CLOUD INFRASTRUCTURE

  • 05/27/2015
    7:00 AM
  • Rating: 
    0 votes
    +
    Vote up!
    -
    Vote down!

Overcoming Cloud Security Challenges

To truly take advantage of cloud computing, enterprises must balance the capabilities of public and private, while focusing on security.

IT decision makers are under greater pressure today, more than ever, to deliver IT solutions that meet the expectations of company employees, partners and customers, who are increasingly demanding innovative applications on the latest devices. In fact, it's become imperative for CIOs to see IT as a key element of their competitiveness, rather than just a cost that needs to be managed -- although keeping costs in line is a constant requirement.

This is where cloud computing comes in. Increasingly, IT organizations can lean on the cloud as a way to deliver the services their employees need almost instantly, while cutting costs and minimizing complexity. The ability to grow and shrink capacity as needed, while reducing the time needed to configure the required IT resources, allows DevOps teams to build and launch new applications and services quickly, and then do something totally different the next day with the same resources.

That's one of the main reasons that high-performing companies are already harnessing the cloud to transform the way they do business. The cloud allows them to quickly launch new products and services that enable them to operate more efficiently, improve the experience of their customers and employees, and compete more effectively.

As with many buzzwords, "the cloud" may need a bit of clarification as there are different types of cloud: the public cloud, shared among multiple users or organizations; the private cloud, dedicated exclusively to a single organization; and the hybrid cloud, that blends public and private resources to optimize cost and flexibility while supporting essential security and control.

The public cloud has been a driver in setting expectations for IT within the enterprise. Many enterprise users prefer the usability, elasticity, and cost-per-usage model of public clouds. However, for security, compliance and cost control, you can't fully adopt public cloud approaches, and instead need to look at building a private cloud or leveraging a hybrid cloud to address your needs.

This approach was reinforced in a recent study completed by research firm Penn Schoen Berland (PSB) for Alcatel-Lucent, which found that three out of five large enterprises are already using some form of cloud computing. The vast majority, at 74%, was adopting private clouds. At the same time, IT decision reported that the move to the cloud was the IT issue with the biggest impact on their organization today and in the future.

Among the large enterprises we talk to, ranging from financial service organizations to healthcare providers, there is a common theme: They have deployed a private cloud because, while they want to take advantage of the cloud, there are key concerns over the types of data that can and should be stored in the public cloud due to privacy and compliance concerns.

For example, PSB's research found that only a fraction of healthcare providers (12%) store patient health records in a public or hybrid cloud, and even fewer (10%) financial services firms store client financial records in a public/hybrid cloud environment. Protecting customer data is the top concern in both market segments.

That said, adopting a private cloud is not sufficient to address every company's needs. Security requirements remain, but it is also important to leverage the flexibility of hybrid or public clouds for less sensitive data and/or to address ever-changing needs.

Network security is challenging in cloud environments because the architectures are dynamic, which makes fixed security measures cumbersome and expensive. At the same time, hackers are more sophisticated and increasingly engaged in persistent attacks to compromise the network and cloud that can extend over the course of many months. Despite these concerns, however, security and compliance can be strengthened in cloud deployments.

Some software-defined networking (SDN) approaches can enforce security for virtual machines (VM) and applications at the first connection point of the network. Also, fine-grained policy controls can allow you to tailor security requirements to the department, network, application, container or VM.

Often we don't realize the implications, both good and bad, that new trends like cloud computing can have on the network and IT in general. In order to harness the benefits of the cloud, the IT infrastructure and approaches must continue to evolve to address the risks.

The good news is that, according to PSB, 35% of large enterprises in the U.K. and 30% in the U.S. would spend extra IT budget on cloud services, meaning that the desire and resources to adopt cloud computing are here.

For more on building hybrid clouds, download out digital issue, In Pursuit of the Purpose-Built Hybrid Cloud.


Comments

High Time

Cloud relevance is still accounted with security challenges, and one of the reason is critical data residing in cloud. Data in the cloud needs to be accessible only by those authorized to do so, making it critical to both restrict and monitor who will be accessing the company's data through the cloud. 

Secure sensitive data across the entire data flow

I agree that "Network security is challenging in cloud environments." Less than 14% of breaches are detected by internal security tools according to the annual international breach investigations report from Verizon. Detection by external third party entities unfortunately increased from approximately 10% to 25% during the last three years. Unfortunately, current security approaches can't tell you what normal looks like in your own systems.

I agree that "critical data is residing in cloud." I think we need to protect our sensitive data itself. I found great advice in a Gartner report, covering enterprise and cloud, analyzed solutions for Data Protection and Data Access Governance and the title of the report is "Market Guide for Data–Centric Audit and Protection."  

It is time to secure sensitive data across the entire data flow, including cloud and enterprise systems.

Ulf Mattsson, CTO Protegrity