Welcome!

@CloudExpo Authors: Liz McMillan, Roger Strukhoff, Pat Romanski, Zakia Bouachraoui, Dana Gardner

Related Topics: @CloudExpo, Microservices Expo, Agile Computing, Cloud Security

@CloudExpo: Blog Post

Are Security Concerns Over Cloud FUD or for Real?

How to do security benchmarking of vendors before evaluating them on cost

Popular British security blogger Graham Cluley made a pretty interesting statement recently. In a chat with Computing.com, Cluley said that businesses that are flocking to the cloud in herds today should stop and replace all instances of the word "cloud" with "somebody else's computer" to really understand the implications of their actions. I call it interesting because while I am personally an advocate of cloud computing, Cluley's statement drives home the point about the consequences a business might face if they do not perform due diligence.

The security concerns surrounding the cloud are not FUD. They are real and have to be taken seriously. Without a proper cloud strategy in place, businesses that rely completely on a third-party service provider run the risk of losing confidential and valuable business data. According to GigaOm Research, 75% of businesses reported to have implemented some form of cloud at their work place. Given this huge shift towards the cloud, it is imperative that these businesses are fully aware of the potential security concerns in order to be prepared with contingency plans.

In my experience, the reason this is such a hotly-debated topic is because most businesses see cloud migration solely as a cost-saving exercise. The various alternative cloud service providers are evaluated solely on the basis of cost with little to no benchmarking done on other aspects, including security. One of my clients told me that the reason they did not bother to do this was because the said service provider also owned the accounts of his competitors; which means if they go down, the others go down as well which will somehow retain his businesses' share in the market. Regardless of what happens to your competitors, potentially losing your own business data is no joke.

That is why it is necessary to critically examine your alternatives while picking a service provider. I personally go through two levels of security benchmarking:

First Level - Hygiene Benchmarking
There are some things that a service provider must provide. For instance, they need to offer user authorization controls, data transmission security layers, disaster recovery, etc. These are the basic minimum that any service provider must deliver - they do not deserve your business if they cannot offer you these features. For the record, if cost was your only benchmarking parameter, a number of providers who get weeded out in this level might be in the running for your business.

Second Level - Security Features Benchmarking
The objective of the first level is to mainly remove providers that do not have even the minimum security features that cloud computing require. The second level is where the actual benchmarking of features happen. Here, I compare the various security features that independent vendors offer. Again, I divide the features offered into two segments:

A. Mandatory Features: Some features, though not evaluated in the hygiene benchmarking, are deemed mandatory. For instance, one of the key features that cloud vendors ought to provide is data backups. Service partners for products like NetSuite provide multiple levels of back up features like offsite backup, hot backups besides redundant systems which make data protection as fool-proof as possible.

B. Optional Features: As the name suggests, these are features that do not have to be there. But if these features can help you enhance your product or help improve efficiency, then they are a bonus addition. An example of such a feature would be a security breach report.

A benchmarking report done through the process detailed above will give you an idea of how the various providers differ on the aspect of security. This is basically the first step in evaluating alternatives. Evaluating the vendors on the basis of other aspects like cost and customer support are secondary are to be done only after these products have passed the security evaluation.

Data is crucial for any business. By evaluating vendors simply on price, businesses often fail to acknowledge the importance of data to the success of a business. With the proliferation of cloud based businesses it is high time, IT decision makers realize this and evaluate the security of their business data.

More Stories By Harry Trott

Harry Trott is an IT consultant from Perth, WA. He is currently working on a long term project in Bangalore, India. Harry has over 7 years of work experience on cloud and networking based projects. He is also working on a SaaS based startup which is currently in stealth mode.

CloudEXPO Stories
IT professionals are also embracing the reality of Serverless architectures, which are critical to developing and operating real-time applications and services. Serverless is particularly important as enterprises of all sizes develop and deploy Internet of Things (IoT) initiatives. Serverless and Kubernetes are great examples of continuous, rapid pace of change in enterprise IT. They also raise a number of critical issues and questions about employee training, development processes, and operational metrics. There's a real need for serious conversations about Serverless and Kubernetes among the people who are doing this work and managing it. So we are very pleased today to announce the ServerlessSUMMIT at CloudEXPO.
AI and machine learning disruption for Enterprises started happening in the areas such as IT operations management (ITOPs) and Cloud management and SaaS apps. In 2019 CIOs will see disruptive solutions for Cloud & Devops, AI/ML driven IT Ops and Cloud Ops. Customers want AI-driven multi-cloud operations for monitoring, detection, prevention of disruptions. Disruptions cause revenue loss, unhappy users, impacts brand reputation etc.
This month @nodexl announced that ServerlessSUMMIT & DevOpsSUMMIT own the world's top three most influential Kubernetes domains which are more influential than LinkedIn, Twitter, YouTube, Medium, Infoworld and Microsoft combined. NodeXL is a template for Microsoft® Excel® (2007, 2010, 2013 and 2016) on Windows (XP, Vista, 7, 8, 10) that lets you enter a network edge list into a workbook, click a button, see a network graph, and get a detailed summary report, all in the familiar environment of the Excel® spreadsheet application. A collection of network maps and reports created with NodeXL can be seen in the NodeXL Graph Gallery, an archive of data sets uploaded by the NodeXL user community.
"There is a huge interest in Kubernetes. People are now starting to use Kubernetes and implement it," stated Sebastian Scheele, co-founder of Loodse, in this SYS-CON.tv interview at DevOps at 19th Cloud Expo, held November 1-3, 2016, at the Santa Clara Convention Center in Santa Clara, CA.
Is advanced scheduling in Kubernetes achievable?Yes, however, how do you properly accommodate every real-life scenario that a Kubernetes user might encounter? How do you leverage advanced scheduling techniques to shape and describe each scenario in easy-to-use rules and configurations? In his session at @DevOpsSummit at 21st Cloud Expo, Oleg Chunikhin, CTO at Kublr, answered these questions and demonstrated techniques for implementing advanced scheduling. For example, using spot instances and cost-effective resources on AWS, coupled with the ability to deliver a minimum set of functionalities that cover the majority of needs – without configuration complexity.