IDT CIO Faces Down New Crop of Global Threats

You are a substantial global telecom service provider with annual revenues in excess of $1.5 billion. Your external endpoints are effectively the huge number of customers you provide with communications services.

You offer retail financial services and run a regulated banking business in partnership with Visa Europe and Mastercard International. You have a wholesale business that interconnects with other telecom carriers worldwide. You provide security services to other organizations.

With diversified operations on such a grand scale, how do you keep everything secure, and who do you choose to do it?

IDT Corporation, listed on the New York Stock Exchange and based in New Jersey, is this company. It employs over 1,000 people across more than 20 countries, offering prepaid, VoIP telephony and financial services, specifically targeted at immigrants and the under-banked.

(Source: Wikipedia)

Under the leadership of Golan Ben-Oni, a "security weatherman" and global CIO at IDT, the corporation survived two virulent attacks in 2017 from perpetrators using cyberweapons stolen from the NSA. Ben-Oni took what he learned from many attacks on IDT, and solutions he developed himself, and funneled the knowledge into Security IO, a firm that specializes in threat hunting, where he is CEO in parallel with his IDT role.

Vendor strategy
Ben-Oni is quick to point out that the threats IDT faces are threats faced fundamentally by everyone, but that no single vendor has all the answers to rapidly evolving hacker strategies and tools.

"IDT and its associated organizations operate not only within the telecommunications vertical but also in gas-and-oil, pharmaceuticals, finance, entertainment, and education vertical markets," he told Security Now.

"The challenge here is that state-sponsored tools are now in the hands of everybody, and this means that many of the security solutions [that vendors] deployed are no longer capable of protecting [enterprises] from non-state sponsored actors. The answer here is to move as fast, or faster than the adversaries, and this is often not possible with incumbent or legacy vendors."

Ben-Oni's two-step strategy is to not only double-up, but to "triple-up" on solutions from incumbent threat prevention vendors. Then, in an acknowledgement that incumbent vendors can't always keep up with the speed that bad actors are moving, he'll handpick another vendor or two from the startup community and effectively have four or five different supply resources to pull from for intrusion prevention.

"What we have found is, very often, the startup vendors can do a better job because they've pivoted more quickly than the incumbent vendors, and are providing something unique in the industry that no one else has before," he says, pointing to Israeli developer Solebit, a firm staffed by graduates from an elite Israeli Defense Forces unit, as an example.

The vendor filter
Clearly, this makes for a complex security environment where many vendors may overlap each other, but that overlap is designed to minimize the cracks. Because Ben-Oni's mantra is to minimize mean-time-to-resolution, he has three golden rules that purposefully limit his choices.

The first is that only vendors who can prove they can offer minimization in terms of either efficacy, detection or response are chosen to participate. Secondly, to fit snugly with the current architecture, only vendors which have bidirectional APIs -- even if they are commercial competitors -- are allowed since he advocates knowledge-sharing between disparate systems.

Finally, the internal goal at IDT is constant improvement, week by week, towards besting a structured set of rolling performance indicators.

"We automate [the] majority of our detection, investigation, and response to security incidents, and therefore have removed the [slow] human-factor and replaced it with [very fast] computing and AI intelligence systems," he said. "This allows us to easily meet our own internal metrics and response."

Next page: Cloud & Compliance

Compliance
Compliance to security and data management regulations is paramount to IDT. A failure of any kind would open the company up to multiple penalties and of course the brand tarnishment that some comparable blue-chip retail B2C names have faced and, in some cases, are still facing.

Because IDT is listed, the up-front compliance burden is tough and the potential backend failure burden is heavy. GDPR, SOX, PCI, HIPAA are prime examples since IDT's business spans management of consumer data from widespread locations, and also being regulated as a type of bank.

"GDPR [for example] has not changed the way we approach security or intrusion protection; however, it does give us an additional financial incentive to do things properly," he said.

Ben-Oni is bullish on IDT's capabilities here.

"Since in most cases, being compliant with these regulations is only a minimum set of standards, they do not speak to our internal security goals," he said. This is where his own best practice of multi-sourcing vendors comes into play, offering in itself a "secure" approach to security.

IDT CIO Golan Ben-Oni
\r\n(Source: IDT)\r\n

"We have found creative methods of fitting a square peg in a round hole, and for example, we have discovered that we can utilize vendors in ways they did not plan [themselves] according to roadmap or original development targets," he added. Indeed, his team drive towards creating their own value out of vendor offerings, tailoring implementations in the direction of unique needs and not necessarily generally available features.

Cloud
Lack of control over external endpoints, hybrid network visibility or strongly authenticated network access, you name it, cloud is a technical, cultural and trust-challenging phenomenon that most have to contend with.

The industry-wide local enterprise IT environment is home-grown and business-specific -- in order to meet internal best practice security metrics and be entirely appropriate for one enterprise versus another. So, that creates one situation for vendors, of working towards integration between existing systems that are ahead of sunsetting but need a more labor-intensive approach to keep them online and performing well.

The other is keeping cloud-first enterprise architectures on a separate track more concerned with maxing out inherent early adopter advantages with in-the-now connectivity and trying to lead with seamless and integrated approaches that ultimately keep customers and generate undisputed revenue.

Vendors need to ideally support both scenarios but according to Ben-Oni, there seems to be a split between those who can, and those who can't yet.

"Sometimes marrying up technology in the cloud and the local enterprise environment can be a challenge because of the complexity of enterprise environments... and this can sometimes be a challenge for a single vendor to provide," he said.

The process of cloud service chaining -- that of integrating a particular service into the cloud -- creates another crossroads. Apparently, many cloud service providers are scrambling to meet security-specific requirements as enterprises migrate, and as a consequence, this aspect is up in the air.

"This is a work-in-progress, but most cloud providers realize that they can't provide all aspects of the infrastructure, service, or security, and are moving as quickly as possible to make it easier for third party security suppliers to enter and provide solutions in their environment," Ben-Oni said.

Boost your understanding of new cyber security approaches at Light Reading's Automating Seamless Security in Carrier & Enterprise Networks event on October 17 in Chicago! Service providers and enterprises receive FREE passes. All others can save 20% off passes using the code LR20 today!

He worries that enterprises are not deploying cloud "properly" -- his feeling is that security is still not baked very hard into the cloud model, and that it's easy for cloud providers to place too much of the security burden on their enterprise customer rather than their own environment.

"The Shared Responsibility Model leaves 95% of the effort on the customer, and the cloud providers will generally wash their hands of misuse, misconfiguration, or inadequate security architectures -- in other words, while the cloud is powerful, it is often improperly deployed," he added.

A shaky global future
Given the technology debt and assaults from all sides faced by most enterprises at the hands of attackers who have more time on their hands and access to readymade weapons in online trading sites, enterprises [and vendors] are up against it.

"What is most striking, whether or not it generates a sense of fear, is the agility and ingenuity of the next-generation of attackers -- because they are moving more quickly than the average security vendor," he explained. "At the same time, government organizations have been pushing to eliminate key security capabilities, such as strong encryption, which will raise the challenge to an untenable level."

The CIO of IDT remains by his own logic aggressive with new systems, and supportive of start-ups.

"There is a long bloody trail of 'next-generation' security organizations that no longer meet the 'next-generation labeling requirements," he said. "[Also,] the only way to solve this problem is to align government, academia, and commercial organizations to respond to the next-generation of threats -- in other words; we will not win in an isolated, siloed, environment."

Related posts:

— Simon Marshall, Technology Journalist, special to Security Now