IBM building security into cloud fabric

IBM executives said this week that the company is looking to many of its existing tools, from the Tivoli management system to Cognos business intelligence software, to secure private and IBM-hosted hybrid clouds as customers migrate to these new computing setups.

Steve Robinson, general manager for IBM security solutions, told Network World during this week's IBM Innovate Conference for software developers that enterprises using clouds should be able to establish means of authentication, provisioning of resources and de-provisioning of them in an automated way.

IBM's Tivoli management platform is being updated for role-based controls in the cloud and will be out later this year.

"Identity management is a foundation piece," Robinson said.

FREEBIE: IBM rolls out cloud software development tool

IBM's research division is working on a real-time monitoring system in which it would be possible to correlate identity with any activity on the network, such as data access and download, to immediately determine security and policy violations.

"Could you detect an upset employee who comes in on a Saturday and walks out with 4GB of data?" Robinson asked, pointing out that IBM's goal with the project is to have a way to detect, store and analyze every network activity in order to determine security and policy violations on a real-time basis.

This would be done by bringing together functionality in IBM's InfoSphere Stream data analysis tool, IBM Cognos business intelligence and IBM SPSS, the predictive analytics software that can be used for fraud control. No timetable was announced for rollout.

Overall, IBM's goal is to "build security into the fabric of the cloud" to overcome security concerns customers have about cloud computing in virtualized environments, said Harold Moss, IBM CTO for cloud security strategy, during a panel discussion at Innovate. "The cloud is potentially more secure" than traditional networks, he said.

While IBM is supporting encryption and ways to audit for compliance purposes, the company has also started investing in technology to keep track of virtual-machine images (IBM states it is "hypervisor-agnostic" in terms of the virtualization platform used).

IBM has begun cataloging virtual-machine images held in its cloud on behalf of customers and has started to monitor the VMs to detect any unexpected movement across the network, said Scott Hebner, vice president of global marketing at IBM's Tivoli division.

Beyond the cloud

But despite IBM's quest to entice its customers into the hybrid and private cloud, some customers find their days filled with down-to-earth struggles related to security in older Web applications.

"The executives know we have a lot of vulnerabilities right now. They want to see them going down," said Daniel Harvey, application security developer for Clayton Homes, the manufactured housing company wholly owned by Berkshire Hathaway. Harvey spoke during a presentation at Innovate about the effort to stamp out Web application bugs.

Clayton Homes, with 12,000 employees worldwide, has about 30 Web developers and 30 Web applications used internally and facing the Internet. Not long ago it was discovered how riddled with security holes many of these Web applications were: Older legacy code of a decade or more was in bad shape and it was clear that software developers were failing to follow safe coding practices.

The company found out about the Web application vulnerabilities during an audit by Ernst & Young. One step that was taken to address the problem was a decision to buy the IBM AppScan tool to get developers to check their code for security vulnerabilities before allowing it into production. But AppScan, in use for about a month, discovered so many bugs that need to be fixed, that Clayton Homes decided it can't address all of them at once.

Instead, the company at the present time is striving for a "threshold of vulnerabilities" to keep holes under an undisclosed number. Harvey added: "It hasn't been that easy to get all the developers to buy in." But he said AppScan, which has been made mandatory, is helping them write more secure code. "The old code is the underlying problem," Harvey said. The issue now has oversight from business executives and the company has beefed up internal networking monitoring as well.

Read more about wide area network in Network World's Wide Area Network section.

Join the PC World newsletter!

Error: Please check your email address.

Tags cognosConfiguration / maintenancesecurityIBMhardware systemsinternetcloud computingData CenterIBM cloud securityvirtualization

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Ellen Messmer

Network World

Most Popular Reviews

Follow Us

Best Deals on GoodGearGuide

Shopping.com

Latest News Articles

Resources

GGG Evaluation Team

Kathy Cassidy

STYLISTIC Q702

First impression on unpacking the Q702 test unit was the solid feel and clean, minimalist styling.

Anthony Grifoni

STYLISTIC Q572

For work use, Microsoft Word and Excel programs pre-installed on the device are adequate for preparing short documents.

Steph Mundell

LIFEBOOK UH574

The Fujitsu LifeBook UH574 allowed for great mobility without being obnoxiously heavy or clunky. Its twelve hours of battery life did not disappoint.

Andrew Mitsi

STYLISTIC Q702

The screen was particularly good. It is bright and visible from most angles, however heat is an issue, particularly around the Windows button on the front, and on the back where the battery housing is located.

Simon Harriott

STYLISTIC Q702

My first impression after unboxing the Q702 is that it is a nice looking unit. Styling is somewhat minimalist but very effective. The tablet part, once detached, has a nice weight, and no buttons or switches are located in awkward or intrusive positions.

Latest Jobs

Shopping.com

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?