Mitigating Insider Threats in Virtual & Cloud Environments
Main Video Segment 1 Segment 2 Segment 3 Listen to the full show. Data centers and enterprise applications have become the objects of intense activity in recent...
Segment 1
Segment 2
Segment 3
Listen to the full show.
Data centers and enterprise applications have become the objects of intense activity in recent years. So has cybersecurity. The focus on one has changed the requirements of the other. Here’s how: Agencies have been virtualizing their servers and applications as a strategy to boost data center efficiency and operational agility. At the same time, they’ve offloaded many of their virtual workloads to cloud providers to gain the benefits of software- and infrastructure-as-a-service. But virtualization and cloud introduce new security risks that threaten to undo the benefits. For instance, when virtualization concentrates systems into software, an attack on the resulting virtual machines can wipe out large pieces of infrastructure with a few keystrokes. Virtualization makes agencies particularly vulnerable to insider attacks. As agencies embark on continuous diagnostics and monitoring of their networks and IT assets, they must be sure the tools they use can see into virtualized infrastructures and sense dangers before damage occurs. That includes detection of abnormal administrator behavior and awareness of outsiders who may, through social media and phishing, gain administrator rights. A panel of federal experts got together to help you understand the latest data center, virtualization and security trends. Among other topics, they answered these questions: * Describe your virtualization and cloud state, future plans * How about CDM (continuous diagnostics and mitigation) * What are your main cybersecurity challenges? * What are your main virtualization challenges as they relate to understanding and mitigating the threats to data centers and virtual machines (including application servers and virtualized storage and networks, if applicable) * How are agencies approaching the insider threat? In Part 1, they discuss the state of virtualiztion – servers, applications, desktops; the use of community clouds; and the need for NIST 800-53 security controls. In Part 2, they discuss continuous diagnostics and monitoring and how it’s more than just maintaining up-to-date patches; tools needed for big data sets. In Part 3, panelists discuss the cloud, how to manage data in the cloud, avoiding exfiltration, and applying virualization and CDM in the cloud.
Moderator
Tom Temin, Federal News Radio
Tom Temin is the host of Federal Drive, airing weekdays from 6-9 a.m. on Federal News Radio 1500AM. Tom Temin has 30 years’ experience in journalism, mostly in technology markets. He was a long-serving editor-in-chief of Government Computer News and Washington Technology magazines, both of which were regular winners of national reporting awards. Before joining Federal News Radio, Tom wrote (and continues to write) a column on government IT and acquisition topics. He was a regular guest on Federal News Radio before joining the team.
Panelists
Tom Bayer, Chief Information Officer, Securities and Exchange Commission
Tom Bayer comes to the SEC from Maris Technology Advisors in Leesburg, Va., where he advised banking and financial services clients on technology strategy, software development, and program management solutions. In his role directing daily operations in the SEC’s Office of Information Technology (OIT), Mr. Bayer oversees applications development, maintenance, infrastructure, and user support for the agency. The SEC’s Office of Information Technology works with the Chairman, Commissioners, and the agency’s divisions and offices to incorporate technology into all SEC programs to serve investors, maintain orderly markets, and promote capital formation. OIT operates the EDGAR system, which provides investors with access to more than 7 million public company financial statements and other filings.
Gary Buchanan, Chief of the Risk Management Division, National Geospatial-Intelligence Agency
Gary Buchanan, Chief of the Risk Management Division of the National Geospatial-Intelligence Agency (NGA), has more than 20 years of experience in information security and technology management. Buchanan is responsible for the Security Assessment, Authorization, and Continuous Monitoring of information systems at NGA. His responsibilities include functioning as the Agency’s Delegated Authorizing Official/Risk Executive and providing leadership, management and oversight of risk, compliance, assessments and testing. Buchanan is a change agent with a demonstrated record of driving information security change and innovative solutions. Mr. Buchanan was appointed to his current position in April of 2011.
William Lay, Deputy Chief Information Officer for Information Assurance and Chief Information Security Officer, U.S. Department of State
William G. Lay, a member of the Senior Executive Service, was appointed Deputy Chief Information Officer for Information Assurance and Chief Information Security Officer for the U.S. Department of State in September, 2012. In these roles, he is responsible for implementation of the Federal Information Security Management Act.
John Skudlarek, Deputy Chief Information Officer, Federal Communications Commission.
John P. Skudlarek is the Deputy Chief Information Officer at the Federal Communications Commission. He is responsible for developing and coordinating FCC information technology plans; establishing and administering IT policies, procedures, and standards; planning and managing IT architecture; directing stakeholder outreach, coordination, and requirements development; overseeing budget and capital planning; approving IT acquisitions; and managing enterprise-wide information management activities. With the CIO, Mr. Skudlarek manages and coordinates implementation of the FCC’s seven modernization tracks: Improve Secure Employee Telework and Mobility; Secure Internal and External Collaborations; Strengthen FCC’s IT Security Posture; Transform Access to FCC Enterprise Data; Modernize Legacy Systems and Tracking; Improve FCC.gov and Complaint Reform; and Increase Transparency and System Usability. He joined the FCC in May, 2014.
Eric Chiu, President & Co-Founder, HyTrust, Inc.
Eric Chiu is a recognized security technology expert and business leader, currently serving as president and co-founder of HyTrust, the Cloud Security Automation company. He previously served in executive roles at Cemaphore Systems and MailFrontier, and was a Venture Capitalist at Brentwood (now Redpoint) and Pinnacle Ventures. He is a published author and speaks frequently at industry forums internationally.
Copyright © 2024 Federal News Network. All rights reserved. This website is not intended for users located within the European Economic Area.
