Michael Bissell

Michael Bissell
As Director of Customer Enablement at Cloudentity, Michael provides insights and thought leadership for the complex world of Identity and Security from localhost, legacy systems, SaaS, PaaS and beyond.
Find me on:

Recent Posts

The Cost of Ignorance -- Why You Need a Chain of Evidence not just logs

Posted by Michael Bissell on Sep 10, 2018 11:23:44 AM

You may have seen my posting on East/West is the New North/South.  The bottom line is that traditional API Gateway models simply don’t provide the level of security we need in modern microservice architecture.  The problem is that only 20% of the traffic (that is the inbound traffic up until the gateway) is secure, everything inside the data center is “trusted.”

Read More

Topics: Identity, IAM, devops, security

Infrastructure, Legal and EMBARRASSMENT -- Why we Secure Our Systems

Posted by Michael Bissell on Aug 9, 2018 5:37:06 PM

In computer technology we talk about security breaches and how to prevent them, but honestly, we have different kinds of breaches and different reasons to want to prevent them. Sure we hear the stats like “60% of small companies that suffer a cyber-attack are out of business within six months” but what is it about those attacks that cripple and destroy companies? And how can we create better security policies and implement those policies so we don't suffer attacks?

Read More

Topics: Identity, IAM, devops, security

Cloudentity Benefits (In 1min 15sec)

Posted by Michael Bissell on Jul 28, 2018 9:47:27 PM

The Cloudentity stack is very powerful and very flexible, which means it's hard to tell the story from one person's point of view.  This short (1:15) video gives a quick view from four different people's perspectives.

Read More

Topics: Identity, IAM, devops

East/West is the new North/South

Posted by Michael Bissell on Jul 19, 2018 9:45:33 AM

We talk about network traffic in two ways – North/South traffic is the traffic heading in and out of your network. East/West traffic is the traffic from one server to another inside your network.  So why do we focus so much on North/South and almost forget about East/West?

As I mentioned in Identity and Security Starts at Home, the era of Zero Trust means we can’t trust traffic coming from inside the house.  Internal systems can be compromised and if your internal security is just IP whitelisting or trusted certs, a “trusted app” can do a lot of damage by probing the internal network.

Read More

Topics: Identity, IAM, devops

The Modern World of APIs (or is that airports?)

Posted by Michael Bissell on Jul 5, 2018 10:14:04 AM

The term "API" is tricky.  It stands for Application Programming Interface, but a lot of people seem to think it means “All Powerful Incantation.” You always see decision makers sigh in relief when they find out a product they’re looking at has an API, they’re not sure what it means but they know their developers will be able to do magic with it.

Trouble is, an API isn’t a single thing.  It’s the classic elephant where blind men each get hold of a different part of the elephant… “It’s a snake!” “It’s a tree trunk!” “It’s a wall!” To front-end developers it’s a collection of resources. To a SysOps engineer it’s a firewall. To an engineer it’s an abstraction. And to an Information Security officer, it’s a big mess.

Read More

Topics: Identity, IAM

Presentation: Identity Isn't Just for Users Anymore

Posted by Michael Bissell on Jun 27, 2018 11:45:07 AM

Security management has historically been focused on the User attempting to access a resource. But in the increasingly complex world of CI/CD methodologies and microservices, it’s no longer “Users” and “Resources” we need to secure. Applications need to talk to each other, resources need to move from development through production and be managed by automated systems, and the systems themselves have become consumers and contributors.

Read More

Topics: Identity, IAM

Your Ever-Changing Identity: Why You Need a Dynamic Identity Strategy

Posted by Michael Bissell on Jun 21, 2018 11:04:29 AM

We tend to think of “Identity” as a static thing. I’m “me” and I can prove it! Only my “identity” is extremely fluid. Identity, in the IAM world of Identity Access Management, isn’t just me proving I’m Michael Bissell, but it’s me proving that I’m allowed to do things, and therein lies the challenge.

To be honest, most companies still use their IdP (Identity Provider) as a way to login with AuthN, plain old Authentication. They think they’re doing AuthZ (Authorization), but in reality, you have a fractured Identity strategy any time you have a system that has to make a second call to a database after I log in, just to figure out what I get to do.

Read More

Topics: Identity, IAM

Identity and Security Starts at Home

Posted by Michael Bissell on Jun 14, 2018 12:03:44 PM

 

 

I started my career back in the days when we hosted servers in the basement of the office. At the time, we never really thought much about security until we deployed the code (which pretty much meant FTPing a bunch of files to a server). Security was handled at the router first – block malicious traffic from getting in the door. Then we locked down the firewall on the server itself (no, you can’t telnet from outside the building).

Skip forward 15-20 years. We like to think in the days of solid development cycles and continuous integration/continuous deployment we have this whole security thing nailed. But to be honest, we, as an industry, still pretty much treat security as the thing you do in Production. We treat our dev boxes an awfully lot like my team treated servers back in the day – it’s okay, it’s inside the firewall.

Only it’s not okay.

Read More

Topics: Identity, IAM

Developer Self Service for Identity and API Security.

Cloudentity provides enterprise application developers with a suite of microservices that seamlessly integrates Identity and API Security. Accelerate the DevOps processes with a service mesh that reduces time to market and development cost by 30%.

Download the whitepaper

 

Try the Cloudentity API Security Trial

Or refer it to an Enterprise Developer in your company.

TRY FOR FREE

 

Subscribe Here!

Recent Posts