How Adobe Security Changed for Cloud Services

TL;DR

Adobe’s move to hosted services shifted security priorities toward continuous operations and monitoring, governance, and authentication, while existing desktop software responsibilities remained. Because cloud software runs in Adobe’s environment, defenders can observe probing directly and respond within seconds or minutes, but teams must develop new skills, structures, procedures, and relationships with service operators.

Transcript

Hi. We're here together February twenty thirteen, but I want you to come back with me, all the way back to the fall of two thousand eleven. I'm gonna help. The Cardinals won the World Series. Charlie Sheen was starting his meltdown. Uh, the pepper screen-- pepper spraying cop in UC Davis, and most importantly, planking. Does anyone remember plankin... Read More

Key Insights

• Adobe’s original security priorities were defending against APT attacks, managing uncoordinated vulnerability disclosures, and addressing concern about CVE counts. APT defense ranked highest because sophisticated attackers created exploits that less-skilled attackers could later adapt and deploy against widely installed Adobe software.
• Adobe’s incident response improved substantially before the cloud transition. An event in 2009 required about ten calendar weeks from notification to update, while a 2011 case took 48 hours from receiving the sample to distributing an update to one billion computers.
• Adobe’s average response time for zero-day incidents was slightly below six calendar days during 2011. This performance depended on substantial proactive and reactive resources, established processes, and cooperation across the company before hosted services became its strategic priority.
• Adobe’s November 2011 cloud strategy moved software from customer-controlled hardware toward servers operated by Adobe. This change gave Adobe greater configuration control, but it also introduced different security problems, required different skills, and compressed meaningful response times from days to seconds or minutes.
• Adobe’s cloud transition did not eliminate responsibility for existing software. The security organization still had to maintain service levels, uptime requirements, and incident response for Reader, Flash Player, Shockwave, AIR, and hundreds of other packaged products while adding responsibilities for hosted offerings.
• Adobe’s Digital Marketing Cloud grew from the Omniture acquisition and operated tens of thousands of cloud nodes. Customers including retailers, department stores, and airlines relied on these services to measure and optimize their sites, making Adobe part of both their uptime and security requirements.
• Adobe’s control of hosted software created a monitoring advantage. Attackers could no longer study the service entirely on an isolated machine, because interacting with it required visiting Adobe’s environment, where defenders could observe probing, track experiments, and choose whether to intervene immediately.
• Adobe’s new leading priorities were security operations and monitoring, governance, and authentication. Governance connected security specialists with hosted-service operators and established procedures, while authentication addressed how Adobe recognized users and managed the related security concerns surrounding access to cloud services.

Questions & Answers

Q: How did Adobe’s move to cloud services change security priorities?

Adobe’s leading concerns shifted from APT exploits, uncoordinated vulnerability disclosure, and CVE counts toward security operations and monitoring, governance, and authentication. Hosted services required Adobe to watch its own environment continuously, coordinate security procedures with operational teams, and recognize users accessing services. These new priorities were added while the company continued supporting the security and service requirements of its existing software products.

Q: Why did Adobe prioritize defending against APT attacks?

Adobe prioritized APT attacks because highly resourced attackers could find vulnerabilities and build reliable exploits for widely installed products such as Flash Player and Reader. After those exploits appeared, attackers with fewer skills could adapt and reuse them. Adobe therefore viewed defense against the initial sophisticated attacks as a way to protect users from the broader exploitation that could follow.

Q: How quickly did Adobe respond to zero-day vulnerabilities?

Adobe reduced its response time significantly before the cloud transition. The first described incident in 2009 took about ten calendar weeks from notification to releasing an update. In 2011, Adobe achieved a record of 48 hours from receiving a malicious sample to distributing an update to one billion computers. Across its software and zero-day events that year, the average was slightly below six calendar days.

Q: Why is cloud security monitoring different from desktop software security?

Desktop attackers could install Adobe software on an isolated, non-networked machine, develop an exploit privately, and deploy it only after making it reliable. With hosted software, attackers had to interact with services running in Adobe’s environment. That gave Adobe opportunities to instrument systems, observe probing and experimentation, record activity, and decide whether to interfere immediately or continue monitoring before fixing the weakness.

Q: What role did governance play in Adobe’s cloud security program?

Governance ensured that teams operating hosted services knew Adobe’s security organization existed and understood its requirements. Without that connection, operational teams might address security inconsistently or only by chance. Adobe’s security team needed operators to follow defined procedures and rules, while also collaborating with them to establish an appropriate level of protection for each hosted offering.

Q: Why did authentication become a major Adobe security priority?

Authentication became a central priority because Adobe’s hosted services needed a way to recognize who was connecting to them and manage the security issues associated with that recognition. Unlike packaged software installed in customer environments, cloud offerings brought users directly to Adobe-operated systems. The transcript identifies authentication as one of the three leading concerns alongside security operations and monitoring and governance.

Q: How did Creative Cloud change the way customers used Adobe software?

Creative Cloud succeeded Creative Suite by letting customers download needed software to the computer they were using instead of purchasing software stored on physical media. It also kept settings consistent and synchronized content across locations. Adobe launched the offering in May, saw usage rise sharply after an overwhelmingly positive response, and committed fully to cloud-based customer interaction by the end of the year.

Q: What security workload remained after Adobe adopted the cloud?

Adobe’s security organization retained its earlier responsibilities even as hosted services created additional work. It still had to maintain service levels, uptime obligations, and incident response capabilities for Reader, Flash Player, Shockwave, AIR, and hundreds of other packaged products. The cloud transition therefore doubled or tripled the workload rather than replacing the established proactive and reactive security program.

Summary & Key Takeaways

• Adobe’s earlier security program focused on advanced persistent threat exploits, uncoordinated vulnerability disclosure, and CVE counts across widely deployed products such as Flash Player and Reader. Its response improved from roughly ten calendar weeks for an incident in 2009 to a record 48 hours and an average below six days in 2011.

• Adobe announced a cloud-focused company strategy in November 2011, making hosted services central to its future. Digital Marketing Cloud operated tens of thousands of nodes for customers, while Creative Cloud delivered downloadable software, synchronized content, and consistent settings. Strong customer adoption encouraged Adobe to commit fully to this model by year-end.

• Hosted services changed Adobe’s leading security concerns to operations and monitoring, governance, and authentication. Adobe could instrument its environment and observe attackers probing cloud software, but security teams also needed relationships with service operators and procedures covering hosted offerings. These duties were added without removing responsibilities for existing desktop and runtime products.