The bi-directional cloud highway

1 September 2019 Editor's Choice, Information Security, Integrated Solutions

The development of the cloud over the last 15 years is one of the most significant convergences of computing and communications technologies in history. It provides unprecedented agility and scalability for organisations, immediate access to information and transactions for individuals and has transformed our global economy similar to smartphones and IoT devices.

It has also resulted in one of the most unique technology transitions in history. Traditionally, whenever a new technology arrives – whether the steam engine or the Internet – there has been an orderly and often rapid transition from old to new tools. The advent of the cloud looked to be on a similar trajectory based on the initial assumption that it would be the best choice for all IT infrastructure.

However, according to a recent IHS Markit survey sponsored by Fortinet, infrastructure, applications, and data are continually moving back and forth between on-premise physical networks to private/public cloud infrastructures as organisations try to figure out where and how it is most appropriate for them to use the cloud.

Multi-cloud is here to stay

Of the 350 companies surveyed, 74% had moved an application into the public cloud, and then for a variety of reasons and circumstances, decided to move it back into their on-premises or private cloud infrastructure. This doesn’t mean they reversed all of their cloud deployments, just that they are encountering cases for bi-directional movement.

For example, 40% of respondents noted that, in some cases, the cloud deployments they moved back into their infrastructure were ‘planned temporary’ deployments. This could be due to a variety of factors, such as the need to set up a temporary infrastructure during an IT transition associated with a merger or acquisition. However, there are many other issues at play that could also be responsible, including concerns about security, the need to manage costs, poor performance in the cloud, shifting regulations, development of new applications, and changes in underlying technologies.

Whatever your plans, plan for change

One crucial reality of the forces that drive these changes is that they are in constant flux, making the dynamic multi-cloud the new environment that many companies now need to live in. Companies deploying applications and other resources into the cloud, and the technology providers that help them with infrastructure, management, and security, now need to consider this new reality as a baseline condition and build products and services with bi-directional movement and co-existence in mind.

To truly take advantage of the best of the cloud, organisations need to make sure the tools and technologies they use are offer consistent capabilities, the ability to automate operations and good visibility across environments, meaning they should operate across a variety of public cloud environments, as well as in private clouds and on-premises physical networks. While moving applications and DevOps services between cloud environments is seamless and straightforward, security can be more of a challenge.

When cloud deployments keep shifting, who owns security?

The first challenge is identifying who owns security in the event of a malicious cyber incident. When asked about the factors driving them to move applications back into their infrastructure, the top two responses – each selected by 52% of respondents – were performance and security.

While performance is likely to improve over time as practices building applications in the cloud improve and organisations better establish expectations, security is a more vexing problem because many companies don't have a good handle on who is responsible for what. In a best-case scenario, where it is clear who should be responsible (such as the existence of a vulnerability in the virtualisation/cloud platform), only about half of respondents were able to pin the root cause where it truly belongs: on the company who built or implemented the vulnerable technology.

Of course, this is a cynical response built on long experience working with flawed technology riddled with vulnerabilities for which IT and security teams accept responsibility, and in most cases, where they have made the decision to go with these technologies. Conversely, a high percentage of respondents incorrectly held their cloud provider responsible for higher layer threats (like APTs) affecting vulnerable systems they have chosen to deploy where in fact the organisation itself is responsible.

While security responsibilities can be generally divided between the underlying cloud infrastructure (which needs to be secured by the cloud provider) and the software, data, and applications running on top of that infrastructure (which are the responsibility of the consumer), those divisions aren’t always so neatly divided – especially as we step into PaaS and FaaS.

The best rule of thumb is that one must consult with best practices pertaining to every cloud service that the company is consuming. And expect the cloud provider only to provide an isolated, available work environment to run these services. The cloud is a shared infrastructure, and when it comes to security events, it’s important to distinguish between the organisation’s responsibility to the cloud provider in order to effectively address risk.

The other challenge is that security tools, functions, policies, and protocols don’t operate similarly between different public cloud platforms, private clouds, and physical infrastructures. While moving an application or service from one environment to the next may be straightforward, many security solutions require a significant amount of IT resources to redeploy and validate a security solution, especially when workflows, applications, and data need to be inspected and secured as they flow between different environments.

Resolving this issue can be complicated. It starts with standardising with a single security vendor that has solutions that run consistently across the broadest possible range of public cloud, private cloud, and physical environments. Next, these tools need to run natively in the various public cloud environments to maximise effectiveness, while seamlessly translating policies, functions, and protocols between different environments using some form of cloud objects abstraction layer. These will yield the best results as existing security operational models remain applicable across a diverse and dynamic environment.

Conclusion

The transition to the cloud has been anything but an orderly process. However, for the foreseeable future, applications and services are going to constantly be moving back and forth between different environments until organisations find the combination of public, private, and on-premises solutions that work best for them. And even then, there will continue to be plenty of reasons why applications, infrastructure, and other resources will need to be moved.

In this new dynamic environment, security cannot afford to be something bolted on after the fact or implementing multiple diverse tools. This approach inevitably leads to issues like vendor sprawl, deployment delays, and security gaps due to things like configuration incompatibilities and differences in functionality and policy enforcement between security solutions deployed in different environments.

As a result, adopting an integrated security strategy that can be used using a streamlined security management operational model, see and manage security devices and policies across the entire distributed network, that run natively in different cloud environments while maintaining consistent enforcement, and that can adapt seamlessly as network continues to evolve, are table stakes in today's new digital economy.




Share this article:
Share via emailShare via LinkedInPrint this page



Further reading:

SA’s strained, loadshedding-prone grid faces cyberthreats
Power Management Information Security
South Africa’s energy sector, already battered by decades of underinvestment and loadshedding, faces another escalating crisis; a wave of cyberthreats that could turn disruptions into catastrophic failures. Attacks are already happening internationally.

Read more...
Almost 50% of companies choose to pay the ransom
News & Events Information Security
This year’s Sophos State of Ransomware 2025 report found that nearly 50% of companies paid the ransom to get their data back, the second-highest rate of ransom payment for ransom demands in six years.

Read more...
Winners of the 2025 Southern Africa OSPAs
Editor's Choice
The winners of the 2025 Southern Africa Outstanding Security Performance Awards (OSPAs) were revealed on Wednesday, 4th June, at Securex South Africa. Winners from all categories (except the Lifetime Achievement) will be featured in the second Global OSPAs set to take place in 2026.

Read more...
Deepfakes and digital trust
Editor's Choice
By securing the video right from the specific camera that captured it, there is no need to prove the chain of custody for the video, you can verify the authenticity at every step.

Read more...
A new generational framework
Editor's Choice Training & Education
Beyond Generation X, and Millennials, Dr Chris Blair discusses the seven decades of technological evolution and the generations they defined, from the 1960’s Mainframe Cohort, to the 2020’s AI Navigators.

Read more...
Back-up securely and restore in seconds
Betatrac Telematic Solutions Editor's Choice Information Security Infrastructure
Betatrac has a solution that enables companies to back-up up to 8 TB of data onto a device and restore it in 30 seconds in an emergency, called Rapid Access Data Recovery (RADR).

Read more...
Key design considerations for a control room
Leaderware Editor's Choice Surveillance Training & Education
If you are designing or upgrading a control room, or even reviewing or auditing an existing control room, there are a number of design factors that one would need to consider.

Read more...
Smart cities and the role of video security
Surveillance Integrated Solutions
As cities around the world continue to embrace smart technology, including IoT that not only connects to people, but also the surrounding activity, the integration of advanced video security systems is crucial to ensure safety and efficiency in environments.

Read more...
The benefits of offsite control rooms
Astrosec Surveillance Integrated Solutions
As the security landscape grows more intricate, control rooms – the crucial hub of security operations – need to adapt. With escalating costs, mounting threats, and a heightened demand for immediate responses, many organisations are reassessing the operations of their control rooms.

Read more...
CCTV control room operator job description
Leaderware Editor's Choice Surveillance Training & Education
Control room operators are still critical components of security operations and will remain so for the foreseeable future, despite the advances of AI, which serves as a vital enhancement to the human operator.

Read more...










While every effort has been made to ensure the accuracy of the information contained herein, the publisher and its agents cannot be held responsible for any errors contained, or any loss incurred as a result. Articles published do not necessarily reflect the views of the publishers. The editor reserves the right to alter or cut copy. Articles submitted are deemed to have been cleared for publication. Advertisements and company contact details are published as provided by the advertiser. Technews Publishing (Pty) Ltd cannot be held responsible for the accuracy or veracity of supplied material.




© Technews Publishing (Pty) Ltd. | All Rights Reserved.