Magazine menu Close Magazine menu

Cloud and security

Latest stories

services multi cloud

Multicloud may be your cloud strategy’s silver lining

  • min read
    • No one expects to hear bonfire-roasted undersea cables were part of what inspired University of Hawai'i's interest in using the cloud. Galvanized steel conduits come out of the ground right where Honolulu's homeless population tends to light fires. More than once, the undersea cables have ended up cooked, leaving Honolulu with a quarter of its usual bandwidth. It's a novel problem, but the benefits University of Hawai'i is getting from multicloud are shared widely. More than 80 percent of organizations now use more than one cloud provider, say leading technology researchers Gartner. They describe multicloud as, "bringing multiple cloud services under unified management to serve multiple service models such as Infrastructure as a Service (IaaS,) Platform as a Service (PaaS) and Software as a Service (SaaS,) and multiple delivery models (public, private.)" Many businesses are testing ways to use multicloud in digital transformation, to reduce risk, avoid getting locked into using one vendor and get more of the services they need. I spoke with Brian Chee, co-host at TWiT: This Week in Tech – a network of nearly 30 tech podcasts and IT Specialist at University of Hawai'i, to find out how and why the university uses multicloud. He shares his advice for those deciding whether it's a good option for their business, or just getting started. Why multicloud? For Chee, it comes down to none of the major cloud providers doing everything they want. For example, since they've been wooing University of Hawai'i, Chee's been considering the value of Google Cloud. But as they've only just started providing infrastructure as a service (IaaS), he couldn't run anything custom on it without a lot of painful retooling. If he were willing to retool, Google Cloud would be economical. They have many and varied data centers globally, making load balancing and failover capability simple. He thought setting up global load balancing (GLB) on Google Cloud was easier than Amazon Web Services or Microsoft Azure, but that will change, as Microsoft and Amazon invest big in undersea cables. Does multicloud mean chaos? University of Hawai'i has 10 campuses and 30 research institutes. Its IT group acts more like an Internet Service Provider (ISP.) They provide connectivity to the research and instruction units, but departments buy their own equipment and services. Brian says between them, departments use almost all the cloud providers he's heard of. Recently they've started turning the corner and using private cloud. It delivers services through IT infrastructure used only by their organization. About three years ago, they deployed a system based on VMware so they could pool resources and provision systems through a portal. On top of that, Chee says university departments want a hybrid cloud environment. He knows some are experimenting with Microsoft Azure, who has a deal on trial machines for educational institutions. He uses Amazon Web Services' Glacier for data archiving with a failover: An alternative destination if there's disruption on the original transfer method. Getting started with multicloud The C-suite (senior executives) should set the tone for the company, but too often they force exceptions on the IT group, like not wanting to change their password, says Chee. There's no "one size fits all" solution Multicloud can happen by circumstance rather than design. Kaspersky's Andrey Pozhogin explains: "When changes happen – like a company restructure, merger or acquisition – the IT team are suddenly managing a very different technical infrastructure stack. How to best resolve this is a unique decision based on your needs. There is no cookie-cutter solution." Know your needs from your wants Chee says, start by making two lists, "needs" and "wants." When you test drive, use these to decide where to place workloads. Proof of concept (POC) As they offer deals for test-driving, you should set up test runs with the major cloud service providers. Try to verify the claims in their brag sheets and marketing materials. This is important because all the big players are different. "Too many people just believe salespeople," says Chee. "Independent, unbiased testing is almost non-existent nowadays." Find a cloud-agnostic dashboard Look for a dashboard that gives you one-touch capability on every switch port, several views into the inter-device path and the health of everything connected to it. Switch ports can be physical or virtual, as long as they talk SNMP (Simple Network Management Protocol.) Chee says market pressure means vendors are moving their dashboards toward this kind of functionality. Always have security top of your mind Chee thinks security is lagging behind DevOps. "They tend to be separate tools. SecOps hasn't caught up with the DevOps folks or a single pane of glass yet, but they're getting there." He's only heard of one tool, TotalView by PastSolutions, that combines DevOps and SecOps, but expects more are on the way. Reducing multicloud risk People often think trying to set up failover between cloud providers is complex. Not so much anymore, says Chee. "For cloud providers to stay competitive, they've had to develop Application Programming Interface (API) sets to manage and control IaaS and SaaS images remotely." Another good thing to include in your proof of concept. If they don't lead by example, the rest of the company will keep bad habits like weak passwords, using sticky notes and personal web browsing on company equipment. The C-suite must also be willing to invest in cybersecurity training and company-wide licenses for security tools like password vaults. Portability is the future Chee thinks the flexibility to move applications and data from one cloud provider to another will be critical in the next few years, and he says things are happening there. "It shouldn't be long before I can shop complex mathematical tasks around various computing clusters worldwide to find the best price. I think that kind of portability is just half a dozen years away." Businesses are choosing multicloud to diversify where they place their workloads among the major cloud service providers, taking advantage of their strengths.
security as a service cloud migration

Why you need Security as a Service for cloud migration

  • min read
    • From small-to-medium-sized businesses (SMBs) to the biggest multinationals, use of cloud computing infrastructure and services is growing exponentially. Spending on end-user information security and risk management will reach 188 billion US dollars by 2023, according to leading technology researchers Gartner. This vote of confidence in the cloud could partly come from greater confidence in Security as a Service (SECaaS.) In our interview, Curtis Franklin, Senior Editor at widely read cybersecurity news site Dark Reading, says SECaaS is a consideration in many cloud migrations, but not the primary factor. Not all businesses are ready to migrate everything to a cloud environment – or in other words, to migrate to Enterprise as a Service (EaaS) – but their cloud assets still need enterprise-grade, cloud-based security. Firewall plus access less identity IT departments have widely accepted security solutions like web application firewalls (WAF,) security information and event management (SIEM) and encryption. Franklin says user identity is there: "Cloud access security brokers (CASB) are an option: On-premises or cloud-based software that sits between cloud service users and cloud applications. It monitors all activity and enforces security policies. Some would have called it the next-generation firewall. It's a firewall and access management in one application, but not so much identity." In the cloud, there's a lot of analytics data, or Security Operations Center as a Service (SOCaaS,) that can be added to user credential management, managing encryption keys and identities. What companies should look for Look at the expertise your cloud service brings to the table. Is it just a service, or a service with people? The security of application program interfaces (APIs) that connect data and applications in the cloud is also critical. Franklin warns against introducing vulnerabilities to take advantage of a new cloud-based experience. "Every time you have one application connecting to another, you have a place where a vulnerability can exist. In the cloud, there are many of those." A lower Total Cost of Ownership (or TCO – direct and indirect costs of an application or system) isn't a given unless the enterprise manager has carefully crunched the numbers. Franklin cites cases where companies on volume-based cloud service pricing schedules didn't know their actual volume, or the cloud got unexpectedly popular with staff, so they ended up with high costs. "Many now understand you're not always reducing your costs, but shifting it. You're exchanging Capital Expense for Operational Expense. For a lot of customers, that's fine or better, because it's taxed differently and hits a different part of the annual report. You're taking the money you'd spend anyway and getting more value for it." Sometimes when you're buying SOCaaS, you're buying expertise in the form of people you can't otherwise find. You're trusting the cloud provider to find and rent those minds to you, rather than trying to find them yourself. Built-in reporting and customer support are critical. If an attacker knows more about your infrastructure and environment than you do, it's an opportunity for an exploit. Franklin suggests using these services to stay on top of what's really happening in your environment, as opposed to what you think is happening. What about cloud service agreements? Review cloud service agreements (CSAs) to ensure you'll get the value you need from the service. There must be enough flexibility to set things up so you can realize that value. Know what you want out of the relationship: Harmonious functionality between the cloud service provider and your existing applications. Everything flows from that. Reporting can help you understand what you're getting from the service. Franklin says, "Are you paying for notification? Are you paying for integration with other systems that will automatically act on signals received? Will it play a role in procedural controls or is it going to be active in process control? You need to know, because if it's process control, there's automation. If it's procedure control, you're getting notifications people will have to review. It's critical to know upfront, as part of your CSA, which it is and where those notifications are going." How will SECaaS solutions evolve? Franklin believes SECaaS solutions will evolve in two ways. On the one hand, there will be SECaaS solutions that augment the intelligence of IT staff, letting analysts and engineers be more productive. On the other hand, some will replace human analysts and engineers. The human replacement may be of more interest to small-to-medium sized business, and automation of more interest to larger enterprises. He says businesses should know which path they're taking when they talk to a service provider. "Are they going to make your current staff more effective, letting you avoid hiring or taking over staff roles?" There'll be much more solution development in authentication and access management because it's a complex piece of the security puzzle. Franklin sees much of that going to the cloud service provider that's handling multi-factor authentication. Whether it's a secondary factor that comes through an app, an SMS or something else, the cloud will handle it. He says more companies want the cloud provider to handle all access management, because it's complicated. They want to be able to do it for their employees on both corporate and personal devices. SECaaS bundled into the cloud service provider services, or bought by the business from a vendor, is an excellent way to do it.
by Innovating leaders.
Innovative tech.
About Secure Futures

Secure Futures magazine is your go-to business guide for opinions, trends and insight into the world of technology and cybersecurity. We help your business to bring on the future. Brought to you by Kaspersky, the global cybersecurity experts.

  • For all other countries