What is shadow IT?

How to Make the Move to the Cloud Securely

Move to the Cloud Securely

The 2016 Enterprise Cloud Computing Survey from IDG offers multiple interesting insights concerning the state of cloud adoption in 2017. According to IDG, 70 percent of the survey’s respondent organizations have at least one application in the cloud, and 56 percent of organizations are still identifying IT operations that are candidates for cloud hosting. On top of that, those that aren’t yet utilizing the cloud may soon be. A McKinsey study found that over one-third of all companies will be using public infrastructure as the primary environment for at least one workload by 2018.

One final report, the 2017 Thales Data Threat Report, finds that 93 percent of enterprises will use sensitive data in advanced technology environments this year (defined as cloud, SaaS, big data, IoT and container). However, that same report found that 63 percent believe their organizations are deploying these technologies ahead of having appropriate data security solutions in place.

Whether making the move now or getting ready to deploy additional cloud applications in the future, secure cloud deployment is essential for any business in the modern age. With malware such as ransomware costing businesses over $1 billion in 2016, and two-thirds of large businesses having suffered a data breach in the same time, the cost of neglecting security could be quite substantial.

Making the Move Securely

How to Move to the Cloud Securely

Moving sensitive data from one place to another will always inherently carry some form of risk. If you’re transferring data over to a cloud service provider (CSP) for applications, you’ll want to pay particular attention that any uploads or API used are secured through SSL or similar encryption processes, such as encryption gateway products. If you’re planning on using infrastructure as a service (Iaas) such as collocation and virtualization, the protocol is essentially the same, albeit on a larger scale.

Those looking to make a move toward cloud infrastructure most securely should:

  • Ask how data will be migrated. Will the CSP be moving data via a virtual private network (VPN) connection between data center and virtual machines (VM) in the cloud, or will your company be managing key pairs while data is transferred via SSH.
  • Ask what security measures the CSP employs. How is risk mitigated and managed? Does the provider have an accountable security officer or security groups with which you can engage? What types of onsite security as well as offsite are employed? How often are backups of all data made? What disaster recovery measures exist for your data? The answers to these questions will help you determine which provider has the security features you need most.
  • Make sure they are HIPAA/PCI-DSS Compliant. If you work in healthcare or deal with online payments, your business needs to abide by either the Health Insurance Portability and Accountability Act (HIPAA) or the Payment Card Industry Data Security Standard (PCI DSS) and sometimes both. In the event that your CSP suffers a breach or mishandles your data, you are the one responsible for telling your customers. Ask if they have independent audits to ensure they’re protecting data properly, and go through the checklist to make sure they’ll be able to pass a HIPAA or PCI DSS audit.
  • Understand the service level agreement (SLA). In the event that a disaster or breach does in fact occur, the SLA is what dictates who is responsible for what, and it what amount of time. For example, if your customer’s data is compromised, you are legally required to respond within a timely manner–but if your SLA dictates that the CSP has 30 days to inform you of a breach, and they wait until day 28, you will have little time to prepare your PR and notify affected individuals.

Most of all: shop around. This cannot be stressed enough. Not all service providers are created equal and not all services offered are either. You’ll want to ensure that you know who owns the data once it’s moved, who can see it, where it’s stored geographically, and what happens if you decide you don’t want to use them as a service provider anymore. Weigh your options and make the most educated decision.

Staying Secure and Agile

The world, and the technology in it, is constantly changing. Proof of this can be found in the reason for your move to, or even the rise of, the cloud in the first place. The only way a CEO or CISO (or anybody in the C-Suite, really) can keep up on a secure cloud is to stay agile and informed. This lack of agility and knowledge is what causes security gaps with people, processes, and technologies that can be bridged by:

  • Getting (or becoming) an actively learning CISO. Many of the problems with security in businesses is a result of not knowing. By the time that cybersecurity professionals learn and pick up something new, it usually means that they are facing and identify a new threat in their field. Don’t wait for that information to get to you secondhand. NetworkWorld recommends you identify or become the CISO that “invests in appropriate hands-on security education up front,” while “pursuing cloud security training with gusto.”
  • Emphasize security as a multi-departmental collaboration. Technology and cloud computing are not confined to IT anymore. Gartner’s recent findings indicate that in 2017, CMOs will be spending more on technology that CIOs–which means that everything we know about security as “the norm” goes out the window. You’ll want to approach cloud security as a blank slate, and look at every new challenge with an open mind.
  • Educate your employees. Since the cloud is being used in more departments, that means that more employees need to be educated on security. Safeguarding against cyber attacks nowadays requires that all employees understand the risks of a breach, know and follow your security policy, and have up-to-date software and secure passwords. Shadow IT, for example, was a real problem in 2016 and will probably be an even bigger in 2017. Don’t fall victim due to a lack of information.
  • Keep your most sensitive information out of the cloud. Last but not least, make sure you’re not storing your most sensitive data in the cloud. While the cloud is a pretty secure place if all of the proper protocols are followed, there is no such thing as a completely secure cloud. Anything that you truly can’t afford to lose–that you would be out of business if compromised–should not go in the cloud.

The Block, The Edge, and The Future Ahead

This understanding and security of cloud infrastructure and the IoT is imperative to businesses and the public alike. Cities are now adopting everything from smart traffic lights to smart trash cans, and the smart car itself is purported to produce so much data that it might revolutionize the cloud by ushering in edge computing as the norm. The blockchain is another technology that promises to change the cloud in the future.

The point is that the cloud is not only a major disruption today, but will also be tomorrow, and the day after that. The new norm for IT departments and CISOs is adaptation to change. Keeping an eye on the technological data landscape will be imperative for those who want to stay in-the-know, and, like the move to the cloud, it will be better to know how to interact with these new technologies correctly and securely than not to interact with them at all.

The secure move to the cloud represents the first in a long line of steps towards agile and effective business solutions and infrastructure. Make sure you’re starting off on the right foot.

By Andrew Heikklia

Andrew Heikklia

Andrew Heikkila is a writer, artist, and business owner from the Pacific Northwest. Because technology has become the cornerstone of modern human existence, Andy finds himself writing about it often, usually in relation to the IoT, cybersecurity, the blockchain, or just good ol’ business integration.

Andy's writing contributions can also be seen on TechCrunch, Business 2 Community and Datafloq.


Avoiding Obsolescence In The Cloud

Avoiding Obsolescence In The Cloud

The Cloud I was amused to discover this week that Microsoft aren’t supporting Internet Explorer 8 or 9 – with ...
Driving Transformation? It is possible to predict the future.

Driving Transformation? It is possible to predict the future.

Driving Transformation Previously, I wrote about the criticality of defining the Vision for your transformation - what is your real objective, how ...
Death of Traditional Enterprise Storage

Death of Traditional Enterprise Storage

Traditional Enterprise Storage Back in 2003, Chris Pinkham and Benjamin Black, two engineers working for Amazon.com, proposed a dramatic overhaul ...
State of the Cloud Report In 2017

State of the Cloud Report In 2017

Cloud Report 2017 As the definitive guide to the biggest trends in the cloud industry, this year’s “State of the ...
Identity and Access Management: Advancing to Meet the Changing Needs of Passwords and Governance

Identity and Access Management: Advancing to Meet the Changing Needs of Passwords and Governance

Identity and Access Management The identity and access management market continues to grow in a wide variety of industries of ...
How Blockchain Has Unexpectedly Improved Big Data Integrity

How Blockchain Has Unexpectedly Improved Big Data Integrity

Big Data Integrity Blockchain technology was developed to improve the integrity of bitcoin. However, as bitcoin became more popular, its ...


Rackspace Extends Managed Security to Google Cloud Platform

Rackspace Extends Managed Security to Google Cloud Platform

SAN ANTONIO, March 21, 2018 (GLOBE NEWSWIRE) -- Rackspace® announced today that Managed Security and Compliance Assistance for Google Cloud Platform (GCP) is now available for preview to new and existing customers that use Rackspace Managed Services for GCP ...
Google classroom

Helping G Suite customers stay secure with new proactive phishing protections and management controls

Security tools are only effective at stopping threats if they are deployed and managed at scale, but getting everyone in your organization to adopt these tools ultimately hinges on how easy they are to use ...
Gartner Says Worldwide IoT Security Spending Will Reach $1.5 Billion in 2018

Gartner Says Worldwide IoT Security Spending Will Reach $1.5 Billion in 2018

By 2021, Regulatory Compliance Will Become the Prime Influencer for IoT Security Uptake Internet of Things (IoT)-based attacks are already a reality. A recent CEB, now Gartner, survey found that nearly 20 percent of organizations ...
BMW raises R&D spending for electric, autonomous cars

BMW raises R&D spending for electric, autonomous cars

Munich (Reuters) - German carmaker BMW (BMWG.DE) will increase research and development (R&D) spending to an all-time high of up to 7 billion euros ($8.6 billion) this year as part of efforts to bring 25 ...
Providers Benchmark Report: Cloud Spectator Releases Annual Top 10 Cloud IaaS

Providers Benchmark Report: Cloud Spectator Releases Annual Top 10 Cloud IaaS

Significant differences persist with price-performance across Public Clouds BOSTON, MA, March 20, 2018 — Cloud Spectator, the industry’s leading benchmarking and cloud consulting firm, today released its 2018 Top 10 Cloud IaaS Price-Performance Benchmark Report ...
Where's Zuck? Facebook CEO silent as data harvesting scandal unfolds

Where’s Zuck? Facebook CEO silent as data harvesting scandal unfolds

Amid calls for investigation and a #DeleteFacebook campaign, company releases an official statement but its figurehead keeps quiet The chief executive of Facebook, Mark Zuckerberg, has remained silent over the more than 48 hours since ...