the greatest challenges around cloud right now is ensuring consistent identity. I see identity provisioning and authentication standards becoming far more solid over the next two to three years to the point where you can ensure your on premise directories and access policies are going to match up exactly with what is available in the cloud. Along with that, you will see mature, consistent APIs to allow logging data to be centralized and correlated across cloud providers. The biggest challenge today is most services provide the ability to collect usage and administrative information, but each service provides different logging APIs or forces you to access this information through their administrative portal; creating significant up front costs for integration. Increased standardization across security and identity integration models will bring us to new levels of security in the cloud in the next two to three years.