When we interviewed Gary Eppinger, CISO of Carnival Corporation, for “Borderless Behavior Analytics – Who’s inside? What’re They Doing?”, I was fascinated with the ‘hyper-hybrid environment’ he described. It’s like no hybrid environment (on-premises integrated with cloud) I had ever encountered or heard of before during my many years in networking and security. Gary coined the term, and an apt coinage it is. So what exactly is a ‘hyper-hybrid environment’? Inquiring minds want to know! Picture a sci-fi setting of interplanetary travel, where spacecraft supporting vast populations must interoperate with the home planet. Now put that all here on earth, and you get the basic idea of the hyper-hybrid environment challenges that Gary and Carnival face every day.
This isn’t just BYOD, IoT, wireless devices, a range of cloud solutions, with users and entities accessing an organization’s environment 24/7 from anywhere in the world. It’s basically a land-based global headquarters with a collection of floating cities, all with complete civic infrastructures, all in constant movement, and with constantly changing populations. And each of these guests has a individually issued wearable medallion with ‘a unified genome’ that identifies who they are, facilitates whatever transactions they need, and knows where they are at all times*. With Carnival Corporation the complexities of their hyper-hybrid environment touch on that challenge of the futuristic space program I described earlier.
Carnival’s data environment infrastructure includes a host of operational requirements that would give the head of any global-class city their own headaches to assure their city is running smoothly. It’s not just a hotel, it’s retail chain, a restaurant chain, a theme park, with the world’s largest casino chain, it’s a health care facility and it is a highly-sophisticated and massive ocean vessel, with all the associated technologies needed for it to operate flawlessly. Every time one of their ships is at sea, it’s connected via satellite communications. With all of the passengers and crew required to support a single ship, that’s around 4000 people on each craft, all with their own access and activity into the environment. Then multiply that by a hundred ships, all around the world, all of which are supported by with various land-based facilities, and you’ve got yourself a hyper-hybrid environment.
Then think about it from a CISO’s perspective. They need to assure the protection of financial transactions, need to protect passengers’ personal information at their health care facilities, the ship’s operation through any condition and they need to deal with international navigational requirements of all description. And even their trusted insiders are of a different profile. For example Carnival accountants can be land based at their headquarters, but may be required to travel to different international locations, or various ships to provide their services. These privileged access users have unique entitlements and peer groups for establishing baselines, can be constantly evolving based on their activity and, yet their access and activity which must be monitored with risk-based scoring for accurate and comprehensive security monitoring.
So the next time you’re thinking of taking a cruise, and planning to kick back with a few Mai Tais at the end of the day, think about what’s happening behind the scenes to assure not only your comfort and leisure time, but your personal information security and privacy as well. Then, go out and get your mask and flippers and have a great time!
To learn more about hyper-hybrid environments, check out Gary Eppinger’s chapter in “Borderless Behavior Analytics – Who’s Inside? What’re They Doing?” It’s one of seven chapters from expert CIO and CISO contributors who share their seasoned insights from all across the cyber security industry (borderlessbehavioranalytics.com).
*Carnival’s Ocean Medallion, a quarter-sized wearable that’s designed to “maximize the guest experience,” is being introduced to a growing number of Carnival ships since its initial launch in November 2017.