Predict ► Prescribe ► Prevent Analytics Value Cycle

Predict ► Prescribe ► Prevent Analytics Value Cycle

Predict ► Prescribe ► Prevent Organizations looking for justification to move beyond legacy reporting, should review this little ditty from the healthcare industry: The Institute of Medicine (IOM) estimates that the United States loses $750 billion annually to medical fraud, inefficiencies, and other siphons in
Mitigating the Downtime Risks of Virtualization

Mitigating the Downtime Risks of Virtualization

Mitigating the Downtime Risks Nearly every IT professional dreads unplanned downtime. Depending on which systems are hit, it can mean angry communications from employees and the C-suite and often a Twitterstorm of customer ire. See the recent Samsung SmartThings dustup for an example of how

CONTRIBUTORS

Global Public Cloud Spending To Double By 2020

Global Public Cloud Spending To Double By 2020

The Cloud and Endpoint Modeling The worldwide migration of IT resources to the public cloud continues, at a head-spinning pace ...
Are you being served by an empathetic Bot! And do you even care?

Are you being served by an empathetic Bot! And do you even care?

Are you being served by an empathetic Bot! Move over chatbots - it is time for the empathetic bot. Say ...
RSA Conference: FUD-free or filled?

RSA Conference: FUD-free or filled?

IoT 15 Billion Units By 2021 At the annual RSA conference, there were plenty of discussions and presentations on the ...

RESOURCES

Machine Learning Open-Source Tools

Do More With Machine Learning Thanks to These 6 Open-Source Tools

Machine Learning Open-Source Tools We are in the middle of a machine learning, AI and big data renaissance — at least, that’s what we’re calling it. Seemingly everyone is interested in this technology these days, and for a good reason ...
15 Promising Cloud-Based Video Conferencing Services

15 Promising Cloud-Based Video Conferencing Services

Cloud Video Conferencing Services We have put together a compilation of some of the best cloud based conferencing services for businesses. The cloud video conferencing services market is expected to reach US$ 6.40 Billion by 2020 from the current $3.31 ...
Load Testing Tools

Load Testing Tools

Provided is a short list of load testing tools which will test server and application resistance and certainly valuable in order to help test and tweak your company's infrastructure ...
peter-tsai

Staying on Top of Your Infrastructure-as-a-Service Security Responsibilities

Infrastructure-as-a-Service

It’s no secret many organizations rely on popular cloud providers like Amazon and Microsoft for access to computing infrastructure. The many perks of cloud services, such as the ability to quickly scale resources without the upfront cost of buying physical servers, have helped build a multibillion-dollar cloud industry that continues to grow each year.

Still, even though cloud has helped many companies, there are tradeoffs with cloud services such as Infrastructure-as-a-Service (IaaS) that organizations need to be aware of. With IaaS, a cloud provider maintains basic IT infrastructure such as servers, storage, and networks on your behalf, which is convenient but also raises concerns at the same time.

cloud-tech-image

Case in point, in the 2016 Spiceworks report Diving into IT Cloud Services, 52 percent of IT professionals surveyed said loss of control over infrastructure is a barrier to moving IT services to the cloud. In the same survey, the majority of IT pros also said the risk of security breach is a top concern with cloud services. Additionally, 36 percent of respondents were worried about the risk of data loss and keeping cloud costs under control.

Why are IT pros worried about cloud security?

With on-premises infrastructure, you have complete visibility and control over everything. You can physically see your infrastructure, and if something goes wrong, you have the power and ability to take immediate actions to fix issues.

But with cloud services, you need to trust your provider to properly secure your environment and respond to any security incidents in a timely manner, and as the data shows, many IT departments are hesitant to relinquish control and are afraid of outages or data loss that might occur in the cloud.

Adding to the worries, if a security incident occurs on cloud infrastructure, there’s sometimes confusion over who’s ultimately responsible for addressing the problem because there’s shared security responsibility between you and the provider. Who needs to take actions to remedy an issue depends on where in the stack the security incident actually occurred. Therefore, it’s critical for cloud users to know who’s responsible for what.

How IaaS security responsibilities are divided 

The two dominant cloud players, Amazon Web Services and Microsoft Azure, have both documented what they are responsible for as cloud providers when it comes to security. For example, in their shared responsibility model, Amazon Web Services has helpfully broken AWS security responsibilities into two main buckets:

Security of the cloud” = everything the provider does, including:

  • Securing global cloud infrastructure, including physical access to data center facilities where your IT resources are housed
  • Protecting the physical networking, compute, and storage resources, so you don’t have to worry about setting up servers or storage hardware, patching firmware, or installing and properly disposing of drives, etc.
  • Securing hypervisors that host and manage your VMs running on cloud infrastructure

Security in the cloud” = everything you’re responsible for, including:

  • Guarding data generated or collected by your applications
  • Maintaining secure operating system, network, and firewall configurations
  • Identifying and accessing control mechanisms tied to any platforms or applications you manage
  • Protecting information by ensuring data integrity, using encryption, and properly using identity management technologies

How security responsibilities differ between Iaas, PaaS, and SaaS

Microsoft also draws a clear line that separates what cloud service providers and cloud customers are responsible for. Their March 2016 document entitled Shared Responsibilities for Cloud Computing goes one step further by breaking down responsibility areas across different cloud models including IaaS, PaaS, and SaaS.

AWS

With all three service models, the cloud provider is solely responsible for physical security of infrastructure. And like with AWS all Azure users, regardless of what cloud model they take advantage of, are responsible for data classification and availability to make sure sensitive customer data is properly handled across all of the cloud models. But there are varying degrees of responsibility when it comes to end-point protection, identity & access management, application level controls, network controls, and host infrastructure. As a general rule of thumb, the more control over infrastructure you have, the more security responsibility you have as well, with IaaS providing the most control and responsibility, followed by PaaS, and then SaaS.

customer-cloud

How to stay on top of cloud security

In summary, a first step towards securing cloud infrastructure and data is understanding what you’re responsible for so you can take appropriate action. The cloud providers try to make this very clear so you know what you’re getting into when you sign up for their services.

But just because the providers make some promises, you still need to be careful. Providers like Amazon Web services and Azure are not typically on the hook for data loss or a breach due to labor disputes, utility failures, natural disasters, orders of government, or acts of terrorism or war. They also include language in their service agreements that state you are still responsible for backing up and archiving your content in case of a disaster… so even when the cloud provider is on the hook for security, you still need a solid “plan B” just in case.

By Peter Tsai, IT Analyst at Spiceworks

peter-tsaiFormerly a systems administrator, programmer, and server engineer who has lived IT from the inside and out, Peter now works to serve up IT articles, reports, infographics, and livecasts that inform and entertain millions of IT pros in the Spiceworks Community worldwide.

CloudTweaks

Established in 2009, CloudTweaks is recognized as one of the leading authorities in cloud connected technology information, resources and thought leadership services.

Contact us for a list of our leading brand and thought leadership exposure programs.

The Lighter Side Of The Cloud - Disaster Recovery
The Lighter Side Of The Cloud - Autonomous Sleigh
The Lighter Side of the Cloud - Procurement

Cloud Community Supporters

(ISC)²
Cisco
SAP
CA Technologies
Dropbox

Cloud community support comes from (paid) sponsorship or (no cost) collaborative network partnership initiatives.