Register Here
Delegates
Sponsorship
  Call For Papers
Speakers
Schedule
Sponsors
Exhibitors
  Sessions
  Videos
  Power Panels
  Presentations
Untitled Document
2018 East Exhibitors

Untitled Document
2018 East Media Sponsors








Untitled Document
2017 West
Premium Sponsors
Diamond



Platinum
@DevOpsSummit

Bronze










Untitled Document
2017 West
Keynote Sponsor


Untitled Document
2017 West Exhibitors
























@ThingsExpo











Untitled Document
2017 West JETRO ×
Six Prefectures
of Japan
Pavilion Exhibitors



















Untitled Document
2017 West Media Sponsors














Untitled Document
2017 East
Premium Sponsors
Diamond



Platinum
@DevOpsSummit

@DevOpsSummit

Silver
@DevOpsSummit


Bronze










Untitled Document
2017 East Exhibitors
@DevOpsSummit




































Untitled Document
2017 East Media Sponsors
















Untitled Document
   
  DevOps: Disruptive but Essential in a Cloud Computing Universe
  Join us in New York City, Novemeber 11 - 13



The widespread success of cloud computing is driving the DevOps revolution in enterprise IT. Now as never before, development teams must communicate and collaborate in a dynamic, 24/7/365 environment. There is no time to wait for long development cycles that produce software that is obsolete at launch. DevOps may be disruptive, but it is essential.

DevOps at Cloud Expo - to be held June 5-7, 2018, at the Javits Center in New York City, NY - will expand the DevOps community, enable a wide sharing of knowledge, and educate delegates and technology providers alike. Recent research has shown that DevOps dramatically reduces development time, the amount of enterprise IT professionals put out fires, and support time generally. Time spent on infrastructure development is significantly increased, and DevOps practitioners report more software releases and higher quality.

Join us at DevOps at Cloud Expo June 5-7 for three days of intense DevOps discussion and focus.

We'll see you in New York!




DevOps Summit Power Panel | DevOps Five Years Later: What Does the Future Hold?
After more than five years of DevOps, definitions are evolving, boundaries are expanding, 'unicorns' are no longer rare, enterprises are on board, and pundits are moving on. Can we now look at an evolution of DevOps? Should we? Is the foundation of DevOps 'done', or is there still too much left to do? What is mature, and what is still missing? What does the next 5 years of DevOps look like?


The Top Keynotes, the Best Sessions, a Rock Star Faculty, and the Most Qualified Delegates on ANY DevOps Event!


DevOps is a software development method that stresses communication, collaboration and integration between software developers and information technology (IT) professionals. At DevOps Summit the breakout sessions will engage not just existing DevOps pros, but also managers and executives like CIOs and CISOs, Dev and Ops managers, business leaders and architects.
 
DevOps Summit is a premier conference that connects a wide range of stakeholders to provide a valuable and educational experience for all.




Opening Keynote at 17th Cloud Expo | Jason Bloomberg, President of Intellyx
In today's enterprise, digital transformation represents organizational change even more so than technology change, as customer preferences and behavior drive end-to-end transformation across lines of business as well as IT. To capitalize on the ubiquitous disruption driving this transformation, companies must be able to innovate at an increasingly rapid pace.

Benefits of Attending the THREE-Day Technical Program
  LEARN exactly why DevOps is relevant today from an economic, business and technology standpoint.
  HEAR first-hand from industry experts how development and operations teams work seamlessly together to make it easy to develop and upgrade applications.
  SEE how to improve IT service delivery agility.
  DISCOVER what the core purpose and principles of DevOps are.
  FIND OUT how the core values of collaboration, integration, and communication will allow large enterprises to benefit from this new approach on a broad, enterprise scale.
  MASTER how to improve collaboration between operations and development teams.
  LEARN what works, what doesn't, and what's next.
@DevOpsSummit at New York City's Javits Center


Avoiding Compliance Risk with Better Access Management | @CloudExpo #Cloud #Security #Compliance
Networks have become large, complex entities that are increasingly difficult to manage and control

Avoiding Compliance Risk with Better Access Management

Networks have become large, complex entities that are increasingly difficult to manage and control. Security, audit, risk and compliance professionals know that their organizations rely on them for effective risk management, control and governance processes that are essential to the safety of their network environment. Yet compliance and security are more challenging than ever before as additional layers are added to this environment.

One of the challenges lies in the fact that there is an ongoing, huge access gap in network security and compliance - and it has been residing within the environment for more than 20 years. This tool, known as the Secure Shell (SSH) protocol, grants privileged access to all types of production environments.

A Problem Gaining Attention
The problem is propagated by a lack of awareness at the management level. Network, system and database administrators are aware of the SSH key access in terms of granting them access to do their jobs. Unfortunately, it's an elevated access that is not being managed and governed and has no management visibility. As organizations attest to compliance and indicate that they have effective access controls and can attest to authorized access at all times to production, they are totally missing the boat in terms of attesting to SSH keys access.

Consider how you grant critical application access to vendors and administrators; that privileged access going into production with SSH keys is not being controlled by any means of logging, auditing or review. The point of privileged access is to obtain approval to elevate your access to do a certain function, to audit and check your work, and then sever the session and review it after the fact. Unfortunately, those steps and the control of privileged access fail when you don't have true governance over SSH keys.

More professionals are becoming aware of this access gap, chiefly through practitioner guidance and industry events discussing the protocol and, unfortunately, by means of large security breaches (such as the SONY breach) stemming from poorly managed SSH key environments.

Material Weakness and Invisible Threats
Now that this huge risk regarding elevated, direct access to production that is not audited, logged, controlled or governed has come to light, what can organizations do? Auditors must take action to assess the risk, govern it, minimize it and take control over SSH keys. Failure to act is likely to have several negative consequences.

One of the consequences would be the spectacular failure of an audit. Not having control over 30 percent of your production access could be construed as material weakness to your environment, from a controls perspective. And if you talk about a financial institution that is publically traded, and they fall under the Sarbanes-Oxley umbrella, this is a huge problem. From a SOX perspective, when a CFO or CEO signs off on attestations, they are saying they have complete visibility and control over access. However, the reality is that they have no visibility or control over their production due to poor or non-existent SSH key management.

Another consequence of poorly managed SSH key environments is that it creates an open door for threats that you don't even have visibility into. For instance, a malicious insider could be leveraging uncontrolled, unaudited privileged access that is not monitored or logged and you wouldn't be able to tell. By the same token, if you are being breached by an attacker who is leveraging back doors or exploits in this environment, the same thing would happen. You would have no visibility into the data that is being compromised or potentially compromised, and by law you must notify and report accordingly. So, what would your reported evidence look like?

Best Practices
To ensure SSH access is authorized and that the access falls within governance guidelines, organizations must adopt best practices, leverage automation, establish ongoing monitoring and auditing, and govern all access equally.

Because this situation warrants immediate attention and action, ISACA has recently released a new guidance document, SSH: Practitioner Considerations. In collaboration with industry experts, practitioners and ISACA subject matter experts, the white paper provides an excellent overview of what SSH is, its background, assurance considerations and practitioner impacts and suggested controls.

The document offers the following best practices to manage SSH keys and mitigate risk:

  • Ownership and accountability:Define roles and responsibilities so that everyone knows who owns SSH key management.
  • Usage procedures: Institute recurring access reviews, document and disseminate security policies and standards, and implement required IT controls.
  • Configuration management: Set up and deploy hardening configuration, and periodically review the configuration. Consider automated tools to manage the configuration and apply integrity control checks and monitoring over critical files.
  • Provisioning: Take an inventory of keys and usage tracking as part of the overall provisioning of users and accounts.
  • Automation and standardization: Automation is critical for the success of SSH key deployments. Standardization is required, and access restrictions are key.

Toward Greater Compliance
ISACA warns that organizations are at risk of incomplete attestation regarding access compliance if they do not take SSH keys into account. The organizations goes on to say that SSH key environments that are poorly managed can result in not only audit infractions but data breaches as well. Use the best practices recommended above to remove these unnecessary risks by taking control of your SSH key management.

About Fouad Khalil
Fouad Khalil is VP of Compliance at SSH Communication Security with extensive experience in the technology space with more than 25 years spanning disciplines in software development, IT support, program and project management and most recently IT Security and Compliance management. He has come up the technology ladder his entire career from network, system and database administration, software programming, system, software and GUI design, project and product development, solution implementation and much more.

He has been an active member in ISACA, IIA and Infragard for over ten (10) years and an active contributor to ISSA and ISC2 regionally and nationwide. He is CISA and ITIL Foundations certified.

In order to post a comment you need to be registered and logged in.

Register | Sign-in

Reader Feedback: Page 1 of 1

Presentation Slides
Traditional on-premises data centers have long been the domain of modern data platforms like Apache Hadoop, meaning companies who build thei...
Using new techniques of information modeling, indexing, and processing, new cloud-based systems can support cloud-based workloads previously...
@DevOpsSummit Stories
So the dumpster is on fire. Again. The site's down. Your boss's face is an ever-deepening purple. And you begin debating whether you should join the #incident channel or call an ambulance to deal with his impending stroke. Yes, we know this is a developer's fault. There's plenty of time for blame later. Postmortems have a macabre name because they were once intended to be Viking-like funerals for someone's job. But we're civilized now. Sort of. So we call them post-incident reviews. Fires are never going to stop. We're human. We miss bugs. Or we fat finger a command - deleting dozens of servers and bringing down S3 in US-EAST-1 for hours - effectively halting the internet. These things happen.
The digital transformation is real! To adapt, IT professionals need to transform their own skillset to become more multi-dimensional by gaining both depth and breadth of a wide variety of knowledge and competencies. Historically, while IT has been built on a foundation of specialty (or "I" shaped) silos, the DevOps principle of "shifting left" is opening up opportunities for developers, operational staff, security and others to grow their skills portfolio, advance their careers and become "T"-shaped.
This session will provide an introduction to Cloud driven quality and transformation and highlight the key features that comprise it. A perspective on the cloud transformation lifecycle, transformation levers, and transformation framework will be shared. At Cognizant, we have developed a transformation strategy to enable the migration of business critical workloads to cloud environments. The strategy encompasses a set of transformation levers across the cloud transformation lifecycle to enhance process quality, compliance with organizational policies and implementation of information security and data privacy best practices. These transformation levers cover core areas such as Cloud Assessment, Governance, Assurance, Security and Performance Management. The transformation framework presented during this session will guide corporate clients in the implementation of a successful cloud solu...
Authorization of web applications developed in the cloud is a fundamental problem for security, yet companies often build solutions from scratch, which is error prone and impedes time to market. This talk shows developers how they can (instead) build on-top of community-owned projects and frameworks for better security.Whether you build software for enterprises, mobile, or internal microservices, security is important. Standards like SAML, OIDC, and SPIFFE help you solve identity and authentication, but for them authorization is out of scope. When you need to control "who can do what" in your app, you are on your own.
Dynatrace is an application performance management software company with products for the information technology departments and digital business owners of medium and large businesses. Building the Future of Monitoring with Artificial Intelligence. Today we can collect lots and lots of performance data. We build beautiful dashboards and even have fancy query languages to access and transform the data. Still performance data is a secret language only a couple of people understand. The more business becomes digital the more stakeholders are interested in this data including how it relates to business. Some of these people have never used a monitoring tool before. They have a question on their mind like "How is my application doing" but no idea how to get a proper answer.



2016 | 2015 | 2014 | 2013 | 2012
Testimonials
This week I had the pleasure of delivering the opening keynote at Cloud Expo New York. It was amazing to be back in the great city of New York with thousands of cloud enthusiasts eager to learn about the next step on their journey to embracing a cloud-first worldl."
@SteveMar_Msft
 
How does Cloud Expo do it every year? Another INCREDIBLE show - our heads are spinning - so fun and informative."
@SOASoftwareInc
 
Thank you @ThingsExpo for such a great event. All of the people we met over the past three days makes us confident IoT has a bright future."
@Cnnct2me
 
One of the best conferences we have attended in a while. Great job, Cloud Expo team! Keep it going."

@Flexential


Who Should Attend?
Senior Technologists including CIOs, CTOs & Vps of Technology, Chief Systems Engineers, IT Directors and Managers, Network and Storage Managers, Enterprise Architects, Communications and Networking Specialists, Directors of Infrastructure.

Business Executives including CEOs, CMOs, & CIOs , Presidents & SVPs, Directors of Business Development , Directors of IT Operations, Product and Purchasing Managers, IT Managers.

Join Us as a Media Partner - Together We Can Enable the Digital Transformation!
SYS-CON Media has a flourishing Media Partner program in which mutually beneficial promotion and benefits are arranged between our own leading Enterprise IT portals and events and those of our partners.

If you would like to participate, please provide us with details of your website/s and event/s or your organization and please include basic audience demographics as well as relevant metrics such as ave. page views per month.

To get involved, email events@sys-con.com.

DevOpsSUMMIT Blogs
So the dumpster is on fire. Again. The site's down. Your boss's face is an ever-deepening purple. And you begin debating whether you should join the #incident channel or call an ambulance to deal with his impending stroke. Yes, we know this is a developer's fault. There's plenty of time for blame later. Postmortems have a macabre name because they were once intended to be Viking-like funerals for someone's job. But we're civilized now. Sort of. So we call them post-incident reviews. Fires are never going to stop. We're human. We miss bugs. Or we fat finger a command - deleting dozens of server...
The digital transformation is real! To adapt, IT professionals need to transform their own skillset to become more multi-dimensional by gaining both depth and breadth of a wide variety of knowledge and competencies. Historically, while IT has been built on a foundation of specialty (or "I" shaped) silos, the DevOps principle of "shifting left" is opening up opportunities for developers, operational staff, security and others to grow their skills portfolio, advance their careers and become "T"-shaped.
IT organizations that don't know their risk factors and exposure are likely to make investments in DevOps that don't matter. After working with several teams that lost their DevOps funding after making automation investments in areas that were not business constraints, Anne Hungate's "Know Your Numbers" model emerged. Join Anne to learn how to prioritize your DevOps improvements and demonstrate the impact and value you are delivering. After all, DevOps gets traction and funding when teams can show the business impact of doing it, so if you want your DevOps initiative to take off, be prepared t...
Digital Transformation Blogs
IT organizations that don't know their risk factors and exposure are likely to make investments in DevOps that don't matter. After working with several teams that lost their DevOps funding after making automation investments in areas that were not business constraints, Anne Hungate's "Know Your Numbers" model emerged. Join Anne to learn how to prioritize your DevOps improvements and demonstrate the impact and value you are delivering. After all, DevOps gets traction and funding when teams can show the business impact of doing it, so if you want your DevOps initiative to take off, be prepared t...
This session will provide an introduction to Cloud driven quality and transformation and highlight the key features that comprise it. A perspective on the cloud transformation lifecycle, transformation levers, and transformation framework will be shared. At Cognizant, we have developed a transformation strategy to enable the migration of business critical workloads to cloud environments. The strategy encompasses a set of transformation levers across the cloud transformation lifecycle to enhance process quality, compliance with organizational policies and implementation of information security ...
Authorization of web applications developed in the cloud is a fundamental problem for security, yet companies often build solutions from scratch, which is error prone and impedes time to market. This talk shows developers how they can (instead) build on-top of community-owned projects and frameworks for better security.Whether you build software for enterprises, mobile, or internal microservices, security is important. Standards like SAML, OIDC, and SPIFFE help you solve identity and authentication, but for them authorization is out of scope. When you need to control "who can do what" in your ...
CloudEXPO.TV
"Calligo is a cloud service provider with data privacy at the heart of what we do. We are a typical Infrastructure as a Service cloud provider but it's been des...
Discussions of cloud computing have evolved in recent years from a focus on specific types of cloud, to a world of hybrid cloud, and to a world dominated by the...