HITS

UNIVERSAL CITY, Calif. — As media and entertainment organizations increasingly embrace the benefits of open, internet-based communications and cloud services, they’re entering the realm of malicious actors, where even the most advanced security organizations are challenged to stay ahead, according to Andrew Lemke, North America cyber resiliency technical solution leader at IBM.

IBM has 18,000 customers and “we monitor 70 billion security events per day,” he said Dec. 4, during the presentation “Secure Journey to the Cloud: Part 1” at the Content Protection Summit.

From working with all those customers, “I’ve seen what works and I’ve seen what doesn’t work” when it comes to security, Lemke told attendees.

During the session, he discussed why doing security the traditional way probably won’t work anymore. A new approach is required and now is the time for M&E security teams, as well as the security teams of other organizations, to adapt one, he said.

Lemke also made note of some of the unique challenges added by cloud environments and how organizations can integrate the solutions to those challenges into their security programs.

“We used to have a defined data center [and] we used to have defined borders,” but “we’ve now gotten away from that” by shifting to the cloud, he noted. Now, “we’re broadly distributed and so, if you’re a security practitioner, it’s very unsettling,” he conceded.

After all, “there’s all these mobile devices,” Software-as-a-Service (SaaS) environments, “on-premise environments and cloud environments, and so, from a, I guess, surface area perspective, we have a lot of agita in terms of concerns and we don’t know exactly where we’re being exposed,” he explained.

“With this dramatically increased surface area, we need to respond and make sure that businesses are doing things the right way,” he said.

About 20% of workloads have been moved into the cloud, so that means 80% of workloads “still have to be migrated” to the cloud, he pointed out.

As we increasingly move to the cloud, meanwhile, “roles and responsibilities get much more difficult, and so, while we used to be responsible for the entire stack, from the data center to the data itself, as we move to the cloud, it starts getting a lot more fuzzy and it’s hard to know who’s responsible for what,” he noted.

But it’s important to be “super clear who’s responsible for what and this is multiplied over and over because now our customers are moving to multiple clouds,” often 5-10 different cloud platforms, and it’s important to figure out how to “manage all of those responsibilities,” he said.

When it comes to enterprise security within cloud environments, “there’s a lot of fragmented tools” and solutions today and “we’d like to try to bring it all together and to have some cohesive strategy,” he went on to say. Otherwise, the result could be “chaos,” he warned.

Yet, while moving to the cloud, “there is actually an opportunity to make things tighter than they used to be” when it comes to enterprise security, he said, noting that “when we had traditional data centers, a lot of the data flows were wide open.” Now, however, we can move to a “zero-trust model,” he said.

The Content Protection Summit was produced by MESA and CDSA, and was presented by SHIFT, with sponsorship by IBM Security, NAGRA, Convergent Risks, LiveTiles, Richey May Technology Solutions, EIDR, the Trusted Partner Network (TPN) and Darktrace.