Many clients and organizations I speak with are interested in moving to public clouds. Some are just beginning an investigation, while others have been migrating for years. We get involved with a new project transitioning to the cloud almost on a daily basis. The project goal may be to build out a new application or to add burst capability to an existing system; in other cases, the goal is the wholesale migration of on-premise infrastructure to infrastructure-as-a-service (IaaS). The cloud is rapidly becoming an essential tool for IT.
Public Clouds Mature
The topic of cloud security comes up at every stage of a cloud project, but I find that once an organization commits to hosting on the cloud, the security considerations tend to take a back seat. Downplaying the security topic can sometimes happen for good reasons — namely, security barriers to cloud adoption are breaking down. With enhanced data center capabilities, better compliance and reporting, better tooling and growing administrator experience with the platforms, the security barriers are being addressed one by one. Basic familiarity with the cloud platform’s security capabilities can go a long way in preparing for the transition as well. Soon, many organizations will begin treating cloud security concerns as an afterthought.
However, the breakdown of cloud security barriers has raised an unusual challenge for security practitioners: CIOs and line-of-business owners are becoming increasingly comfortable with cloud security, while the actual cloud security implementations lag far behind traditional enterprise security. Many factors contribute to the gap, from the fast speed of adoption and complexity in implementation to weaknesses in available cloud security tools.
To consider a straightforward example, how would deployment of an event management and visibility solution change when a portion of the on-premise infrastructure migrates to a public cloud? Not only would multiple data centers require integration with a single product, but new classes of events also must be added to the existing system: hypervisor activity, software-as-a-service (SaaS) logs, cloud platform audit records, automation logs, etc. Even if these new event sources could be integrated seamlessly, do security intelligence and analytics seamlessly make use of the new data? Visibility across the entire environment requires a new generation of security tools and capabilities.
5 Steps Toward a More Secure Cloud
My webinar presentation, “5 Easy Steps to Securing Workloads on Public Clouds,” highlights how complex cloud security requirements can be made easier by unlocking advantages in public clouds. The presentation covers five areas to easily get up and running with cloud security. To help convey the step-by-step implementation, each of the five topics includes detailed recommendations based on hands-on experience.
The five steps begin with fundamental capability and gradually increase in terms of cloud capability leveraged.
- The first step addresses basic functions to achieve security parity with on-premise deployments
- The second step moves on to automated security patterns
- The third step to rapid integration with existing systems
- The fourth step covers integrated intelligence and visibility across the many new aspects of a hybrid cloud
- I’ll leave the fifth topic unnamed here so as not to spoil the entire presentation, but I will posit that it can be the most powerful — and simple — of the topics. It shows us where the cloud is heading and why the cloud can make security easier than anything we had before.
While basic enablement is just a starting point, cloud automation enables security deployment at a level never before possible in on-premise environments. The cloud shifts us from physical appliances that monitor network perimeters to virtual appliances that can be deployed anywhere easily and rapidly. Combine automated configuration with easy-to-use policies and reporting, and suddenly an application workload can have Defense in Depth and in Breadth without expert guidance supplied to the application developer.
My webinar concludes with a look at the future of cloud security. Automated deployment of highly-tuned infrastructure around specific workloads gets us focused back on the most important topic: securing high-value assets. If the most sensitive data in an organization can be hosted with protections deployed automatically, as well as monitored and audited automatically, suddenly we have strong, turnkey security capability. Lower-priority workloads and data can be deployed with respectively appropriate levels of security, and those systems can be easily segregated using software-defined networks. Every application can have its own customized security zone. Once this happens, we can begin to fundamentally rethink security for the cloud.
I invite you to watch my on-demand webinar below to learn more about the trends we see in cloud security, easy steps that can be taken to secure cloud workloads and the emerging solutions that will be unlocked by future cloud capability.
https://www.youtube.com/watch?v=ZGUg9Yn57aY