Welcome!

Containers Expo Blog Authors: Liz McMillan, Derek Weeks, Mark Herring, Mehdi Daoudi, Kevin Benedict

Related Topics: Containers Expo Blog, @CloudExpo, Cloud Security

Containers Expo Blog: Article

A New Approach to Cloud Computing Security

Arguably the greatest barrier to businesses taking full advantage of cloud computing is the issue of security

Security Pavillion at Cloud Expo

Arguably the greatest barrier to businesses taking full advantage of cloud computing is the issue of security. Recent high-profile breaches of the cloud (the attack on Twitter being perhaps the most publicized) have only served to heighten concerns.

It's true; the potential consequences of a breach of cloud security are catastrophic, and this knowledge has served to make the debate rage even more fiercely. A cloud security issue within an organization has the potential to be a major business crisis, and against a backdrop of heightened public awareness of data loss and privacy issues such as ID theft, it's understandable.

But there's no denying that cloud computing is gaining momentum and will continue to become more and more mainstream. This year, for example, the UK government announced that it would be developing a cloud infrastructure (the ‘G-Cloud'), and the offer of flexible, low-cost and easily scalable IT means that many businesses are relying more and more heavily on cloud-based applications, storage and security.

The result is that the industry must get to grips with the security concerns. Fast.

Concern...or Confusion?
One of the key questions is whether or not security concerns are justified. Is it the case that unnecessary fears are preventing organizations from getting the most from the wealth of benefits that cloud-based services can offer?

It's a bit of both in my opinion. First, there's certainly a lot of confusion. A recent report by Gartner [1] suggests that most organizations don't fully understand their business' existing security provision and therefore cannot accurately pinpoint exactly where the gaps are when it comes to working with a cloud-based provider.

Furthermore, a lot of the confusion - and concern - arises from the (largely incorrect) assumption that cloud security is a complex issue. Security of the cloud is not necessarily as complex as some would have you imagine.

Detached Data
One of the key ways in which cloud computing differs to other IT services is that the relationship between cloud service provider and client is detached, often with significant geographical separation between parties. In addition, the ‘on-demand' nature of the relationship means that the client has very little influence on the operational practices of the provider. The cloud business model has moved far away from nurturing long-term partnerships, focusing instead on ease of initiation (and termination!) of relationships.

Combine this with the often large numbers of potential cloud providers with whom an organization may have a relationship at any one time and the greater level of data sharing inherent in many cloud services, and the issues become clear.

One of the key issues that arises from a security perspective as a result is the greater transfer of data in and out of a company's own IT infrastructure. Cloud computing differs from other similar IT services by moving data further from its original owner. As data storage and email outsourcing become two of the most popular modern cloud-based services, security fears over the transfer of data, and later, over who has access to this data, remain significant concerns.

However the numbers of cloud providers involved and the level of sharing that is inherent with many cloud-based services may well prove to make the task of securing the cloud itself an almost impossible one.

The key problem is that by the time data has reached the cloud, it's normally too late. As soon as a company's data leaves the relatively safe confines of its own IT infrastructure, the potential is there for it to get into the wrong hands. For this reason, it's at the boundary between the organization and its external environment that security has to be the key priority for those looking to use cloud-based services.

Confidence in the Cloud
With all this talk of risk and security, it's easy to forget the rewards of cloud services. Cloud computing is responsible for offering some of the greatest efficiencies within IT for decades. Furthermore, cloud computing forms the basis for a range of cutting-edge communication tools that not only provide new ways to engage with customers and colleagues, but demonstrate that your business is agile and forward-thinking.

While security is an important consideration, let's not forget that security must essentially be about enablement. It's no good having security that operates by preventing access, clamping down etc.

Security in this day and age must be about giving businesses the confidence to take advantage of new technology. This in turn, will lead to better communication, connectivity and innovation.

For Your Eyes Only
The key premise on which the foundations for safe and effective use of the cloud is this: That there will always be data that is so sensitive that it simply cannot be allowed to leave the confines of your business.

In the case of highly sensitive material, the best course of action in most instances is to prevent it from leaving your organization in the first place. (It is classic psychology that sensitive or confidential material is considered less so the further away it gets from the original creator.) What is therefore needed is highly sophisticated automated checking of outbound data to ensure that data that shouldn't leave the organization does indeed remain there.

For this reason, the key priority for improving the security of cloud computing lies not in the security of the cloud itself but in the routes in to and out of the cloud. Consider the analogy of tangible security risks to homes and business premises; it's the access points that are always the weak point. Therefore it's vital to ensure the ‘windows' and ‘doors' of cloud computing are made as secure as possible. Addressing the security of your company's specific cloud entry and exit points is the best - and simplest - way to get a grip on the potential issues involved to enable businesses to take advantage of all that the cloud has to offer.

Inbound from the Cloud
Many believe that cloud-based email is the only way to attain the best levels of efficiency and cost reduction. Indeed, although cloud-based email offerings can be compelling, it isn't the only way of doing things. In fact, when you consider the often quite significant issues regarding trust of a third-party cloud provider, cloud-based email can lose its shine. Allowing a third party to have unfettered access to all your incoming mail has major security implications, and requires complete trust and reliance on the organization providing the service.

Advances in appliance-based technology now mean that non-cloud based email security applications are as effective at reducing spam and malware with similar efficiencies to cloud-based services, but without the risk of handing all email data to a third party.

Keeping It Simple
Security of the cloud does not need to cause concern, nor should it be a barrier to using cloud services. Businesses simply need to ensure they have fully understood the risks their particular organization faces through using cloud-based services, and ensure that their security will enable them to use cloud services with confidence.

Collaboration and openness (both key cloud computing premises) are great attributes for many types of technology, and security nowadays must shift to focus on enablement rather than prevention. But collaboration and sharing is one thing when it's just you and your home PC and you are taking individual responsibility for the potential consequences of your actions. The same is not true for a company IT system where this way of working and engaging with customers and suppliers, though often commercially advantageous, carries far greater risks and therefore needs a level of corporate governance.

While it's easy to assume, when looking to adopt cloud-based services, that a third party may be a safer pair of hands, the reality is that there are no guarantees, and even if there is someone else to blame, the potential damage to your business could be catastrophic The only way to ensure your data is not compromised by the cloud is to control what is going to and from it in the first place, and make sure your control over what goes to and from the cloud is watertight.

More Stories By Alf Pilgrim

Alf Pilgrim is CTO of content security company, Clearswift. He joined Clearswift in 2006 as vice president, engineering where he is responsible for the product portfolio and technology development strategy and leads Clearswift’s drive to deliver policy-based security solutions. He was previously chief technology officer and director of product development and support at Northgate Information Solutions plc, the premier supplier of software and services to the UK public sector and human resource markets. He was part of the team that oversaw a 400% increase in shareholder value and corporate entry into the FTSE250. Alf holds a Ph.D. from the University of Leeds, is a chartered engineer, chartered IT professional and a member of the British Computer Society.

Comments (1) View Comments

Share your thoughts on this story.

Add your comment
You must be signed in to add a comment. Sign-in | Register

In accordance with our Comment Policy, we encourage comments that are on topic, relevant and to-the-point. We will remove comments that include profanity, personal attacks, racial slurs, threats of violence, or other inappropriate material that violates our Terms and Conditions, and will block users who make repeated violations. We ask all readers to expect diversity of opinion and to treat one another with dignity and respect.


Most Recent Comments
rlebherz 11/20/09 03:42:00 PM EST

Alf,

Interesting article. I think the Cloud services and cloud infrastructure lines are a bit blurred, but I agree with most of what you are saying.

Dont underestimate the SLA's role in accountability. For companies that have dynamic requirements and no down time can be afforded, make sure you have very tight SLAs. For example, OpSource provides a 100% SLA in the cloud and 100%SLA around production application environments. Now 100% is ideally perfect, it comes down to accountability, you put you faith in us, we should do what we say we will do. And if something happens, you should be paid back. We also have 24x7 phone support where you can actually talk to a real person and you get account managers when you sign up who can help you work through business related issues. Imaging that, people in charge of the relationship and accountability.

Also, A New Approach To Cloud Security Is Already Her! From a Cloud Infrastructure and operations perspective
Check out OpSource.net and OpSourcecloud.net

If you want to move everything need for delivering your production environments into the cloud check out OpSource.net

If you want to move your infrastructure into the clouds, check out OpSourcecloud.net

Also, RLE01 will get you 20% off.

@ThingsExpo Stories
Digital Transformation (DX) is not a "one-size-fits all" strategy. Each organization needs to develop its own unique, long-term DX plan. It must do so by realizing that we now live in a data-driven age, and that technologies such as Cloud Computing, Big Data, the IoT, Cognitive Computing, and Blockchain are only tools. In her general session at 21st Cloud Expo, Rebecca Wanta explained how the strategy must focus on DX and include a commitment from top management to create great IT jobs, monitor ...
The 22nd International Cloud Expo | 1st DXWorld Expo has announced that its Call for Papers is open. Cloud Expo | DXWorld Expo, to be held June 5-7, 2018, at the Javits Center in New York, NY, brings together Cloud Computing, Digital Transformation, Big Data, Internet of Things, DevOps, Machine Learning and WebRTC to one location. With cloud computing driving a higher percentage of enterprise IT budgets every year, it becomes increasingly important to plant your flag in this fast-expanding busin...
"Digital transformation - what we knew about it in the past has been redefined. Automation is going to play such a huge role in that because the culture, the technology, and the business operations are being shifted now," stated Brian Boeggeman, VP of Alliances & Partnerships at Ayehu, in this SYS-CON.tv interview at 21st Cloud Expo, held Oct 31 – Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA.
In his session at 21st Cloud Expo, Raju Shreewastava, founder of Big Data Trunk, provided a fun and simple way to introduce Machine Leaning to anyone and everyone. He solved a machine learning problem and demonstrated an easy way to be able to do machine learning without even coding. Raju Shreewastava is the founder of Big Data Trunk (www.BigDataTrunk.com), a Big Data Training and consulting firm with offices in the United States. He previously led the data warehouse/business intelligence and B...
A strange thing is happening along the way to the Internet of Things, namely far too many devices to work with and manage. It has become clear that we'll need much higher efficiency user experiences that can allow us to more easily and scalably work with the thousands of devices that will soon be in each of our lives. Enter the conversational interface revolution, combining bots we can literally talk with, gesture to, and even direct with our thoughts, with embedded artificial intelligence, whic...
Cloud Expo | DXWorld Expo have announced the conference tracks for Cloud Expo 2018. Cloud Expo will be held June 5-7, 2018, at the Javits Center in New York City, and November 6-8, 2018, at the Santa Clara Convention Center, Santa Clara, CA. Digital Transformation (DX) is a major focus with the introduction of DX Expo within the program. Successful transformation requires a laser focus on being data-driven and on using all the tools available that enable transformation if they plan to survive ov...
Product connectivity goes hand and hand these days with increased use of personal data. New IoT devices are becoming more personalized than ever before. In his session at 22nd Cloud Expo | DXWorld Expo, Nicolas Fierro, CEO of MIMIR Blockchain Solutions, will discuss how in order to protect your data and privacy, IoT applications need to embrace Blockchain technology for a new level of product security never before seen - or needed.
Smart cities have the potential to change our lives at so many levels for citizens: less pollution, reduced parking obstacles, better health, education and more energy savings. Real-time data streaming and the Internet of Things (IoT) possess the power to turn this vision into a reality. However, most organizations today are building their data infrastructure to focus solely on addressing immediate business needs vs. a platform capable of quickly adapting emerging technologies to address future ...
With tough new regulations coming to Europe on data privacy in May 2018, Calligo will explain why in reality the effect is global and transforms how you consider critical data. EU GDPR fundamentally rewrites the rules for cloud, Big Data and IoT. In his session at 21st Cloud Expo, Adam Ryan, Vice President and General Manager EMEA at Calligo, examined the regulations and provided insight on how it affects technology, challenges the established rules and will usher in new levels of diligence arou...
SYS-CON Events announced today that Evatronix will exhibit at SYS-CON's 21st International Cloud Expo®, which will take place on Oct 31 – Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA. Evatronix SA offers comprehensive solutions in the design and implementation of electronic systems, in CAD / CAM deployment, and also is a designer and manufacturer of advanced 3D scanners for professional applications.
SYS-CON Events announced today that Synametrics Technologies will exhibit at SYS-CON's 22nd International Cloud Expo®, which will take place on June 5-7, 2018, at the Javits Center in New York, NY. Synametrics Technologies is a privately held company based in Plainsboro, New Jersey that has been providing solutions for the developer community since 1997. Based on the success of its initial product offerings such as WinSQL, Xeams, SynaMan and Syncrify, Synametrics continues to create and hone inn...
To get the most out of their data, successful companies are not focusing on queries and data lakes, they are actively integrating analytics into their operations with a data-first application development approach. Real-time adjustments to improve revenues, reduce costs, or mitigate risk rely on applications that minimize latency on a variety of data sources. In his session at @BigDataExpo, Jack Norris, Senior Vice President, Data and Applications at MapR Technologies, reviewed best practices to ...
"Evatronix provides design services to companies that need to integrate the IoT technology in their products but they don't necessarily have the expertise, knowledge and design team to do so," explained Adam Morawiec, VP of Business Development at Evatronix, in this SYS-CON.tv interview at @ThingsExpo, held Oct 31 – Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA.
In his Opening Keynote at 21st Cloud Expo, John Considine, General Manager of IBM Cloud Infrastructure, led attendees through the exciting evolution of the cloud. He looked at this major disruption from the perspective of technology, business models, and what this means for enterprises of all sizes. John Considine is General Manager of Cloud Infrastructure Services at IBM. In that role he is responsible for leading IBM’s public cloud infrastructure including strategy, development, and offering m...
Nordstrom is transforming the way that they do business and the cloud is the key to enabling speed and hyper personalized customer experiences. In his session at 21st Cloud Expo, Ken Schow, VP of Engineering at Nordstrom, discussed some of the key learnings and common pitfalls of large enterprises moving to the cloud. This includes strategies around choosing a cloud provider(s), architecture, and lessons learned. In addition, he covered some of the best practices for structured team migration an...
No hype cycles or predictions of a gazillion things here. IoT is here. You get it. You know your business and have great ideas for a business transformation strategy. What comes next? Time to make it happen. In his session at @ThingsExpo, Jay Mason, an Associate Partner of Analytics, IoT & Cybersecurity at M&S Consulting, presented a step-by-step plan to develop your technology implementation strategy. He also discussed the evaluation of communication standards and IoT messaging protocols, data...
Recently, REAN Cloud built a digital concierge for a North Carolina hospital that had observed that most patient call button questions were repetitive. In addition, the paper-based process used to measure patient health metrics was laborious, not in real-time and sometimes error-prone. In their session at 21st Cloud Expo, Sean Finnerty, Executive Director, Practice Lead, Health Care & Life Science at REAN Cloud, and Dr. S.P.T. Krishnan, Principal Architect at REAN Cloud, discussed how they built...
22nd International Cloud Expo, taking place June 5-7, 2018, at the Javits Center in New York City, NY, and co-located with the 1st DXWorld Expo will feature technical sessions from a rock star conference faculty and the leading industry players in the world. Cloud computing is now being embraced by a majority of enterprises of all sizes. Yesterday's debate about public vs. private has transformed into the reality of hybrid cloud: a recent survey shows that 74% of enterprises have a hybrid cloud ...
22nd International Cloud Expo, taking place June 5-7, 2018, at the Javits Center in New York City, NY, and co-located with the 1st DXWorld Expo will feature technical sessions from a rock star conference faculty and the leading industry players in the world. Cloud computing is now being embraced by a majority of enterprises of all sizes. Yesterday's debate about public vs. private has transformed into the reality of hybrid cloud: a recent survey shows that 74% of enterprises have a hybrid cloud ...
DevOps at Cloud Expo – being held June 5-7, 2018, at the Javits Center in New York, NY – announces that its Call for Papers is open. Born out of proven success in agile development, cloud computing, and process automation, DevOps is a macro trend you cannot afford to miss. From showcase success stories from early adopters and web-scale businesses, DevOps is expanding to organizations of all sizes, including the world's largest enterprises – and delivering real results. Among the proven benefits,...