Cloud has spread like wildfire through the majority of businesses. Its flexibility, scalability and price-point often makes it the natural data storage solution. 

With cloud follows the notion of a ‘hybrid cloud strategy’, and whether the IT manager recognises it or not, the business probably has one. Take for example, a company that is slowly moving applications out of the data centre and chooses SaaS applications where possible – the business may not consider this a ‘formal’ hybrid cloud strategy but, like it or not, it is.

No one person is responsible, but many have contributed. Over the years, with each additional SaaS service purchased, each new application that was brought in and hosted with a public cloud provider, and each new upgrade to the existing onsite data centre, a hybrid cloud ecosystem has developed.

Once implemented it is easy for cloud to spread throughout the business. Every month new services are added and old applications are taken offline, and so a hybrid cloud ecosystem evolves.

The attraction of hybrid cloud may not be something that can be entirely set in stone in a formal strategy. By its very nature, perhaps it has to be a living, breathing ecosystem, that flexes and changes as new situations arise: perhaps one year a data centre failure means more services than usual are moved to the cloud; or the company’s ERP provider moves to a pure cloud play strategy so the businesses is forced to turn to the SaaS world for its central business applications.

It is not always possible to plan for this change.  With Microsoft Dynamics now being Azure-led, customers may be moving central systems to the cloud earlier than their strategies previously anticipated.

All this being said, it doesn’t mean a strategy doesn’t exist. Rather it just means that maybe the traditional way of deciding on a long term IT strategy doesn’t fit in a world where new providers can launch applications on the fly, or the industry’s largest vendors can change their position regarding onsite or public cloud hosting overnight. 

A hybrid IT strategy is all about being flexible enough to allow for change both internally (i.e. what the business decides to do commercially and operationally) and externally (i.e. what the market dictates and also what technology industry and vendors offer each year).

Previously, vendors may have introduced a newer, shinier box – but it was just a newer, shinier version of the previous box. It didn’t necessitate throwing out the old IT strategy and starting again. Today, an application vendor deciding to only release its updated version as a SaaS product means that a strategy to keep that application in-house for the foreseeable future changes. And perhaps it has a knock-on effect on other business applications – maybe it makes it too costly to keep other applications in-house.

The stakeholders responsible for a hybrid IT strategy have also changed. Shadow IT and the proliferation of cloud services means that the people involved in making a decision about the company’s hybrid IT strategy may be sitting in diverse roles across different departments of the business. They may, for example, have been purchasing their own cloud services for over 10 years and now have a key voice in decisions about future IT strategy of the organisation.

The business landscape of IT has changed dramatically over the last decade. IT strategy is now a top boardroom-level priority with more people taking notice and more people involved in making decisions.

So, the question is, do you have a hybrid IT strategy or has your company sorted it while you weren’t looking?

With the Global Data Protection Regulation (GDPR) on the horizon, businesses that wish to operate in the European Union are having to spend more time than ever thinking about compliance.

Not only does all personally identifiable customer data need to be accounted for – a task that is easier said than done for many organisations – internal processes also have to be updated and employees need to be educated to ensure the compliance deadline of May 25 2018 is met.

Of course, GDPR is just one legislative challenge facing businesses. Financial services firms, for example, have a revamped version of the Markets in Financial Instruments Directive (also known as MiFID II) to respond to, while the UK telco industry is facing the prospect of new legislations being enforced after Brexit.

And as falling foul of industry regulations has the potential to result in massive financial penalties, as well as the threats of reputational damage and a loss of customers, organisations simply can’t afford to be complacent.

However, fear of the complexity of managing compliance in new infrastructure as well as the effort already involved in ensuring existing systems are ready to go, is prompting many businesses to shy away from cloud, despite the many benefits such services offer. Concerns are primarily due to a misconception that cloud platforms, with data held by third parties on shared systems, will be a more difficult undertaking than traditional in-house systems and potentially less secure, but the truth is very different.

Public cloud services can be extremely secure and often can be a more secure option than in-house systems. So, what exactly is behind this misconception and why should businesses be trusting public cloud services with their compliance needs?

Privacy please

On the face of things, it’s easy to see why many people would assume on-premise infrastructure is more secure and easy to manage. In theory, businesses know exactly where their data is being stored and who has access to it, both of which provide comfort for organisations.

They can also design the architecture to suit their own specific needs and preferences, as well as reducing the risk of data loss if a public cloud provider goes out of business. One could argue that such a setup would be particularly appealing to businesses operating in highly regulated industries, such as healthcare and financial services, which need to have greater visibility and control over how their data is managed.

However, firms would be wise to remember that operating their own private cloud places the responsibility of security and compliance squarely on their shoulders. Businesses are at the mercy of the whims of nature and the resilience of their local power grid, potentially leaving them helpless if something goes wrong.

It also leaves them vulnerable to disgruntled employees and internal data theft. Employees may have easy access to confidential data, sometimes with very little to stop them from stealing corporate information simply by pulling a disk from a server and leaving the building with it. Often employees can also connect USB drives which have been used in home systems and may contain malware or viruses. Huge faith is placed in the firewall as an effective means of keeping intruders out, yet backdoors may well exist in the form of legacy and unsecured modem connections, as well as poor access control processes that leave user credentials in place long after the relevant employee has left the company.

So just because infrastructure is in your data centre doesn’t mean it is inherently more secure, resilient or suitable to meet the needs of regulatory compliance than public cloud.

Going public

While some businesses may feel more comfortable knowing their data is being stored within their own walls, data location is only one small aspect of security and compliance.

Along with the provision of innovative new services to enable business growth, it is the job of public cloud providers to protect their customer’s data. A central component of their value proposition, therefore, is the delivery of systems, tools and continuity plans that make their cloud infrastructure safe and secure.

This applies to both virtual and physical means of protection. Corporate data will be stored in a secure facility with multiple layers of physical security that are often not present if businesses opt to run their cloud infrastructure in-house.

And, with competition in the market continuing to increase at a rapid rate, ensuring compliance is not only a valuable competitive advantage for those businesses offering public cloud services, but also essential to gaining customer trust and in turn, loyalty. In this respect, smart cloud providers such as City Cloud are leading the way with a value proposition focused very much around regulatory compliance

Public cloud providers are also likely to carry out software patching on a more regular basis which is essential to manage compliance. Businesses running their own private clouds will generally be slower to patch security gaps, leaving themselves exposed to potential data breaches and compliance holes. The recent Spectre and Meltdown vulnerabilities are a great example of this, with Google, Microsoft and Amazon all patching their system quickly after the problems became public. Meanwhile many businesses will still be trying to determine what systems they need to patch and how they go about doing it.

Furthermore, public cloud providers tend to have highly skilled and experienced IT teams, which isn’t something that can be said for all businesses. The skills gap issue is an extremely prevalent one in the cloud world and businesses are finding it harder than ever to attract talented developers. This is causing problems when it comes to addressing the more technical compliance challenges, which could be solved using third-party infrastructure.

Add in the fact that businesses will not be alone when defending against attacks and the skills argument provides compelling support for the merits of using third-party providers to ensure legislative compliance.

The combination of these factors means that in many cases public cloud can actually be a better option than a private cloud for systems with high security and compliance requirements. It can certainly be a less complicated option for businesses and help to give them peace of mind amidst shifting regulatory landscapes.

As end users become far more sensitive to security of their personal data and initiatives like Open Banking come into effect, the challenges are only going to grow. That’s why organisations today, rather than shying away from public infrastructure, should be embracing them as part of a hybrid cloud offering on their journey to compliance. 

Cisco has announced its intent to acquire Skyport Systems, a provider of hyperconverged infrastructure (HPI) and cloud-managed secure virtualisation.

The company, based out of Mountain View, has an offering which aims to converge security and infrastructure and be secure by design. The company claims its ‘continuously validated’ security platform enforces capabilities needed to avoid 85% of targeted cyber-attacks.

In a brief statement, Rob Salvagno, head of Cisco’s M&A and venture investment team, said the acquisition “will enable Cisco to utilise Skyport’s intellectual property, seasoned software and network expertise to accelerate priority areas across multiple Cisco portfolios.”

The move highlights the importance of venture capital arms within companies. Skyport has raised in total $67 million (£47m) in funding, with the most recent, a $30m series C in March 2016, involving Cisco Investments.

Cisco has been particularly busy on the acquisitions front, with the most recent of interest being the buying of Cmpute.io, a cloud application optimisation provider, in December. Among the company’s other acquisitions in 2017 were Viptela, a provider of SD-WAN technologies, and cloud collaboration software provider BroadSoft.

The Skyport team will join the data centre-computing systems product group, as well as the service provider-networking group at Cisco.

Financial details of the acquisition were not disclosed.

The migration towards cloud computing in business has grown exponentially over the last 12 months, with new installation of public and private cloud network infrastructure becoming a key area of successful business operation.

Partnering this successful adoption of cloud technology is the positive development of both core and non-core careers in the sector, which in turn has led to an increased demand for skilled professionals and a boost in the number of available jobs.

We initially saw an increased demand for those skills that focused primarily on the implementation and support of cloud platforms such as Amazon Web Services (AWS), Microsoft Azure and Google Cloud.

Now, however, with protection against cyber security threats fast becoming a primary concern for businesses following the recent ransomware attacks, and the impending introduction of the General Data Protection Regulation (GDPR) in the EU also becoming a priority, the cloud computing sector has seen a major shift in the demand for non-core professionals such as cybersecurity.

These experts have a strong knowledge of security and specialise in cloud network protection, in particular, penetration testers or ethical hackers, who are tasked with ensuring the complete safety of a system and network infrastructure so it has the capability to withstand infiltration. These are the first line of defence against a cyber-attack.

Given the authorisation to simulate white hat attacks on a secure network or system, the role of a penetration tester or ethical hacker is to evaluate the security of a network and test for unknown vulnerabilities.

Utilising a targeted pen test strategy to legally break into a computer, each test will be formulated to replicate a specific type of already-known attack, and will focus on identifying, exploring, testing and exploiting the main access points to a network. If the performed tests do unearth a vulnerability, pen testers will then comb the remainder of the network and work with the rest of the security team to eliminate the vulnerability.

Our experience tells us that in one in five UK IT vacancies, candidates are expected to have some experience of cloud computing, with many also stipulating the need for knowledge of data protection and security.

In order to service our clients more effectively, particularly with regards to cloud vacancies, we created  FRG Technology Consulting, which is our cloud specific recruitment brand.

As it stands, the majority of cloud professionals are self-taught or have learnt their skills throughout their time in the industry, ultimately meaning they lack the necessary experience to perform the role of an ethical hacker. And while experience in another IT field can offer some career progression and fills the gaps created by the current skills shortage, it will only curb the pressure on the marketplace for a short period of time.

There has however been a shift towards a route of natural progression into cloud computing and cybersecurity careers, which will not only provide a secure future for careers in the sector but also offer a comfortable alleviation on the skills shortage, and that is through the university education.

Numerous universities across the UK have backed the trend of modern cloud computing by moving away from the generic computer science degrees and offering BSC and MSC qualifications specifically in cloud computing. Allowing graduates to find a career in Cloud Operations if they take a non-specialised route, many establishments also offer a specific Cyber Security degree where students are taught to become penetrations testers while also learning the fundamentals of network security and advanced information security techniques.

Over the next 12 months, the investment from businesses into the cloud and security infrastructure is expected to systematically increase to accommodate the number of cloud professionals needed to successfully cope with the internal adoption of cloud platforms, storage and infrastructure. These investments should theoretically secure the future of careers in the sector, particularly with the inundation of new graduates continually adding different expertise to the sector, and the evolution of the technology providing equally as many opportunities to find your ideal cloud computing career.

Here’s an interesting statistic to illustrate how much influence the major cloud providers have: according to Lloyd’s of London, US businesses could lose $15 billion if a leading vendor experienced downtime of at least three days.

According to the insurer, working in partnership with risk modelling firm AIR Worldwide in its ‘Cloud Down’ report, an ‘extreme cyber incident’ which took a top cloud provider offline for three to six days would also result in insured losses of $3bn alongside the $15bn economic losses.

Businesses outside of the Fortune 1000 – who the report argues are more likely to be users of cloud services – are as a result placed at a higher risk. The companies say these businesses would carry 63% share of economic losses and 57% of insured losses.

The report also assessed how different industries would be impacted. If a large cloud provider went down for days, manufacturing would bear the brunt, with direct economic losses of $8.6bn. This compares against wholesale and retail trade ($3.6bn), information sectors ($847 million), finance and insurance ($447m) and transportation and warehousing ($439m).

Cloud providers’ services can go down for various reasons; whether it is weather-related, bug-related, or simply a case of fat fingers. Earlier this month, a study from Syncsort found that a majority of organisations had to deploy their disaster recovery solution at least once in the past year, with many not sure as to the specifics of their availability plans.

“A major cloud failure would significantly impact the insurance industry, and our research has shown that such an event is plausible,” said Scott Stransky, assistant vice president and principal scientist at AIR Worldwide. “We hope the report will help raise awareness across the industry as to how significant losses could be, how likely they are, and provide an opportunity for insurers to better understand and manage cyber risk.”

You can find out more about the report here.

A cryptocurrency is a digital asset designed to work as a medium of exchange that uses cryptography to secure its transactions, to control the creation of additional units, and to verify the transfer of assets. The quest to discover meaningful commercial applications for blockchain, beyond cryptography apps, has begun across the globe.

451 Research revealed that 28 percent of enterprises are now evaluating or using blockchain, although fewer than 3 percent have any production applications.

Blockchain market development

According to the study, 20 percent of organizations surveyed are using blockchain in a discovery or evaluation phase, 4 percent running trials or pilots, 2 percent in test and development environments, 2 percent undertaking initial implementations of production applications and less than 1 percent have broad implementation of production applications.

Furthermore, the market is rife with vendor misrepresentation about blockchain apps, and there is little understanding about how enterprise leaders can deploy blockchain profitably while navigating a market with thousands of vendors and hundreds of consortia vying for mind-share.

The 451 Research blockchain codex systematically decodes this market, pursuing the goal of replacing confusion and complexity with an examination of the technology components and guidance on first steps.

451 Research analysts believe blockchain has the potential to be the active ingredient for establishing universal trust among parties through clever code and peer-to-peer consensus.

In the enterprise sector, where smart contracts will dictate terms and cloud-tasking using multiple providers is the norm, there will be a need for transparency and an immutable system of record.

At the edge, IoT devices could take advantage of blockchain for authentication and to store and share interactions and data. Numerous other commercial applications will evolve over time.

"Blockchain will do for transactions what the Internet has done for information. It promises to disrupt business models and entire industries. It allows for increased trust and efficiency, and is pushing us to challenge how we define and exchange value and reward participation," said Csilla Zsigri, senior analyst at 451 Research.

Outlook for blockchain application development

With a scarcity of skills in blockchain technology and potential applications, there is a tremendous opportunity for third-party expertise that can help define and support proof of concepts and initial deployments.

More CIOs and CTOs seek information and guidance to gain an understanding of what blockchain is, how it works and how it can be applied in use cases. They're also eager to learn what those organizations and industries at the forefront of this nascent distributed ledger technology have accomplished, thus far.

Read more: IBM ends revenue decline, says it has strengthened cloud and blockchain leadership