Omkhar Arasaratnam

Omkhar Arasaratnam

New York, New York, United States
10K followers 500+ connections

Join to follow

About

My goal is to leave the world a better, more secure and trustworthy place.

I've…

Articles by Omkhar

  • Strong authentication's ultimate side channel attack - Helpful people
    Dec 29, 2015

    Strong authentication's ultimate side channel attack - Helpful people

    A couple of days ago, Brian Kerbs wrote about the inherent weaknesses in the handling of customer authentication…

    12 Comments
  • Security, and Defensive Lines.
    Aug 16, 2015

    Security, and Defensive Lines.

    With the fall soon upon us, many are thinking about defensive lines. While for most in the USA, this is an epic…

    6 Comments
  • Security Architect? Oh ya... - part 4
    Jun 7, 2015

    Security Architect? Oh ya... - part 4

    Well, looks like we got to the end. Here we are, the last part of my series on security architecture.

    7 Comments
  • Security Architect? Oh ya... - part 3
    May 30, 2015

    Security Architect? Oh ya... - part 3

    In the first part of this multipart series, we started with our problem statement – why is security architecture so…

    5 Comments
  • Security Architect? Oh ya... - part 2
    May 25, 2015

    Security Architect? Oh ya... - part 2

    In the first part of this series, I describe an interesting problem – why is security architecture such a hard…

    9 Comments
  • Security Architect? Oh ya.. - part 1
    May 24, 2015

    Security Architect? Oh ya.. - part 1

    Over almost a decade, I’ve held the title of security architect - or some variant thereof, including but not limited…

    17 Comments
See all articles

Activity

Join now to see all activity

Experience

  • LinkedIn Graphic

    LinkedIn

    New York, NY

  • -

    New York, New York, United States

  • -

    New York, New York, United States

  • -

    New York City Metropolitan Area

  • -

    New York, NY

  • -

    New York, United States

  • -

    Greater New York City Area

  • -

    Greater New York City Area

  • -

    New York City Metropolitan Area

  • -

    Toronto, Canada Area

  • -

    Toronto, Canada Area

  • -

    Toronto, Canada Area

  • -

    Toronto, ON

  • -

    Toronto, ON

  • -

    Toronto, ON

  • -

    Toronto, ON

  • -

    Toronto, ON

  • -

    Toronto, ON

Licenses & Certifications

Publications

  • Privacy Requirements and Realities of Digital Public Goods

    USENIX SOUPS 2024

    Other authors
    See publication

  • Practical Guide to Cloud Migration – Google - Site Reliability Engineering

    O'Reilly

    For a collection of essays on Organizational Transformation, we asked colleagues across Google — solutions architects, security engineers, software engineers, SRE, and more — to share their guidance on what it means to "move to the Cloud”.

    Other authors
    See publication

  • Auditing Cloud Computing: A Security and Privacy Guide

    Wiley

    Companies are increasingly looking to Cloud Computing to improve operational efficiency, reduce head counts, and help with the bottom line. But security and privacy concerns present a strong barrier to entry. In an age when the consequences and potential costs of mistakes could quickly become catastrophic for companies that handle confidential and private customer data, auditors and IT security professionals must develop better ways of evaluating the security and privacy practices of Cloud…

    Companies are increasingly looking to Cloud Computing to improve operational efficiency, reduce head counts, and help with the bottom line. But security and privacy concerns present a strong barrier to entry. In an age when the consequences and potential costs of mistakes could quickly become catastrophic for companies that handle confidential and private customer data, auditors and IT security professionals must develop better ways of evaluating the security and privacy practices of Cloud services. Auditing Cloud Computing presents a collection of white papers written by renowned thought leaders in the field of auditing Cloud Computing to show you how to audit your company's hosted services.
    Providing a holistic view to this elastic, on-demand service, Auditing Cloud Computing is your one-stop reference to Cloud Computing and the many questions that may arise during preparation of an audit program or throughout the course of an audit or assessment. Edited by renowned information security researcher and practitioner Ben Halpert, this volume gathers a team of prominent Cloud experts who have labored to provide insight into many aspects that you and your organization will encounter during your foray into the Cloud.

    Other authors
    See publication

  • The IBM eServer BladeCenter JS20

    IBM Corporation, International Technical Support Organization

    Blade servers are a relatively new technology. They have captured industry focus
    because of their modular design, which can reduce cost with a more efficient use
    of valuable floor space. They offer simplified management, which can help to
    speed such tasks as installing, reprovisioning, updating, and troubleshooting
    hundreds of blade servers. You can do all of this remotely using one graphical
    console with IBM® Director systems management tools.
    In addition, blade servers…

    Blade servers are a relatively new technology. They have captured industry focus
    because of their modular design, which can reduce cost with a more efficient use
    of valuable floor space. They offer simplified management, which can help to
    speed such tasks as installing, reprovisioning, updating, and troubleshooting
    hundreds of blade servers. You can do all of this remotely using one graphical
    console with IBM® Director systems management tools.
    In addition, blade servers provide improved performance by doubling current rack
    density. By integrating resources and sharing key components, costs decrease
    and availability increases.
    The IBM Eserver® BladeCenter™ boasts innovative modular technology,
    leadership density, and availability. It was designed to help solve a multitude of
    real-world problems.
    This IBM Redbook takes an in-depth look at the IBM Eserver BladeCenter
    JS20. This is a two-way blade server for applications requiring 64-bit computing.
    It is ideal for computer-intensive applications and transactional Internet servers.
    This IBM Redbook helps you to install, tailor, and configure the IBM Eserver
    BladeCenter JS20.

    See publication

  • Linux: Why It Should Replace Your Windows NT Domains

    IBM Corporation, International Technical Support Organization

    Other authors
    See publication

  • Migrate Exchange 5.5 to Domino on Linux

    IBM Corporation, International Technical Support Organization

    Other authors
    See publication

  • Open Your Windows with Samba on Linux

    IBM Corporation, International Technical Support Organization

    Other authors
    See publication

  • An Architectural View of Security for Cloud

    The Open Group (White Paper W116)

    Other authors
    See publication

  • Making Security Policies Fit-for-Purpose

    A Practical Guide to Cloud Migration (O'Reilly/Google SRE)

    Chapter 10 on security policy design for cloud migration

    Other authors
    See publication

Patents

  • SOFTWARE DEFINED COMMUNITY CLOUD

    Issued WO2024118389A1

    Other inventors
    See patent

  • OPTIMIZING ON DEMAND ALLOCATION OF VIRTUAL MACHINES USING A STATELESS PREALLOCATION POOL

    Filed US9229711B2

    A method, computer system, and computer program product for allocating virtual machines in a stateless preallocation pool on a computing device is provided. In response to determining that a virtual machine is to be removed from an active pool in a computing device, it is determined whether the virtual machine is to be moved to a preallocation pool of the computing device. In response to determining that the virtual machine is to be moved to the preallocation pool, the virtual machine is…

    A method, computer system, and computer program product for allocating virtual machines in a stateless preallocation pool on a computing device is provided. In response to determining that a virtual machine is to be removed from an active pool in a computing device, it is determined whether the virtual machine is to be moved to a preallocation pool of the computing device. In response to determining that the virtual machine is to be moved to the preallocation pool, the virtual machine is cleansed of stateful data by removing unique information about the virtual machine's prior allocation while in the active pool. The virtual machine is moved to the preallocation pool. In response to determining that the virtual machine is needed in the active pool, the virtual machine is moved from the preallocation pool to the active pool.

    See patent

  • Programmatically selecting a service provider based on assured quality of service attributes

    Filed US8868709B2

    A method including querying a service provider for functional and nonfunctional qualifications of the service provider to provide a service having functional and nonfunctional requirements; responsive to input from the service provider, receiving by a requestor the functional qualifications and nonfunctional qualifications of the service provider including attesting by a third party, not the service provider or requestor, to at least the nonfunctional qualifications of the service provider;…

    A method including querying a service provider for functional and nonfunctional qualifications of the service provider to provide a service having functional and nonfunctional requirements; responsive to input from the service provider, receiving by a requestor the functional qualifications and nonfunctional qualifications of the service provider including attesting by a third party, not the service provider or requestor, to at least the nonfunctional qualifications of the service provider; evaluating the functional qualifications and attested to nonfunctional qualifications of the service provider; and selecting a service provider having functional and attested to nonfunctional qualifications complying with the functional and nonfunctional requirements of the requestor. The method may be performed on one or more computing devices. Also disclosed is a computer program product.

    Other inventors
    See patent

  • Externalized data validation engine

    Filed US 13/052220

    A method and system of externalized data validation. Data input to applications is received. Metadata specifying types of the received data is received. Methods to cleanse the received data are determined based on the metadata. Based on the determined methods and received metadata, a validation engine external to the applications cleanses and validates the received data. The validated data is sent to the applications for use by the applications. Via a subscription service and without requiring…

    A method and system of externalized data validation. Data input to applications is received. Metadata specifying types of the received data is received. Methods to cleanse the received data are determined based on the metadata. Based on the determined methods and received metadata, a validation engine external to the applications cleanses and validates the received data. The validated data is sent to the applications for use by the applications. Via a subscription service and without requiring updates to the applications, a service provider provides dynamic updates of the validation engine to mitigate newly identified events associated with input to the applications.

    See patent

  • SECURING SENSITIVE DATA FOR CLOUD COMPUTING

    Filed US 12/883248

    A system and associated method for securing sensitive data in a cloud computing environment. A customer system has proprietary data as a record stored in a database. The customer system associates a hashing directive with the record prior to sending the data out to a cloud for computing services. The hashing directive classifies each data field of the record into sensitive and transactional. The hashing directive controls a mode of hashing, either one-way hashing or two-way hashing for each…

    A system and associated method for securing sensitive data in a cloud computing environment. A customer system has proprietary data as a record stored in a database. The customer system associates a hashing directive with the record prior to sending the data out to a cloud for computing services. The hashing directive classifies each data field of the record into sensitive and transactional. The hashing directive controls a mode of hashing, either one-way hashing or two-way hashing for each sensitive data field associated with the hashing directive. A cloud receives the record secured according to the hashing directive and process the record to generate a result value for a cloud process result field of the record. The customer system reconstitutes the record the record according to the mode of hashing indicated in the hashing directive.

    See patent

  • TRUST ASSERTION USING HIERARCHICAL WEIGHTS

    Filed US 12/782860

    An illustrative embodiment provides a computer-implemented method for access control by trust assertion using hierarchical weights. The computer-implemented method comprises obtaining an access request for an asset, identifying a trust value associated with a set of paths associated with the access request to form an identified trust value. The identified trust value is compared with a required trust value and a determination as to whether the identified trust value is greater than or equal to…

    An illustrative embodiment provides a computer-implemented method for access control by trust assertion using hierarchical weights. The computer-implemented method comprises obtaining an access request for an asset, identifying a trust value associated with a set of paths associated with the access request to form an identified trust value. The identified trust value is compared with a required trust value and a determination as to whether the identified trust value is greater than or equal to the required trust value is made. Responsive to a determination that the identified trust value is greater than or equal to the required trust value, access to the asset is permitted.

    See patent

  • OPTIMIZING ON DEMAND ALLOCATION OF VIRTUAL MACHINES USING A STATELESS PREALLOCATION POOL

    Filed US 12/782743

    A method, computer system, and computer program product for allocating virtual machines in a stateless preallocation pool on a computing device is provided. In response to determining that a virtual machine is to be removed from an active pool in a computing device, it is determined whether the virtual machine is to be moved to a preallocation pool of the computing device. In response to determining that the virtual machine is to be moved to the preallocation pool, the virtual machine is…

    A method, computer system, and computer program product for allocating virtual machines in a stateless preallocation pool on a computing device is provided. In response to determining that a virtual machine is to be removed from an active pool in a computing device, it is determined whether the virtual machine is to be moved to a preallocation pool of the computing device. In response to determining that the virtual machine is to be moved to the preallocation pool, the virtual machine is cleansed of stateful data by removing unique information about the virtual machine's prior allocation while in the active pool. The virtual machine is moved to the preallocation pool. In response to determining that the virtual machine is needed in the active pool, the virtual machine is moved from the preallocation pool to the active pool.

    See patent

  • TRUST ASSERTION USING HIERARCHICAL WEIGHTS

    Filed CA 2675701

    An illustrative embodiment provides a computer-implemented method for access
    control by trust assertion using hierarchical weights. The computer-
    implemented method comprises obtaining an access request for an asset, identifying a trust value
    associated with a set of paths associated with the access request to form an identified
    trust value.
    The identified trust value is compared with a required trust value and a
    determination as to whether the identified trust value is…

    An illustrative embodiment provides a computer-implemented method for access
    control by trust assertion using hierarchical weights. The computer-
    implemented method comprises obtaining an access request for an asset, identifying a trust value
    associated with a set of paths associated with the access request to form an identified
    trust value.
    The identified trust value is compared with a required trust value and a
    determination as to whether the identified trust value is greater than or equal to the required
    trust value is made. Responsive to a determination that the identified trust value is greater
    than or equal to the required trust value, access to the asset is permitted.

    See patent

Projects

  • Workcell - https://github.com/omkhar/workcell

    - Present

    Code securely at the speed of yolo!

    Workcell runs coding agents inside a bounded local runtime on Apple Silicon macOS: a dedicated Colima VM plus a hardened container inside that VM. It supports Codex, Claude Code, and Gemini through thin provider adapters that seed each provider's native control plane without pretending provider config is the security boundary.

    This project is for teams that want local agent velocity without turning the host home directory, keychain, provider…

    Code securely at the speed of yolo!

    Workcell runs coding agents inside a bounded local runtime on Apple Silicon macOS: a dedicated Colima VM plus a hardened container inside that VM. It supports Codex, Claude Code, and Gemini through thin provider adapters that seed each provider's native control plane without pretending provider config is the security boundary.

    This project is for teams that want local agent velocity without turning the host home directory, keychain, provider state, or local sockets into the trust boundary.

Recommendations received

4 people have recommended Omkhar

Join now to view

More activity by Omkhar

View Omkhar’s full profile

  • See who you know in common
  • Get introduced
  • Contact Omkhar directly
Join to view full profile

Other similar profiles

Explore more posts

Explore top content on LinkedIn

Find curated posts and insights for relevant topics all in one place.

View top content

Add new skills with these courses

See all courses