Jul 21, 2018

Can cloud computing really be secure?

Four reasons why the cloud is more secure than legacy systems

When it comes to cloud computing, businesses and IT professionals alike remain especially wary. In a world where security breaches dominate the headlines, the ambiguity that surrounds cloud computing can make securing the enterprise seem daunting. Concerns about security have led some business leaders to continue inhibiting their organisational use of public cloud services.

The challenge exists not in the security of the cloud itself, but in the policies and technologies for security and control of the technology. In nearly all cases, it is the user — not the cloud provider — who fails to manage the controls used to protect an organisation’s data.

This article explores four reasons why the Cloud is more secure than on-premise backup, storage and computing systems, otherwise known as “legacy systems.” It aims not only to demonstrate cloud computing’s usefulness but also to address existing concerns about security. It goes further to explore how an organisation can use effective steps in house to make sure they operate a secure cloud infrastructure.

Four features of cloud security demonstrate why fear of the Cloud is more of a myth than a reality.

1. Strong Perimeters and Surveillance for Legacy Systems

Legacy system security can be unreliable and difficult to implement. They include the terminal, workstation and browser. Legacy systems originated before computer crimes became prevalent. Therefore, preventing access to on-site computers often was enough to block hackers.

In most offices, a locked door is the main defense to protect IT equipment, important files, and personal- and business-related data. In contrast, the top cloud service providers’ (CSP) data centers have multi-layered security defenses. Precautions include high fences, barbed wire, concrete barriers, guards that patrol the area, and security cameras.

These physical barriers not only prevent people from entering the data center. They also monitor activity near the space.

2. Controlled Access

When data is stored off-site in the Cloud, employees, vendors and visitors are physically separated from a company’s mission-critical data. This lack of physical access makes it more difficult for third parties to stumble across data and use it negatively. The amount of human risk decreases.

3. Cyber Security Expertise

Cloud security personnel and cloud vendors specialise in keeping data safe. Cloud infrastructure is monitored at all times in order to head off potential security threats. With added cloud native and 3rd party tooling cloud infrastructures and can be made impenetrable.

With the Cloud, you get access not only to the best data centres but also to highly skilled IT professionals.

4. Thorough and Frequent Auditing

Cloud Platform vendors undergo yearly audits to protect against flaws in their security systems. The list of compliance and security certifications of Cloud vendors are by far more superior to those of corporate data centres. Notably legacy systems do not have this requirement.

How to manage security effectively within your organisation

Different cloud models have different risk and control ramifications. Make sure your strategy reflects this reality. It should also ensure that staff assigned to strategically important use cases have the skills required to do so with security and compliance. In most cases, your team will need to be proficient in both infrastructure as a service (IaaS) and software as a service (SaaS) models.

BUILD EXPERTISE IN YOUR CLOUD MODELS

The basic deployment and operational framework of IaaS is broadly the same as the processes and skills used in traditional IT. Yet, it calls for security and operational teams to acquire a specific set of skills:

  • Virtualization and CSP-specific knowledge
  • Identity and access management (IAM)
  • Workload protection (eg. Hardened Compute instances)
  • Network security and encryption

Technology management who want to use IaaS for sensitive use cases need to ensure their teams have a sophisticated understanding of cloud-specific security technologies and know how to leverage the programmatic infrastructure of IaaS providers for security automation.

Encourage teams to apply imagination and energy to develop new approaches to securely and reliably leverage the benefits of IaaS, SaaS and platform as a service.

In contrast, the entire SaaS technology stack is under the direct control of the service provider. This means that to govern SaaS usage, tech management must focus on Identity and Access Management (IAM) permissions management and the protection of sensitive data. This is accomplished by relying on whatever mechanisms each SaaS provider makes available or by use of a third-party product, such as a cloud access security broker (CASB).

As overseeing SaaS demands less technical expertise, there is a wide range of roles that can manage it:

  • IT operations
  • IT security
  • The compliance or privacy function
  • The business units

Key takeaway - Act on cloud predictions: (via Gartner 2018 Cloud report)

  • Enterprises that implement appropriate cloud visibility and control tools will experience one-third fewer security failures. Placing workloads in the cloud does not require a security trade-off. Enterprises actually benefit from the security built into the cloud.
  • Through 2020, public cloud infrastructure as a service (IaaS) workloads will suffer at least 60% fewer security incidents than those in traditional data centres. CIOs should look to leverage the programmatic infrastructure of public cloud IaaS. Automating as much of the process as possible will remove the potential for human error — generally responsible for successful security attacks. Enterprise data centres could also be automated, but usually don’t offer the programmatic infrastructure required.
  • Through 2022, at least 95% of cloud security failures will be the customer’s fault. CIOs can combat this by implementing and enforcing policies on cloud ownership, responsibility and risk acceptance. They should also be sure to follow a life cycle approach to cloud governance and put in place central management and monitoring planes to cover the inherent complexity of multi-cloud use.

Tagged: Cloud Computing, Cloud Security, Identity and Access Management, Iaas and Saas Security




Jerome Wagner

Posted by Jerome Wagner

Jerome started Startsmart back in 2004. He is a cloud technology architect with over 20 years experience in data centre infrastructure, virtualisation and cloud hosting platforms.

Subscribe to our weekly blog updates

RELATED ARTICLES