IBM Building Security Into Cloud Fabric

IBM executives said this week that the company is looking to many of its existing tools, from the Tivoli management system to Cognos business intelligence software, to secure private and IBM-hosted hybrid clouds as customers migrate to these new computing setups.

Steve Robinson, general manager for IBM security solutions, told Network World during this week’s IBM Innovate Conference for software developers that enterprises using clouds should be able to establish means of authentication, provisioning of resources and de-provisioning of them in an automated way.

IBM’s Tivoli management platform is being updated for role-based controls in the cloud and will be out later this year.

“Identity management is a foundation piece,” Robinson said.

FREEBIE: IBM rolls out cloud software development tool

IBM’s research division is working on a real-time monitoring system in which it would be possible to correlate identity with any activity on the network, such as data access and download, to immediately determine security and policy violations.

“Could you detect an upset employee who comes in on a Saturday and walks out with 4GB of data?” Robinson asked, pointing out that IBM’s goal with the project is to have a way to detect, store and analyze every network activity in order to determine security and policy violations on a real-time basis.

This would be done by bringing together functionality in IBM’s InfoSphere Stream data analysis tool, IBM Cognos business intelligence and IBM SPSS, the predictive analytics software that can be used for fraud control. No timetable was announced for rollout.

Overall, IBM’s goal is to “build security into the fabric of the cloud” to overcome security concerns customers have about cloud computing in virtualized environments, said Harold Moss, IBM CTO for cloud security strategy, during a panel discussion at Innovate. “The cloud is potentially more secure” than traditional networks, he said.

While IBM is supporting encryption and ways to audit for compliance purposes, the company has also started investing in technology to keep track of virtual-machine images (IBM states it is “hypervisor-agnostic” in terms of the virtualization platform used).

IBM has begun cataloging virtual-machine images held in its cloud on behalf of customers and has started to monitor the VMs to detect any unexpected movement across the network, said Scott Hebner, vice president of global marketing at IBM’s Tivoli division.

Beyond the cloud

But despite IBM’s quest to entice its customers into the hybrid and private cloud, some customers find their days filled with down-to-earth struggles related to security in older Web applications.

“The executives know we have a lot of vulnerabilities right now. They want to see them going down,” said Daniel Harvey, application security developer for Clayton Homes, the manufactured housing company wholly owned by Berkshire Hathaway. Harvey spoke during a presentation at Innovate about the effort to stamp out Web application bugs.

Clayton Homes, with 12,000 employees worldwide, has about 30 Web developers and 30 Web applications used internally and facing the Internet. Not long ago it was discovered how riddled with security holes many of these Web applications were: Older legacy code of a decade or more was in bad shape and it was clear that software developers were failing to follow safe coding practices.

The company found out about the Web application vulnerabilities during an audit by Ernst & Young. One step that was taken to address the problem was a decision to buy the IBM AppScan tool to get developers to check their code for security vulnerabilities before allowing it into production. But AppScan, in use for about a month, discovered so many bugs that need to be fixed, that Clayton Homes decided it can’t address all of them at once.

Instead, the company at the present time is striving for a “threshold of vulnerabilities” to keep holes under an undisclosed number. Harvey added: “It hasn’t been that easy to get all the developers to buy in.” But he said AppScan, which has been made mandatory, is helping them write more secure code. “The old code is the underlying problem,” Harvey said. The issue now has oversight from business executives and the company has beefed up internal networking monitoring as well.

Read more about wide area network in Network World’s Wide Area Network section.