Connor Jones

Bobby Hellard

Cloud computing has become a prevalent force, bringing economies of scale and breakthrough technological advances to modern organisations, but it is more than just a trend. Cloud computing has evolved at an incredible speed and, in many organisations, is now entwined with the complex technological landscape that supports critical daily operations.

This ever-expanding cloud environment gives rise to new types of risk. Business and security leaders already face many challenges in protecting their existing IT environment. They must now also find ways to securely use multiple cloud services, supported applications and underlying technical infrastructure.

The need to use cloud services securely

The surge in business processes supported by cloud services has been well evidenced by organisations using cloud services store confidential data in the cloud environment. But when using cloud services, organisations are still unsure whether to entrust cloud service providers (CSPs) with their data. CSPs generally provide a certain level of security as substantiated by multiple surveys, but cloud-related security incidents do occur.

CSPs cannot be solely responsible for the security of their customers’ critical information assets. Cloud security relies equally on the customer’s ability to implement the right level of information security controls. Nevertheless, the cloud environment is complex and diverse, which hinders a consistent approach to deploying and maintaining core security controls. It is vital that organisations are aware of and fulfill their share of the responsibility for securing cloud services to successfully address the cyber threats that increasingly target the cloud environment.

Key features of cloud services

Organisations have rapidly adopted cloud services, attracted by the ease of procurement, relatively low set-up cost and the opportunity to replace legacy technology that no longer meets business needs. Yet, managing security is no simple task due to the unique and varied features intrinsic to using multiple cloud services.

Cloud services cover a vast range of offerings such as business applications, document storage solutions, databases and virtual servers, which can all be purchased on-demand from a selection of CSPs through a public network, most commonly the internet.

As organisations move to cloud computing to enhance their business operations, they tend to favor the acquisition of cloud services over the expansion of conventional, on-premises IT data centers. Often described as a cloud-first policy, this approach has been adopted by countless organisations. For many organisations, this means that almost their entire IT Infrastructure will eventually be hosted in the cloud environment.

The rise of the multi-cloud environment

As organisations acquire new cloud services, they typically choose these from a selection of multiple CSPs and therefore need to deal with a multi-cloud environment, which is characterised using two or more CSPs.

Organisations favor a multi-cloud environment because it allows them to pick and choose their preferred cloud services across different CSPs (e.g. AWS, Microsoft Azure, Google Cloud, Salesforce). However, each individual CSP adopts its own jargon, its own specific technologies and approaches to security management. The cloud customer therefore needs to acquire a wide range of skills and knowledge to use different cloud services from multiple CSPs securely.

Organisations require a range of different users to securely access cloud services from within the organisation’s network perimeter through secure network connections (e.g. via a gateway). However, organisations also need their cloud services to be accessed from outside the internal perimeter by business partners and users travelling off-site or working remotely, all connecting through a selection of secure network connections as dictated by the organisation.

Overcoming cloud security challenges

While CSPs provide a certain level of security for their cloud services, organisations need to be aware of their security obligations and deploy the necessary security controls.  This requires organisations to understand and address the many security challenges presented by the complex and heterogeneous aspects of the cloud environment.

Our ISF members have identified several obstacles to operating securely in the cloud environment. The main challenges include:

• Identifying and maintaining the appropriate security controls
• Balancing the shared responsibility for security between the CSP and the cloud customer
• Meeting regulatory requirements to protect sensitive data in the cloud environment

The rapid explosion of cloud usage has accentuated these challenges and, in some instances, left organisations insufficiently prepared to tackle the security concerns associated with using cloud services.

Balancing the shared responsibility for security between the CSP and the cloud customer

Securing the use of cloud services is a shared responsibility between the CSP and the cloud customer. The security obligations incumbent on the CSP are to protect the multi-tenant cloud environment, including the backend services and physical infrastructure, as well as to prevent the commingling of data between different customers.

While the CSP maintains much of the underlying cloud infrastructure, the cloud customer is responsible for securing its data and user management. Whether the customer’s responsibility extends to performing security configurations for applications, operating systems and networking will depend on the cloud service model selected.

This shared responsibility for security can create confusion and lead to over-reliance on the CSP to mitigate threats and prevent security incidents. It is essential that the cloud customer does not depend wholly on the CSP to deploy the appropriate security measures, but clearly understands how responsibility for security is shared with each CSP in order to identify and deploy the requisite security controls to protect the cloud environment.

Meeting regulatory requirements to protect sensitive data in the cloud environment

An organisation using an on-premises IT data centre will know exactly where its critical and sensitive data resides and can exert full control over the movement of its data. This helps considerably when implementing security controls, whereas in the cloud environment, data moves in and out of an organisation’s perimeter more freely. This can obscure where critical and sensitive data is located, and how it can be protected, which can hinder an organisation’s ability to effectively enforce the requisite security controls across all of its cloud services in line with compliance requirements.

While it is the cloud customer’s responsibility to ensure the security of its data in the cloud environment, the customer’s control over its data is intrinsically limited since the data is stored by an external party – the CSP – in an off-site location, often in a different country. Moreover, the CSPs will often leverage several data centers in geographically distinct locations to ensure the organisation’s data is stored on more than one server for reasons of resilience.

This creates additional complexity in terms of managing data across borders, understanding where it is located at a given moment in time, determining the applicable legal jurisdiction and ensuring compliance with relevant laws and regulations – an obligation that rests fully with the cloud customer, not the CSP.

Maximise potential and take responsibility

Modern organisations must operate at a fast pace, delivering new products and services to stay ahead of the competition. Many are therefore choosing to move ever further towards cloud computing, as the elasticity and scalability offered by cloud services provide the desired flexibility needed to compete. For an organisation to have confidence that it can move to the cloud whilst ensuring that vital technological infrastructure is secure, a robust strategy is required.

The cloud environment has become an attractive target for cyber attackers, highlighting the pressing need for organisations to enhance their existing security practices. Yet consistently implementing the fundamentals of cloud security can be a complicated task due to the diverse and expanding nature of the cloud environment.

This is but one of many challenges that organisations need to overcome to use cloud services securely. Organisations cannot rely purely on CSPs to secure their critical information assets but must accept their own share of responsibility. This responsibility calls for a combination of good governance, deployment of core controls and adoption of effective security products and services. Controls that cover network security, access management, data protection, secure configuration and security monitoring are not new to information security practitioners, but they are critical to using cloud services securely.

Moving forward, organisations can select from a variety of trends and technologies that will enable them to use cloud services securely – from the adoption of new products to the embedding of improved processes, such as a focus on secure containers, where security is given greater emphasis during development.

Assuring that services are used securely will provide business leaders with the confidence they need to fully embrace the cloud, maximising its potential and driving the organisation forward into the future.

Interested in hearing industry leaders discuss subjects like this and sharing their experiences and use-cases? Attend the Cyber Security & Cloud Expo World Series with upcoming events in Silicon Valley, London and Amsterdam to learn more.

CIOs have been telling their cloud partners for years now that they’re not ready to fully commit to the public cloud. They have existing infrastructure investments which they’re loathe to jettison and some applications and workloads can’t easily move off site. In other cases, IT needs workloads to run nearby in the data centre to satisfy the extreme low latency requirements for services on the factory floor or in the emergency room.

Highly sensitive regulatory requirements also are a factor when CIOs choose to keep some assets in the corporate data centre. The cloud giants are finally listening. And suddenly, hybrid cloud is red hot.

A majority, or 86% of enterprises, have more than a quarter of their IT infrastructure running in cloud environments and more than half have 50-75% in the cloud, according to a recent OpsRamp survey. According to the RightScale 2019 State of the Cloud report, hybrid cloud is the dominant enterprise strategy, with 58% of respondents stating that is their preferred approach. Organisations are using an average of five different clouds. Clearly, the appetite for hybrid and multi-cloud environments, which are now increasingly characterised by including multiple cloud vendors, is strong.

The big three cloud providers are responding

Amazon, Google and Microsoft have been releasing new hybrid cloud offerings in recent months. The latest is Arc from Azure. This bundled multi-cloud layer claims to be the single platform for extending Azure services whether its on-premise using Azure Stack, competing cloud services, or edge environments. Arc promises a hybrid automation framework for deploying and managing apps in all clouds.

Given its enterprise heritage, Microsoft placed the right bet when it announced Azure Stack in 2015. Amazon and Google quickly followed. If the recent Arc announcement is any indication, the complex multi-cloud world is here to stay. In this multi-cloud hybrid reality, software engineers have to design or re-factor applications to account for interoperability between all clouds, while releasing applications ever faster to stay competitive. Meanwhile, IT operations teams are challenged to manage assets, metrics, alerts, events and services from on-premise and major cloud vendors. The greatest challenge for IT ops today is to discover a cohesive framework to process multi-cloud hybrid data and complexity without undue cost and pain.

Now, there are finally several options for doing just that.

Clouds competing for the middle

While all three companies have competitive solutions to address the hybrid IT challenge and be the provider to solve hybrid woes, none of them are a perfect solution. This is a new battleground for cloud vendors to compete in the world of infrastructure management and orchestration. 

Microsoft was the first to consider enterprise IT cloud realities, when it launched Azure Stack in 2017. Stack has been wildly successful because it’s delivered a safe runway to the cloud. CIOs can run the Azure cloud operating system on-premise and obtain tangible benefits of cloud architecture and services without giving up the security and control they want from keeping IT inside. That’s especially important in companies with heavy compliance requirements or in traditional IT organisations and cultures.

Stack also supports an easier migration path to Azure, and simpler integration between on-premise and cloud workloads. Arc takes this a step further by adding an abstraction layer over Azure and Stack environments so that IT can orchestrate and manage all infrastructure (including, says Microsoft, a competing cloud environment) from one place.

In April, Google released its version of the hybrid play: Anthos. Google calls it an “open application modernisation platform that enables you to modernise your existing applications, build new ones, and run them anywhere.” Google’s service, as expected, focuses on open-source technologies Kubernetes, Istio, and Knative and allows IT to manage both on-premises and cloud environments.

AWS Outposts brings AWS infrastructure, services, and operating models to “virtually” any data centre or on-premises facility. AWS Outposts builds on the AWS Nitro system technologies that enable customers to launch EC2 instances and EBS volumes on the same AWS-designed infrastructure used in AWS data centres. Companies can run AWS Outposts on VMware Cloud or using AWS native technologies.

Now for the outlier: Kubernetes. While not a cloud provider, this container orchestration platform has been a boon to IT because it decouples the underlying infrastructure (on-premises or public cloud) from the applications. This has never been done so elegantly before and transformed Kubernetes into a strategic and beloved abstraction layer allowing developers to spread their wings across any cloud vendor or environment. This decoupling empowers application developers to focus solely on the app development and port applications between environments with ease. That said, Kubernetes is also an extension of the overall hybrid infrastructure picture, one that needs to be tracked and monitored as well.

Impact on IT and IT ops

Most enterprises will end up operating in a hybrid-cloud configuration between on-premise and one or more cloud vendor. Products like Azure Arc, AWS Outpost and GCP Anthos will enable enterprises to speed cloud adoption, minimise internal risk, maintain consistent deployment and automation models across apps and infrastructure, and allow IT to migrate workloads between locations and clouds with ease.

There may also be significant benefits for IT Operations in adopting a hybrid cloud service from Amazon, Google or Microsoft along with Kubernetes. Legacy, on-premise monitoring and management tools are still common in enterprises. A survey by Forrester found that some 33% of companies are using more than 20 monitoring tools and only 12% were solely using modern tools. But as you put more workloads in the cloud, legacy tools don’t really fit the bill. Infrastructure leaders will be looking to select a modern cloud management solution that doesn’t lock them into a certain cloud. In addition, many IT organisations still need a vendor-neutral system to monitor and optimise these environments. Those systems will of course need to integrate with the company’s hybrid cloud service of choice. 

Enterprises can realise the following three benefits from a hybrid public cloud approach:

• Use best of breed products from all cloud vendors
• Use the most cost effective products from each vendor
• Distribute risks between cloud vendors

Will the customer be locked in?

To that extent, it’s questionable if any of the public cloud vendors will provide the optimal approach for operating other clouds. Regardless of which approach enterprises choose, 2020 will be a pivotal year for realising real-world benefits from the cloud as the market matures for hybrid cloud products and services.

Interested in hearing industry leaders discuss subjects like this and sharing their experiences and use-cases? Attend the Cyber Security & Cloud Expo World Series with upcoming events in Silicon Valley, London and Amsterdam to learn more.

Bobby Hellard

Continuous integration and delivery (CI/CD) software provider CircleCI has been acting on its expansion plans following the $56 million (£44.8m) secured in series D funding in July. Now, the company is ready for business in London – and has hired a new head of EMEA to push things along.

Sharp observers looking at the almost 250 faces which comprise the CircleCI team would have noticed a recent addition at the foot of the list. Nick Mills joined the company in September having previously held leading sales roles at Stripe and Facebook, among others, invariably concerned with international expansion.

At CircleCI, Mills will be responsible for EMEA – which the company says represents almost a quarter of its overall business – in everything which is classified as non-engineering. “There’s a huge amount of expansion opportunity,” Mills tells CloudTech. “I’ve already had some interesting conversations in the first few weeks here with companies in fintech and mobility, on-demand services. They really see CircleCI and CI/CD as a fundamental critical enabler that can help their teams increase productivity.”

The company certainly appears to be seeing gains from this bet. Big tech names on the customer roster include Facebook, Spotify and Docker, while investor Scale Venture Partners described the company earlier this year as the ‘DevOps standard for companies looking to accelerate their delivery pipeline while increasing quality.’

For CEO Jim Rose, who has been in London this week for the launch, it is the expansion of a journey which began for him in 2014, first as COO before moving up to the chief executive role a year later.

“When I first got to the company, there were about 30 individual logos in the CI/CD market, and that’s been whittled way down,” Rose tells CloudTech. “Now there is, really, ourselves, a couple of smaller, standalone, very focused CI/CD players, and then you’ve got some of the larger platforms that are trying to go end-to-end.”

Rose cites the ‘peanut butter manifesto’, the now infamous document from Yahoo which used the foodstuff as a metaphor for businesses spreading themselves too thinly across multiple offerings, as evidence for why the larger platforms will struggle.

“We have really gone for the opposite of that strategy,” he explains. “For the vast majority of large customers, you can only move certain systems one at a time. Customers ask us all the time… how do we build that CI/CD system but also the most flexible system so that regardless of what you have in place inside of your overall enterprise or team, it’s really easy and seamless?”

There are various aspects which pull together the company’s strategy. Back in the mid-2000s, if a company built a new application it would hire a bunch of developers, flesh out the spec, write custom code across every line and then package and ship the resultant product. As Rose puts it, any custom code written today takes on the mantle of orchestrating all the pieces together, from the plethora of open source libraries and third-party services.

Continuous delivery is a hornet’s nest – it’s very easy to get to version one, but then the complexity comes as your developers start pushing a lot faster and harder

“What we’re helping customers do is, across all of these hundreds and thousands and millions of projects, start to take a heartbeat of all those different common components and use that to help people build better software,” says Rose. “If you have a version that’s bad or insecure, if you’re trying to pull a library from a certain registry that has stability problems, if you have certain services that are just unavailable… these are all new challenges to software development teams.

“Using the wisdom of the crowd and the wisdom of the platform overall, we’re starting to harness that and use that on behalf of our customers so they can make their build process more stable, more secure, and higher performing.

“Honestly, continuous delivery is a hornet’s nest,” adds Rose. “It’s really complicated to run into one of these systems at scale. It’s very easy to get to version one, but then the complexity comes as you bring it out to more teams, as you add more projects, as your developers start pushing a lot faster and a lot harder.”

For a large part of the company’s history, the individual developer or team of developers was the route in for sales; almost in an infiltrative ‘shadow IT’ context, whether it was the CTO of a small startup or a team lead at a larger company. While this can still be the case at enterprise-level organisations, CircleCI realised it needed more of a top-down, hybrid sales approach.

“One of the biggest changes in our space – not just CI/CD, but the developer space more generally – is developers historically have not been conditioned to pay for things,” says Rose. “If you needed a new tool, a new script, the developers would either go out and create it on their own or they use an open source service.

“What’s changed over the last two or three years is now developers, because their time is so valuable, have the budget and the expectation that they have the opportunity to pay for services that help you move faster. A lot of what we do from a sales perspective is help development teams understand how to procure technology. What’s necessary? What do you think about what you look at? How do we help you through that commercial process?”

Mills will be looking to guide EMEA customers through this process, with the stakes high and the motivation to assist leading tech companies strong. “A lot of companies are successful in and of themselves and can build their businesses, but the space we’re in really has the potential to enable the most successful tech companies today and of the future,” Mills explains.

“Ultimately, the creation they can generate as companies can obviously help them move quickly, increase the scale and pace of product delivery,” he adds. “To me, that feels like incredibly high-level work to be doing and high value.”

Interested in hearing industry leaders discuss subjects like this and sharing their experiences and use-cases? Attend the Cyber Security & Cloud Expo World Series with upcoming events in Silicon Valley, London and Amsterdam to learn more.

Maggie Holland

Maggie Holland

Google Cloud has taken its Next event to London – and the company stressed its commitment and capabilities to European businesses in the process.

The company took to the ExCeL to announce a variety of product updates and customer news, with Anthos, its hybrid cloud services platform, top of the bill.

The general availability (GA) launch of Migrate for Anthos, announced today, aims to provide a more straightforward path to convert physical servers or VMs from multiple clouds – the reason why Anthos was rebranded at Next in San Francisco back in April – directly into containers in Anthos GKE. The updated service will be available at no additional cost and does not need an Anthos subscription to activate.

“Migrate for Anthos makes it easy to modernise your applications without a lot of manual effort or specialised training,” a blog post from director of product management Jennifer Lin and VP product and design Pali Bhat noted. “After upgrading your on-prem systems to containers with Migrate for Anthos, you’ll benefit from a reduction in OS-level management and maintenance, more efficient resource utilisation, and easy integration with Google Cloud services for data analytics, AI and ML, and more.”

Another new product moving to GA was Cloud Code, which enables developers to write, debug, and deploy code to Google Cloud, or any Kubernetes cluster, through extensions to popular integrated developer environments (IDEs). This was by no means the only developer-centric product launched, with a hybrid version of API management tool Apigee also announced.

In terms of customers, the biggest announcement was John Lewis, which, as a blog attributed to Google Cloud CEO Thomas Kurian notes, is utilising Google Cloud for greater eCommerce benefits, as well as Google’s artificial intelligence and machine learning expertise. The retailer has worked with Google for half a decade, firstly around productivity through G Suite and then to create a centralised data platform with Google Cloud.

Retail has become a major area for the biggest cloud providers over the past year, with particular focus on Microsoft and Google’s clouds given Amazon’s strength. One of Google Cloud’s biggest customer acquisitions this quarter has been fellow UK supermarket Sainsbury’s, with machine learning again cited. Yet at the start of this year, following Albertson’s move to Microsoft, 451 Research told this publication to beware the narrative of retailers ‘fleeing AWS.’

Other customers referenced at the event included Vodafone, using Google Cloud to develop a data analytics platform called Neuron, as well as ride hailing app Kapten.

Analysis

The timing of the event could be seen as portentous, as some of Europe’s most powerful countries are looking to fight back at what it sees as a monopoly among US cloud providers.

At the end of last month, the German federal ministry for economic affairs and energy, alongside counterparts at the French ministry of economy and finance, issued a press release announcing plans to build a Euro-centric ‘secure and trustworthy data infrastructure.’ Amazon Web Services (AWS) told Bloomberg in a statement at the time that while the idea of a national cloud was ‘interesting’ it ‘in reality… removes many of the fundamental benefits of cloud computing.’

Google Cloud’s data centre map has seven European sites listed; alongside the Netherlands, Finland and Belgium, there are regions located in London, Frankfurt, Zurich and Warsaw. The latter was the most recent to launch, in September. For comparison Microsoft Azure also has presence in seven countries, but swapping France, Ireland and Norway for Belgium, Finland and Poland.

Writing in a blog, Google Cloud EMEA president Chris Ciauri – a high profile signing from Salesforce just a few months before – noted today’s developments were part of an ongoing commitment to ‘make Google Cloud the best place for digital transformation for European organisations.’

“Europe’s ambition for a successful digital transition is something we have always strived to support and enable,” Ciauri wrote. “Our cloud is designed to fully empower European organisations’ strict data security and privacy requirements and preferences. Where data resides, who has access to customers’ data, and protections for the privacy and security of customers’ data is central to our offering.”

This need for privacy and security above all else has been emphasised in research conducted by analyst CCS Insight. The company’s 2019 CIO survey data found that trust for Google Cloud among senior IT executives was going up as EMEA remained a primary growth area.

It is almost a year to the day since Kurian took over Google Cloud after the departure of Diane Greene. At the time, as this publication reported, Kurian’s in-tray would consist of two primary goals: bolster sales and improve industry education and trust around the company’s value proposition. The first has been achieved, or at least plenty of effort has gone towards it, while the second has also seen a lot of endeavour.

“Google will need to continue to push its communications hard over the next 12 months as many still don’t understand the separation of Google Cloud from the consumer business,” said Nick McQuire, VP enterprise at CCS Insight. “Messaging its corporate strategy is imperative especially as ethics, governance and responsibility have now become crucial indicators for investment in not only cloud computing, but its crown jewel machine learning as well.”

Interested in hearing industry leaders discuss subjects like this and sharing their experiences and use-cases? Attend the Cyber Security & Cloud Expo World Series with upcoming events in Silicon Valley, London and Amsterdam to learn more.

Keumars Afifi-Sabet