Information Technology has advanced in different areas at different speeds. This has always been true, as people found workable solutions to the problems that faced them today, most often before there was a market for those solutions. While things like virtualization and eventually cloud computing grew slowly, programming languages sat at the same point for around a decade before the current round of new languages and approaches—Python, Ruby, Node, Swift—came about. These things seem unrelated, but there is a union of the two sets of changes that we are about to see blossom.

read more

Businesses across the country have bought into the extraordinary benefits of cloud computing. Senior executives have become passionate advocates, attracted by the promise of greater agility, cost savings and convenience. It is no surprise that global spending on public cloud services will reach $141bn by 2019. But business leaders are less well informed when it comes to the risks the cloud can introduce to enterprise environments.

That’s why IT needs to take ownership of cloud security. This will certainly require specialised tools designed to detect the “needle in the haystack” of cyber threats across this type of IT service delivery. It will also demand that IT functions articulate those threats in a language the business understands. Without cyber risk being articulated in the familiar lexicon of business risk, senior management and board-level engagement is difficult to secure.

Scoping the threat

Clouds (and cloud services) come in many shapes and sizes. But despite the undoubted business and IT benefits, security still tops the list of barriers to adoption. These concerns frequently revolve around the multi-tenancy nature of many cloud offerings. The question as to whether you can be sure your sensitive customer data and/or IP is protected from the virtual machines (VMs) of other tenants, some of whom may be competitors is a reasonable concern? Others include: whether your supplier is certified to comply with relevant industry standards and regulations like PCI DSS and ISO 27001? If you know where your data is being stored and how it is being handled by your CSP? Do you know what kind of security measures are in place, and what you are expected to provide?

These are all valid concerns, especially as the means to launch successful attacks in the cloud are increasingly available on the dark web. Anyone trying to “shoehorn” traditional security products and techniques into their cloud environment needs to be confident that they are not compromising their security preparedness. 

Zero-day threats are particularly difficult to detect, yet critical to defend against. Signature-based anti-virus solutions, traditional firewalls and even intrusion defence systems are fine when dealing with known malware. But they become problematic when they present as something that hasn’t been seen before. A zero-day threat in your cloud environment could enable attackers to access your sensitive customer data and trade secrets, or simply give them an opportunity to spread ransomware.

A determined hacker will always find a way into a system. The important thing to focus on is detecting this as soon as possible. The longer you allow an attacker to stay active, the deeper they can go and the more damage they will inflict.

Taking control

Business users keen to accelerate moves to the cloud can sometimes risk paying insufficient attention to safety or security, so it is important for IT leaders to take control. The reality is that when it comes to the cloud, you can’t outsource responsibility, so businesses need to be proactive about vetting providers, understanding what security controls they have in place and where and how data is stored. But most importantly, they need to work out what protections they still need to put in place “over the top” to keep key data and systems safe from harm.

Central to any security strategy should be to reduce the attackers’ “dwell time” – the time between infection and detection – which currently averages an unacceptable 146 days. Some organisations set up alerts to help them spot unusual behaviour. Unusual, however, is not necessarily a problem but it can swamp teams with too much data to investigate, inevitably leading them to spend so much time fire-fighting that they can miss the all-important needle in the haystack.

Threat intelligence needs to be consolidated to be genuinely useful;  part of this is being able to baseline normal behaviour in order to better spot unusual activity that indicates a breach. Applied in the right way, machine learning can help by systematically prioritising only the most critical threats to maximise your response team’s effectiveness. Given the more exposed and accessible nature of cloud systems, these approaches become even more important.

Talk, talk, talk

Detecting threats is one thing, but taking action on major issues typically requires wider understanding from technical and business teams. That means being able to describe threats and impacts in a way that is meaningful beyond security operations. It doesn’t matter how impassioned you are about threat vectors, unsecured APIs, or inter-VM attacks, it will mean nothing unless they are translated into the right risk lexicon.

Highlighting a compliance failure may be met with blank stares but if it means no revenue because the business can’t process payments it takes on a greater significance and will be rectified quickly. Similarly, a report of a security issue affecting a number of virtual servers may not be seen as a priority until the associated business impact and the potential loss of customer data and resulting financial and reputational impacts are clearly understood by management. To support this, companies are increasingly investing in intelligent systems that can articulate the specific business risk to the organisation of a given cyber threat.

Cloud computing is here to stay, and is transforming organisations across the globe. But it has also introduced new challenges that many organisations are still coming to grips with. IT teams, security functions and business stakeholders need to communicate effectively, in a common language, to understand and manage cyber risks in this new outsourced world. 

Without a clear strategy for cost control and an architecture designed with cloud services in mind, costs and operational performance can quickly get out of control. To avoid multiple architectural redesigns requires extensive thought and planning. Boundary (now part of BMC) launched a new public-facing multi-tenant high resolution monitoring service on Amazon AWS two years ago, facing challenges and learning best practices in the early days of the new service.

read more

In the first article of this three-part series on hybrid cloud security, we discussed the Shared Responsibility Model, and examined how the most common attack strategies persist, are amplified, or are mitigated as assets move from data centers to the cloud. In part two, we talked about the unique security challenges that are introduced by public cloud environments. In this third and final installment, we’ll review why it’s essential to approach hybrid cloud security with different methods, tools and best practices than those used in the data center.

read more

Digital transformation is happening everywhere. It starts with an expectation that whatever an organization does in the real world is supported by—and expands through—its digital presence. As the process continues, digital transformation should drive innovative ways to engage customers, get the most from resources and differentiate its way into completely new markets.
All these great expectations come from both within and outside an organization, and can add up to a big challenge for any team. According to MIT Sloan Management Review, “Preparing for a digital future is no easy task. It means developing digital capabilities in which a company’s activities, people, culture and structure are in sync and aligned toward a set of organizational goals.” (MIT SMR, July 26, 2016)

read more

Digital transformation.
It’s only two simple words, but in the increasingly complex, customer-centric enterprise IT landscape, it’s a phrase that carries multiple meanings — to the point where some would probably observe, tongue-in-cheek, that it doesn’t mean anything anymore.
It’d be hard to argue that “digital transformation” hasn’t been pushed into buzzword territory by those of us who write about business IT, but I feel like that speaks more of the concept’s genuine relevance and importance to the success of today’s digital first enterprises than just simple hype. The sports media talks about the Golden State Warriors, Cleveland Cavs, and their superstar players a lot, too.

read more

A new survey from machine data analytics provider Sumo Logic has found more than two thirds of enterprises either plan to adopt DevOps or are already doing so, while four in five are currently or plan to use at least one public cloud service.

The study, titled ‘The New Normal: Cloud and DevOps Analytics Tools Reign in the Modern App Era’ and put together alongside UBM Technology, found that of the 230 IT operations, app development and information security professionals polled, 67% are utilising software as a service, while 42% are deploying and updating apps more frequently than in the past.

When it came to the types of public cloud service being used, Microsoft Azure (66%) and Amazon Web Services (55%) were the most popular. In another finding that was less than surprising, security was the biggest challenge to cloud adoption, cited by 27% of respondents. Only 6% of those polled thought the security of public cloud was ‘excellent’, albeit with 55% adding public cloud services were more secure than previously.

“As cloud computing becomes standard in IT organisations, concerns about security and loss of control persist,” said Amy Doherty research director for UBM Technology in a statement. “This new study confirms these findings and delves into best practices for how cloud-first companies are leveraging new tools and technologies to speed adoption.”

This publication has extensively covered previous DevOps research, with recent studies having a lack of consensus in common. Automation software provider Quali, taking data from various industry events in 2016, found earlier this month that the current vendor ecosystem was open-ended, while almost half of applications in traditional environments were considered ‘complex’ for cloud.

More than one in three companies admit it has been either ‘difficult’ or ‘very difficult’ to find specific cloud skills for their organisation, according to a new study from Microsoft.

The dreaded ‘cloud skills gap’ has been long reported by this publication – ‘the trend will continue further through 2013’, this reporter once warned – but in the Microsoft report, titled ‘Closing the Cloud Skills Gap’, only 31% of the 250 respondents polled said they have recruited for cloud skills over the past 12 months. 8% of overall respondents said it was ‘very difficult’ to find the right skills, compared with 30% who opted for ‘difficult’.

One contributing factor to the continued malaise is that companies are being forced to think ‘beyond their established business models’, Microsoft notes; for instance, Rolls-Royce now sells flight miles as opposed to aircraft engines, and RAC is a pre-emptive vehicle maintenance service as well as offering roadside assistance.

“Those organisations that are forced to stall their transformational journeys due to a lack of skills will find themselves facing significant challenges,” the report notes. “Indeed, they may find that by the time they are able to meet the demands of both customers and employees, the market has moved on, rendering them irrelevant.”

It’s not as if organisations are setting the barrier especially high either: only 8% say recognised cloud certifications were ‘essential’ when recruiting, compared with 27% who say they are ‘highly desirable’ and 45% ‘nice to have’. That said, if most people’s job hunts are anything to go by, ‘highly desirable’ usually means ‘you probably should have it’; and as the report notes, “those people that do have certifications will enter the interview room with an advantage.”

The study also looked at closing the gender gap within technology firms; 22% of companies with 250 to 999 employees said they had zero female contingent, although on the plus side not one organisation with more than 1000 employees opted for 0%; the most popular bucket was 30-39% (26% of respondents).

Ultimately, the study argues that while there is still work to be done, the figures can be spun in a positive light for those who want to move into the industry. “Whilst the data outlines the challenges that many organisations face, it should make for positive reading for those interested in pursuing a cloud career or for businesses that already offer cloud consultancy to other organisations,” the report notes.

“With demand outstripping supply, those equipped with cloud skills can be confident that their talents will be required for the foreseeable future.”

When it comes to gaining those cloud skills for an organisation, the best advice is to plan ahead and prepare for as many situations as possible. “You can’t move to the cloud until you understand fully the shape of your current IT estate and the applications which support the organisation,” wrote Eduserv’s Andrew Hawkins in this publication last year. “Mapping these will allow you to understand areas which are compatible and incompatible with a cloud operating model ahead of time.”

For individuals looking to beef up their talents, IT learning organisation Firebrand Training offered its five key in-demand skills for 2017 back in February, citing database and big data, application security, enterprise cloud migration, containers, and cloud enterprise application development. Naturally, Microsoft wants to be at the forefront of enabling businesses, outlining its commitment to train 500,000 digital specialists and 30,000 public servants by 2020.

Elsewhere, Microsoft announced that its UK Azure data centres are now compliant with the Payment Card Industry (PCI) Data Security Standards (DSS) certification, outlining the move as ‘crucial’ for storing customers’ financial details. The news comes at an interesting time, especially given reports elsewhere over problems with AWS provisioning in its UK base.

You can read the Microsoft report in full here (no registration required).

Read more: The top five in-demand cloud skills for 2017