Compliance to security and data management regulations is paramount to IDT. A failure of any kind would open the company up to multiple penalties and of course the brand tarnishment that some comparable blue-chip retail B2C names have faced and, in some cases, are still facing.
Because IDT is listed, the up-front compliance burden is tough and the potential backend failure burden is heavy. GDPR, SOX, PCI, HIPAA are prime examples since IDT's business spans management of consumer data from widespread locations, and also being regulated as a type of bank.
"GDPR [for example] has not changed the way we approach security or intrusion protection; however, it does give us an additional financial incentive to do things properly," he said.
Ben-Oni is bullish on IDT's capabilities here.
"Since in most cases, being compliant with these regulations is only a minimum set of standards, they do not speak to our internal security goals," he said. This is where his own best practice of multi-sourcing vendors comes into play, offering in itself a "secure" approach to security.
IDT CIO Golan Ben-Oni
"We have found creative methods of fitting a square peg in a round hole, and for example, we have discovered that we can utilize vendors in ways they did not plan [themselves] according to roadmap or original development targets," he added. Indeed, his team drive towards creating their own value out of vendor offerings, tailoring implementations in the direction of unique needs and not necessarily generally available features.
Lack of control over external endpoints, hybrid network visibility or strongly authenticated network access, you name it, cloud is a technical, cultural and trust-challenging phenomenon that most have to contend with.
The industry-wide local enterprise IT environment is home-grown and business-specific -- in order to meet internal best practice security metrics and be entirely appropriate for one enterprise versus another. So, that creates one situation for vendors, of working towards integration between existing systems that are ahead of sunsetting but need a more labor-intensive approach to keep them online and performing well.
The other is keeping cloud-first enterprise architectures on a separate track more concerned with maxing out inherent early adopter advantages with in-the-now connectivity and trying to lead with seamless and integrated approaches that ultimately keep customers and generate undisputed revenue.
Vendors need to ideally support both scenarios but according to Ben-Oni, there seems to be a split between those who can, and those who can't yet.
"Sometimes marrying up technology in the cloud and the local enterprise environment can be a challenge because of the complexity of enterprise environments... and this can sometimes be a challenge for a single vendor to provide," he said.
The process of cloud service chaining -- that of integrating a particular service into the cloud -- creates another crossroads. Apparently, many cloud service providers are scrambling to meet security-specific requirements as enterprises migrate, and as a consequence, this aspect is up in the air.
"This is a work-in-progress, but most cloud providers realize that they can't provide all aspects of the infrastructure, service, or security, and are moving as quickly as possible to make it easier for third party security suppliers to enter and provide solutions in their environment," Ben-Oni said.
Boost your understanding of new cyber security approaches at Light Reading's Automating Seamless Security in Carrier & Enterprise Networks event on October 17 in Chicago! Service providers and enterprises receive FREE passes. All others can save 20% off passes using the code LR20 today!
He worries that enterprises are not deploying cloud "properly" -- his feeling is that security is still not baked very hard into the cloud model, and that it's easy for cloud providers to place too much of the security burden on their enterprise customer rather than their own environment.
"The Shared Responsibility Model leaves 95% of the effort on the customer, and the cloud providers will generally wash their hands of misuse, misconfiguration, or inadequate security architectures -- in other words, while the cloud is powerful, it is often improperly deployed," he added.
A shaky global future
Given the technology debt and assaults from all sides faced by most enterprises at the hands of attackers who have more time on their hands and access to readymade weapons in online trading sites, enterprises [and vendors] are up against it.
"What is most striking, whether or not it generates a sense of fear, is the agility and ingenuity of the next-generation of attackers -- because they are moving more quickly than the average security vendor," he explained. "At the same time, government organizations have been pushing to eliminate key security capabilities, such as strong encryption, which will raise the challenge to an untenable level."
The CIO of IDT remains by his own logic aggressive with new systems, and supportive of start-ups.
"There is a long bloody trail of 'next-generation' security organizations that no longer meet the 'next-generation labeling requirements," he said. "[Also,] the only way to solve this problem is to align government, academia, and commercial organizations to respond to the next-generation of threats -- in other words; we will not win in an isolated, siloed, environment."
— Simon Marshall, Technology Journalist, special to Security Now