Securing your data used to be simpler (if not necessarily easy). You had IT infrastructure in your data center. You adopted security controls at all levels – from physical security, controlling who could enter the facility, up through the network and system, and application layers. IT security looked a lot like perimeter security in a building – the valuables are inside, the attackers are outside, so you have good walls and strong locks and monitor what passes through.
The cloud explodes this model. Today, your data is in your own facility, at a managed hosting provider’s data center, and at your cloud provider. And while you’ve got a specific set of servers and network connections at the hosting provider – you can even go see your servers if you want to! – in the cloud you’ve got virtual machines that vary in number and location within the cloud environment. In a dynamic, autoscaling cloud the number of VMs you’re using may change hour to hour. And wait, there’s more – your employees, customers, and partners are accessing that data not just on IT-approved workstations but on iPads, Android phones, and probably Google Glass before long with the rise of BYOD.