Bobby Hellard

Cloud computing hasn’t always been synonymous with great security. However, despite early fears that it was less secure than data centres, the cloud is now considered a useful – and secure – solution for most critical business functions. While some of its earliest adopters could afford to be somewhat blasé about security, that’s no longer the case. The latest generation of cloud entrants mainly operate in finance and government sectors, meaning that security and compliance are at the very top of their agendas.

This emphasis on cloud security has also been sped up by the series of significant data breaches which have affected consumers in recent years. Security has been thrown into the legal spotlight more than ever before too, particularly after GDPR was introduced in Europe, giving strict regulation for businesses to either comply with or face direct consequences.

But while the development and operations departments of businesses have largely embraced the dynamic world of the cloud, for the security team it presents a whole new set of challenges. They no longer work with controlled environments that they can carefully assess and manage as they did before. Instead, with cloud platforms and application code so tightly integrated, development teams must now incorporate security requirements into their code itself to enforce in the platform.  

As cloud platforms often change daily, the potential risk of a misconfiguration is significant. According to Gartner analysis, by 2020, 80 percent of cloud breaches will be due to customer misconfiguration, mismanaged credentials, or insider theft – not cloud provider vulnerabilities. 

Solutions do now exist that can help the security team with these challenges. These solutions allow them to define their policies (PCI-DSS, CIS, NIST, HIPAA) against the cloud environments and, then, to present them to the development team in a concise way.

Reducing the unnecessary overheads incurred in maintaining security policies can aid an organisation enormously. It lowers the risk of misinterpretation, narrows the margin for human error, and allows the development team to work safely within the guardrails established by the security team. This means that they do not constantly need to be aware of the latest changes on the cloud platform and how they correspond to the written security policies. Free from their security role, they can code without wading through pages of policy.

At my organisation, we faced this exact challenge. We found that the existing tools for multi-cloud environments were poor and that any remediations were lacking. In order to address these gaps, we created a solution named Cloud Security Guardian (CSG) and, now, our workflow follows a clearly-defined pattern:

• Deployment: Stand up a new Azure subscription or AWS account 
• Permission: Create the IAM controls and give them to security teams to allow them to configure CSG in order to inspect the new environment
• Definition: The security team can create or apply the compliance policies that they require the cloud solutions to meet. This can be easily changed as the environment expands or as the compliance requirements evolve
• Building: The development team can now start making their cloud deployments into the environments. For these initial ones, the developers can focus on function as this will be evaluated in real time. 
• Consumption: Query CSG via the API and find out exactly where that new deployment fails to match the security policy. If the deployment matches it perfectly, then you now have the report to prove it.
• Remediation: If there is at least one thing to remediate, the violations can be fixed with another quick call. The corrected template can then be pulled back into the repo or the API can provide the JSON to integrate independently. (Those who like GUIs can review the alerts and remediate from the GUI instead)
• Report: As the project progresses, the reports can be shared with stakeholders. These can prove invaluable when performing risk analysis and will assist with sprint planning because they show which areas should be focused on

For developers, this process provides information throughout the entire integration cycle. It can point out the risks in smoke, make quick remediations in UAT, or provide validation in staging. Once in production, this could then be handed over to the operations team to monitor for manual changes or for configuration drift.

Of course, the security team can use this tool too. It allows them to have an immediate overview of the security of all cloud environments and to keep an eye on short-lived environments in order to assess the risk they may have presented as well. Once the security team can view the system’s entire infrastructure, they can easily see how its components interconnect and identify its weak points. 

When it comes to carrying out company-wide reviews of security practice, it allows the security team to quickly make a report on compliance status at any given point in time. It also provides them with a full audit trail. Every change made to the system can be monitored in real time and alerts can be sent to Slack, Sumo Logic, or email whenever something falls out of compliance. 

Making continuous security part of the cloud lifecycle can benefit a company’s security and development teams in equal proportion. It allows them to operate the cloud environments and to manage their compliance requirements as one joined entity using the methods that best suit each team.  

Interested in hearing industry leaders discuss subjects like this and sharing their experiences and use-cases? Attend the Cyber Security & Cloud Expo World Series with upcoming events in Silicon Valley, London and Amsterdam to learn more.

• AWS and Google certifications are among the most lucrative in North America, paying average salaries of $129,868 and $147,357 respectively
• Cross-certifying on AWS is providing a $12K salary bump to IT professionals who already have Citrix and Red Hat/Linux certifications today
• Globally, four of the five top-paying certifications are in cloud computing

These and many other insights of which certifications provide the highest salaries by region of the world are from the recently published Global Knowledge 2019 IT Skills and Salary Report. The report is downloadable here (27 pp., PDF, free, opt-in). The methodology is based on 12,271 interviews across non-management IT staffs (29% of interviews), mid-level professionals including managers and team leads (43%), and senior-level and executive roles (28%) across four global regions. For additional details regarding the study’s methodology, please see page 24 of the report.

Key insights from the report include the following:

Cross-certifying on AWS is providing a $12K salary bump to IT professionals who already have Citrix and Red Hat/Linux certifications

Citrix certifications pay an average salary of $109,546 and those earning an AWS certification see a $12,339 salary bump on average. Red Hat/Linux certification-based jobs pay an average of $113,165 and are seeing an average salary bump of $12,553.  Cisco-certified IT professionals who gain AWS certification increase their salaries on average from $101,533 to $111,869, gaining a 10.2% increase. The following chart compares the salary bump AWS certifications are providing to IT professionals with seven of the more popular certifications (please click on the graphic to expand for easier reading).

AWS and Google certifications are among the most lucrative in North America, paying average salaries of $129,868 and $147,357 while the most popular are cybersecurity, governance, compliance, and policy

27% of all respondents to Global Knowledge’s survey have at least one certification in this category. Nearly 18% are ITIL certified. In North American, the most popular certification categories beyond cybersecurity are CompTIA, Microsoft, and Cisco. The following table from the report provides an overview of salary by certification category (please click on the graphic to expand for easier reading).

AWS Certified Solutions Architect – Associate is the most popular AWS certification today, with 72% of respondents having achieved its requirements

Certified Solutions Architect – Associate leads the top five most commonly held AWS certifications today according to the survey. AWS Certified Developer – Associate (33%), AWS Certified SysOps Administrator – Associate (24%), AWS Certified Solutions Architect – Professional (16%) and AWS Certified Cloud Practitioner round out the top five most common AWS certifications across the 12,271 global respondents to the Global Knowledge survey.

Interested in hearing industry leaders discuss subjects like this and sharing their experiences and use-cases? Attend the Cyber Security & Cloud Expo World Series with upcoming events in Silicon Valley, London and Amsterdam to learn more.

Bobby Hellard

Dale Walker

Cloud technology is helping companies in every industry do more with less. In specific industry verticals, the cloud can play a key role in pushing the industry into successful digital integration. The energy sector, which is my company's expertise, is an example of how the cloud can transform an industry's operating procedures. Adoption isn't yet widespread yet, but the industry's shift to the cloud is picking up speed as we catapult into the next decade.

In energy, legacy systems that rely on human involvement are now being replaced by automated systems that interact seamlessly with cloud platforms. The companies driving this shift report typical improvements (greater efficiencies, lower costs), as well as some benefits that aren't as applicable to other industries.

Things happen quickly in the cloud, and speed is priceless in this industry. A recent report from Accenture found that energy executives view reduced costs as merely a secondary benefit — they mostly want to harness the cloud to speed up operations. In oil and gas, timely data transmission is critical to operators. Cloud technologies allow for the transfer of data at unprecedented speed and scale, whether it comes from field measurement instruments/flow, land titles/contracts, or regulatory documentation.

Cloud technology is also a boon to energy-based accounting departments and CFOs. Energy is one of the most regulated sectors of the economy, which means accounting can get complicated in a hurry. The cloud meets the complex accounting needs of most oil and gas enterprises at a reasonable cost and with a high level of reliability.

When companies can back up data and recover it in the cloud, SOX compliance becomes far more manageable. Even better? Automated cloud-based systems reduce human errors that even the most sophisticated legacy software can’t prevent.

Integrating the cloud with energy companies

Spending on public cloud services is expected to total $277 billion in 2021, according to the International Data Corporation. That charge primarily will be led by professional services, telecommunications, and banking enterprises. Energy companies will also contribute to that number, though not all of them are ready for cloud adoption.

In several cases, we have witnessed organisations rush to join the cloud movement without first developing an adequate plan for adoption that accounts for such a unique environment. This can be a costly mistake — these companies often expend resources attempting to transition to services they don’t need or can’t use. Focus on the following three steps when planning your own cloud migration, and you’re much more likely to appreciate the outcome.

Tap into internal expertise

Clients often think they want cloud solutions when they actually need more agility and mobility in their present ERP systems. Some organisations rush to ditch their existing on-premise systems before they have comprehensive digital strategies in place. They quickly realise that cloud solutions aren’t a panacea — and can become the opposite when companies aren't ready for the transition. A botched or painful migration is avoidable if energy leaders take the time beforehand to understand what the technology can and cannot do.

At Enertia Software, we urge operators to get input from experts within their organisations before seriously considering cloud adoption. Talk with internal stakeholders who have a clear understanding of the value of cloud technology and the core business objectives of your organisation.

Don’t overlook integration

Companies don’t do business in a vacuum. Your business probably has processes and systems in place for working with outside partners, and you’ll need to thoroughly evaluate these internal operations as you develop your plan. For example, oil and gas processes in the energy sector are field-intensive and not directly comparable to the outputs of other industries. Cloud integration for an energy company will be a different process than for companies in other industries.

Your organisation’s digital transformation will affect everyone you work with, including vendors, contractors, and other partners. Unless you want to lose them, you’ll need to help them understand how existing workflows will change and how your company will navigate that change.

Ultimately, having a fully integrated single database cloud solution will not only improve efficiencies but also provide meaningful outsourced-IT services, alternative accessibility options, and cost-saving solutions. To capture those benefits without completely overhauling your existing business model, you’ll have to ensure that your partners and their products will be seamlessly integrated into your post-adoption workflows.

Seek out flexibility

When evaluating specific cloud services, don't forget about the client's need for flexibility. In our industry, upstream energy companies consistently need flexible implementation solutions that support business expansion, agility, and operational efficiency. This needs goes beyond the energy sector — all innovative, solutions-oriented companies need flexibility in their cloud infrastructures. Just as public cloud spending will continue to increase, the global market for true private cloud services will also expand — reaching roughly $262.4 billion by 2027, according to Wikibon — and there is no shortage of firms that would love to help your organisation with its transformation.

The best partners have more than just technical expertise, of course. They’ll be able to help you turn cloud technology into a competitive advantage and empower you to think more strategically and proactively about how it can be deployed. In the not-too-distant future, nearly every organisation will rely on the cloud in some form or another. The ones that win won’t just evolve their technology — they’ll evolve with it.

Interested in hearing industry leaders discuss subjects like this and sharing their experiences and use-cases? Attend the Cyber Security & Cloud Expo World Series with upcoming events in Silicon Valley, London and Amsterdam to learn more.

Esther Kezia Thorpe

Bobby Hellard

Managed service providers (MSPs) are in a fascinating place right now. They more often than not have plenty of longevity, while the vast majority believe today is as good as ever to be in the industry.

Yet the two points can be conflated. With longevity comes a need to change course, to avoid falling behind competitors. But as organisations continue to move to the cloud, and as their cloudy workloads become increasingly complex, the role of the MSP becomes increasingly vital. It is just about where exactly you play.

Datto, a provider of business continuity, networking and business management software, recently released its 2019 State of the MSP Report. The study polled more than 1600 MSPs around the world focusing on what they were doing right now in the channel and, crucially, where they thought the puck was heading.

Areas where providers felt their business was positively impacted included cloud storage and management, business continuity and disaster recovery, as well as cybersecurity. Kevin Damghani, chief partner experience engineer at IT Partners, told the report that as more clients shift to cloud-based productivity software, a ‘major opportunity’ presented itself for SaaS backup, with SaaS protection being the company’s fastest growing offering.

Rob Rae, VP business development at Datto, emphasised this positive approach. “MSPs have endless opportunities to expand their offerings, reach more industries, and grow their bottom line,” he told CloudTech. “The industry landscape for MSPs is constantly changing as technology advances – and nowadays, those advances are happening more rapidly than ever.”

Rae cited managed networking as a good example of this expansion where providers were showing plenty of interest. “It’s an easy concept for the businesses an MSP serves to grasp, because every business needs a Wi-Fi network. An MSP might manage their clients’ data backups, but what happens if the network goes down?” said Rae. “How would a client access that data? Businesses will invest to keep their networks, both wired and wireless, running efficiently.”

MSPs have endless opportunities to expand their offerings, reach more industries, and grow their bottom line. The industry landscape is constantly changing as technology advances

As good as it is for a business to have so many strings on one’s bow, it matters little when others aren’t aware of it. This was seen as one of the primary concerns of the report’s respondents; marketing and sales, cited by 44% of those polled, was the most frequent grumble.

Rae notes it has been this way for a few years – and is indirectly related to how long the companies have been in business. “Most MSPs don’t have in-house marketing teams and come from technical backgrounds,” he explained. “Maintaining healthy revenue growth and profitability is a common pain point as well as competition increases as more MSPs enter the space.

“Many MSPs began as break-fix shops or VARs [value added resellers],” Rae added. “As the concept of an MSP who operates on a recurring revenue model continues to grow in popularity across the IT channel, we can expect more MSPs to keep entering the space.”

Security was another concern, cited alongside ransomware by 30% of respondents. Regular readers of this publication will have seen the increasing sophistication of attacks, whether it is from greater attack surfaces or emerging technologies such as artificial intelligence (AI). The report notes that for many customers, the ‘it won’t happen to me’ mindset remains prevalent.

Datto has previously explored how ransomware remains a ‘massive’ threat to SMBs and how the channel is coping with it. Rae noted this heightened worry. “Concerns have increased because the risks have been more widely reported globally along with monetary and data losses – however, the threat never increased,” he said. “Bad actors merely were able to exploit at a wider scale more anonymously than ever before with the advent of ransomware and cryptocurrencies.”

Ultimately, MSPs have plenty of experience in terms of IT lifecycles, as well as an array of options in how to charm their customers and prospects. While the pain points aren’t going away, the 2019 State of the MSP Report notes an overall mood of optimism: in the next 12 months more than half of MSPs polled are expecting to add up to 10 new clients.

Editor’s note: This article is in association with Datto.

Maggie Holland