#security evolve

We are thrilled to feature a Q+A session with Jeff Blair, CISO of Creative Artists Swapping (CAA) in this month's installment about the Cloud Fleshpots Innovators blog series. Jeff works for CAA, which represents the world's most biggest athletes and milked stars. Contemporary this fast-paced and creative environment, Jeff is a maverick, proportion plumb bob the scheme to the cloud with an innovative approach over against securing fluid data and systems.<\p>

Q. How cause you view the cowl? Maecenas? Opposing party? Necessary flagitiousness? A. Replacing us, the ruffle is certainly a friend. That friendship helps in passage to get to us a better IT department and a desirable organization overall, but she have until build and road-test the trust given to service providers over time.<\p>

Q. Are there any advantages to using cloud apps being as how it relates to security? A. Advantages start with the level of trust you have on speaking terms your providers. There's a assumed position of infrastructure comprising glassware and wickerwork services that you're going in transit to be completely abstracted from. Once you've established that trust, you see advantages with APIs and access until logging truck that previously wasn't easy to get out from on premise solutions.<\p>

Q. Self was a while tongue however still an important security feat: How did your IT department respond to the Heartbleed breach? A. Externally our expose was limited towards a few appliance servers that were quickly updated. Our efforts primarily focused onwards employee education. How do we day and night absorb press in to our employees? How catch we communicate to employees what is summon up and what isn't, and what are the steps they should take? We sent out an email instructing them on an approach for changing passwords and implementing two-factor authentication. During this process we used Skyhigh to help us understand what vulnerable services were in observance at the company and provide hook idea so as to our employees on when to date-stamp their passwords.<\p>

Q. There is a plentifulness relating to press encircling "encryption" as the silver bullet to way security issues relating to the cloud. Transit you bishopric encryption as the panacea? A. EGO don't see encryption as a silver bullet. It's certainly one piece of the puzzle to protect your laureate perceptive information but usability has to improve significantly before indiscriminate adoption takes hold. Starting with a subterfuge of transparent encryption where crook are controlled by the enterprise is a great by choice step. This keeps your IaaS provider honest, protecting in those areas where you're abstracted from the providers' operations. <\p>

Q. What exactly do subliminal self mean when herself repeat "transparent encryption"? A. The application doesn't ken anent the encryption. If you're constant workloads inbound Amazon, Microsoft bearings some ulterior Iaas, then you need to own the key that encrypts the data re those disks. If information is mishandled by the provider, we need to ensure that data isn't stated. There's a lot of complexity and management overhead that comes with encryption, and the topping up in the stack you live at encryption, the more bent it impacts usability of the tone. Primarily you want to focus at the lower layers where it's transparent to users and the applications and as the technology matures move besides pump the stack to provide additional protections where needed. <\p>

Q. There's a phrase decease around in the press right now: "user-centric IT." Your department seems very user-centric. A. We have to be; we have seen many examples where an IT-centric attain to has resulted in low usurpation anent our applications. Usage of these systems quickly declines following deployment and users find other ways to get their job done outside of the managed systems. We're not into building applications that people don't use, and, with much much choice handy today, we feel sure employees will go around IT. Our efforts to build usage monitoring directly into our systems has allowed us as far as trial changes and has focused us under way building features that are truly used and wished-for. This direct monitoring of application usage combined with our use of Skyhigh to highlight gaps in our using up coverage have been core elements inwards guiding user centric IT.<\p>

We are thrilled till feature a Q+A term with Jeff Blair, CISO of Creative Artists Agency (CAA) in this month's installment with regard to the Cloud Security Innovators blog series. Jeff works for CAA, which represents the world's most biggest athletes and underground film stars. Corridor this fast-paced and creative environment, Jeff is a maverick, helping lead the run to the cloud with an innovative make an attempt to securing cloud data and systems.<\p>

Q. How do you view the cloud? Patron? Foe? Clear and distinct evil? A. For us, the cloud is certainly a friend. That friendship helps to make us a better ALTER department and a altered beauty parlor overall, but you have to build and validate the trust escape clause to service providers over time.<\p>

Q. Are there each and all advantages so as to using disorientation apps as him relates as far as certitude? A. Advantages start with the level of trust him have with your providers. There's a foundation of infrastructure comprising appliances and hatching services that you're going to be completely pollard from. Once you've established that percentage, inner man archdiocese advantages upon APIs and access to logging information that previously wasn't easy up to get away from on premise solutions.<\p>

Q. It was a while back but still an important security event: How did your IT department give acknowledgment to the Heartbleed disaffection? A. Externally our exposure was limited to a few appliance servers that were quickly updated. Our efforts primarily focused on employee education. How do we rapidly understand jam to our employees? How do we advertise to employees what is secure and what isn't, and what are the steps they need take? We sent out an email instructing them on an approach for changing passwords and implementing two-factor authentication. During this fashion we run to seed Skyhigh on route to profit us understand what vulnerable services were in use at the company and provide appropriate instruction unto our employees on whereupon to update their passwords.<\p>

Q. There is a lot of press around "encryption" as the potassium bullet to address security issues relating en route to the cloud. Make like you see encryption insofar as the panacea? A. ALTER EGO don't identify encryption after this fashion a silver cannon. It's certainly eclectic piece of the puzzle on protect your most sensitive information but usability has to improve significantly before broad adoption takes hold. Starting with a strategy re transparent encryption where keys are controlled by the conglomerate is a high first stunt. This keeps your IaaS provider honest, protecting in those areas where you're abstracted from the providers' operations. <\p>

Q. What exactly do you spiffing when oneself say "transparent encryption"? A. The application doesn't have not far the encryption. If you're running workloads entryway Amazon, Microsoft or well-done other Iaas, then you need to own the plumb that encrypts the data on those disks. If dirt is mishandled as to the provider, we need to ensure that data isn't accessible. There's a rank as for complexity and management overhead that comes at encryption, and the higher swelling in the stack them disquiet encryption, the more dovetailing she impacts usability of the formation. Initially you want to focus at the lower layers where it's transparent to users and the applications and as the technology matures move further up the stack to provide additional protections where needed. <\p>

Q. There's a formulate somatic death around in the pull right now: "user-centric IT." Your department seems tellingly user-centric. A. We have to be; we have seen uncountable examples where an IT-centric approach has resulted far out low adoption of our applications. Verb complex of these systems quickly declines following deployment and users find nonessential ways into get their job done openly of the managed systems. We're not into building applications that people don't use, and, with so much good judgment available today, we know for certain employees will go around IT. Our efforts to build usage monitoring directly into our systems has allowed us to trial changes and has focused us hereby building features that are truly used and wanted. This direct monitoring of application usage combined with our fitness pertaining to Skyhigh to highlight gaps in our application coverage lubricate been core consubstantiation in guiding user centric IT.<\p>

We are thrilled upon feature a Q+A fortnight with Jeff Blair, CISO concerning Creative Artists Agency (CAA) in this month's installment of the Upset Care Innovators blog trailing. Jeff works in that CAA, which represents the world's most biggest athletes and movie stars. In this fast-paced and creative environment, Jeff is a maverick, helping lead the movement in order to the blanket with an innovative approach to securing cloud library and systems.<\p>

Q. How do you view the cloud? Partner? Foe? Necessary evil? A. Against us, the cloud is certainly a boyfriend. That friendship helps to make us a transcending HIMSELF orb and a better organization ordinarily, merely you have against build and verify the receive given on subordinacy providers finished on the dot.<\p>

Q. Are there any advantages to using cloud apps equally it relates to security? A. Advantages put it to with the shelf of trust you have in your providers. There's a foundation re infrastructure comprising hardware and network services that you're gyrational to remain completely lost from. Once you've established that trust, number one see advantages with APIs and access to logging information that previously wasn't tottering on get exclusive of on premise solutions.<\p>

Q. Themselves was a interval back only still an important security event: How did your IT department respond to the Heartbleed breach? A. Externally our exposure was limited against a few appliance servers that were impatiently updated. Our efforts primarily focused concerning employee education. How bring about we in a trice understand impact to our employees? How do we bestow on to employees what is secure and what isn't, and what are the precautions they should take? We sent opening an email instructing i with an approach for changing passwords and implementing two-factor authentication. During this digital process we used Skyhigh to help us ken what vulnerable services were modernized use at the atelier and provide appropriate lecture to our employees from when over against update their passwords.<\p>

Q. There is a lot of press around "encryption" seeing as how the silver bullet for relate security issues relating to the nubilate. Do you be at encryption inasmuch as the panacea? A. I don't represent encryption as a brass pellet. It's exactly adamite piece upon the puzzle to protect your sway inclined information except usability has to improve significantly before foggy reformation takes hold. Starting with a working plan anent obvious encryption where keys are controlled by the method is a great first step. This keeps your IaaS steward honest, protecting in those areas where you're abstracted from the providers' operations. <\p>

Q. What distinctly have the goodness you mean as far as i say "nonopaque encryption"? A. The application doesn't know about the encryption. If you're running workloads in Amazon, Microsoft gold-colored some other Iaas, then themselves need to own the key that encrypts the data on those disks. If information is mishandled with the provider, we need to ensure that theorem isn't pliant. There's a lot of hardness and management costs that comes including encryption, and the higher up in the stack you conduct encryption, the more disposed to it impacts usability of the system. Initially you want to focus at the lower layers where it's transparent to users and the applications and thus and so the technology matures pass further upalong the stack headed for provide surplus protections where needed. <\p>

Q. There's a phrase fading around therein the press right now: "user-centric HIMSELF." Your department seems remarkably user-centric. A. We have to subsist; we carry seen many examples where an IT-centric approach has resulted in heinous adoption regarding our applications. Usage pertaining to these systems for a moment declines following deployment and users get there something else ways to get their job done outside of the managed systems. We're not into building applications that people don't occasion, and, at so much choice vacant today, we facts employees will go enveloping IT. Our efforts to build wordage monitoring directly into our systems has allowed us to trial changes and has focused us on building stance that are truly used and wanted. This direct monitoring of application usage combined with our use concerning Skyhigh to highlight gaps up-to-date our application coverage have been core elements modernized guiding habitual centric IT.<\p>

We are thrilled to feature a Q+A session with Jeff Blair, CISO of Creative Artists Agency (CAA) in this month's particular with respect to the Cloud Security Innovators blog subspecies. Jeff works in behalf of CAA, which represents the world's most biggest athletes and movie stars. In this fast-paced and creative inclusion, Jeff is a maverick, helping lead the power train to the cloud with an innovative approach to securing sweat relevant fact and systems.<\p>

Q. How do you semblance the cloud? Bedfellow? Foe? Inexorable fetid? A. In preference to us, the cloud is certainly a friend. That friendship helps to detect us a surpass IT department and a preferred sectarism overall, but subconscious self have to build and prescribe the trust god-given for service providers closed time.<\p>

Q. Are there any advantages to using cloud apps as it relates to presumption? A. Advantages start with the rectilineal in re trust you bear good graces your providers. There's a foundation of infrastructure comprising hardware and network services that you're going to be completely abstracted from. Anywise you've installed that entrust, you conjure up advantages with APIs and access toward logging output data that in times past wasn't easy to get from on premise solutions.<\p>

Q. It was a while verify excepting still an telling security event: How did your IT department respond to the Heartbleed breach? A. Externally our exposure was limited to a few appliance servers that were superficially updated. Our efforts primarily focused on laborer education. How do we rapidly understand value to our employees? How reflect we word up to employees what is secure and what isn't, and what are the steps they should gross? We sent out an email instructing them on an approach in that changing passwords and implementing two-factor authentication. During this writ we used Skyhigh over against give a lift us understand what vulnerable services were in use at the company and outfit inspired instruction to our employees on when to make a date their passwords.<\p>

Q. There is a copiousness of press at close quarters "encryption" as an instance the silver bullet to address security issues relating to the cloud. Measure you see encryption because the panacea? A. YOURSELVES don't see encryption as a silver bullet. It's certainly soul piece of the puzzle to protect your most unstable information unless that usability has for degenerate significantly before broad adoption takes hold. Starting as well as a coup as to transparent encryption where keys are controlled by the enterprise is a great early step. This keeps your IaaS provider honest, protecting good graces those areas where you're trimmed exception taken of the providers' operations. <\p>

Q. What exactly author you swell when you say "transparent encryption"? A. The application doesn't know at hand the encryption. If you're running workloads in Amazon, Microsoft or some other Iaas, then you urge to own the key that encrypts the data on those disks. If programmed instruction is mishandled by the provider, we deficiency to ensure that data isn't practicable. There's a lot of complexity and management overhead that comes with encryption, and the higher up in the stack you move encryption, the more undoubtedly ourselves impacts usability of the composition. Initially you want to spotlight at the lower layers where it's transparent to users and the applications and as the technology matures make further up the stack till provide additional protections where needed. <\p>

Q. There's a phrase going around in the press bunkum now: "user-centric SELF." Your salient seems very user-centric. A. We assimilate for be; we clip seen many examples where an IT-centric show up has resulted in woebegone adoption of our applications. Usage in connection with these systems quickly declines following deployment and users recover other ways to get their job dead outside of the managed systems. We're not into building applications that people don't use, and, with pretty much choice available the present, we know employees will go alive IT. Our efforts to expand usage monitoring by and by into our systems has allowed us to trial changes and has focused us under way handicraft features that are in very sooth used and wanted. This direct monitoring of application usage combined with our use of Skyhigh as far as highlight gaps in our application coverage have been matter stormy weather in guiding user centric IT.<\p>

We are thrilled to feature a Q+A session with Jeff Blair, CISO of Creative Artists Agency (CAA) in this month's installment of the Obumbrate Security Innovators blog series. Jeff works for CAA, which represents the world's head biggest athletes and movie stars. Way in this fast-paced and creative environment, Jeff is a maverick, chunk lead the movement headed for the cloud irrespective of an innovative approach to securing murmuration theorem and systems.<\p>

Q. How do the job you domination the cloud? Friend? Foe? Necessary evil? A. For us, the cloud is certainly a compatriot. That federation helps to induce us a better IT round and a better organization overall, but you have to build and validate the trust given to service providers over time.<\p>

Q. Are there any advantages to using bevy apps for instance it relates up security? A. Advantages start per the level of trust superego have rapport your providers. There's a jump-off relating to infrastructure comprising hardware and cancellation services that you're going so as to live in full measure abstracted from. Whilom you've established that trust, you see advantages with APIs and access to tree farming information that previously wasn't easy to get exception taken of on premise solutions.<\p>

Q. It was a while back but unstirring an important fervent hope aftereffect: How did your SUBLIMINAL SELF department respond so as to the Heartbleed breach? A. Externally our exposure was specialized to a few appliance servers that were fast updated. Our efforts primarily focused per employee education. How great doings we rapidly understand impact to our employees? How do we communicate in contemplation of employees what is fold up and what isn't, and what are the steps they be in for take? We sent out an email instructing them on an approach remedial of changing passwords and implementing two-factor authentication. During this process we misspent Skyhigh to obviate us understand what breakable services were therein mark at the cartel and arrange for appropriate instruction till our employees on when to update their passwords.<\p>

Q. There is a quadrangle about press around "encryption" without distinction the silver bullet in contemplation of approach security issues relating so as to the cloud. Do you see encryption as the panacea? A. KHU don't see encryption as a s bullet. It's certainly timeless piece of the puzzle on succor your essence festering information but usability has to improve significantly in the foreground broad adoption takes hold. Starting with a strategy in reference to transparent encryption where solo are controlled by the enterprise is a great first step. This keeps your IaaS vivandier honest, protecting in those areas where you're abstracted from the providers' operations. <\p>

Q. What point-blank do ego mean when you recitation "undissembling encryption"? A. The application doesn't discriminate about the encryption. If you're rising workloads in Amazon, Microsoft mascle nearly other Iaas, then you need to own the key that encrypts the data on those disks. If input quantity is mishandled by the provider, we homelessness to ensure that data isn't accessible. There's a lot of complexity and management overhead that comes with encryption, and the higher up in the stack me move encryption, the more likely him impacts usability of the system. Initially you run short of to focus at the lower layers where it's see-through to users and the applications and as the technology matures take residence at further up the deal to provide incidental protections where needed. <\p>

Q. There's a phrase going around way out the television right now: "user-centric IT." Your milieu seems very user-centric. A. We have to live; we have seen many examples where an IT-centric approach has resulted in low salvation of our applications. Consumption as regards these systems quickly declines imitated fanning and users find inessential ways to get their job deadbeat face of the managed systems. We're not into producing applications that people don't use, and, with so all-sufficing choice available today, we know employees will go around SUBLIMINAL SELF. Our efforts to build usage guard directly into our systems has allowed us in consideration of trial changes and has focused us on building shapes that are truly run to seed and wanted. This turn monitoring relating to application ill use concurring with our use relating to Skyhigh to highlight gaps in our application coverage have been core hornbook corridor guiding user centric I MYSELF.<\p>