Reaching For The Cloud Wp101366
-
Upload
erik-ginalick -
Category
Documents
-
view
261 -
download
2
description
Transcript of Reaching For The Cloud Wp101366
Market Pulse
“It’s possible to do as good a job securing the cloud
as the local infrastructure, but it is more likely that
someone else has better economies of scale and
the specialization needed to help do it better than
you ever could,” says Chris Shull, director of informa-
tion technology for the Jewish Federation of Greater
Philadelphia.
IDG Research Services recently conducted an online
survey of 122 business and technology leaders across
a range of industries to gain a better understanding of
cloud security trends. Among its conclusions:
n Security for the cloud is a concern, but it is not as
troubling as other data threats.
n Nearly half of those surveyed use or plan to use
a hybrid approach to managing security for cloud
environments.
n A number of technologies are being deployed to ad-
dress security concerns, including integrating the exist-
ing security infrastructure into cloud environments.
Embracing the Cloud IT service models are evolving at record speed, though
none faster than cloud computing. CIOs everywhere
say they are considering the merits of the cloud com-
pared to traditional on-premise delivery. Specifically,
they say, cloud models enable enterprises to leverage
third-party expertise and more attractive economics,
while on-premise services offer greater control.
It leaders cite benefits, downplay security as they move applications to the cloud.Will security worries be the undoing of cloud adoption? Not likely, given other,
more pressing threats like device theft, mobility and IT consumerization. And with
new technologies able to mitigate the real and perceived risks inherent in hybrid
clouds—the combination of internal and external services—IT leaders say they
see opportunities to up the ante on security for greater end-to-end protection.
reaching for the Cloud
With advantages to both approaches, a hybrid cloud
strategy is increasingly becoming the preferred option.
In fact, 47 percent of those surveyed by IDG are using
at least one application and/or a portion of their com-
puting infrastructure via a hybrid cloud model, while
another 53 percent plan to do so in the future.
Those users confidently point to the top-line gains
from hybrid cloud deployment, including greater
market flexibility, improved business continuity and
innovation, superior customer service, a stronger
competitive edge and expanded revenue opportunities.
They also cite bottom-line efficiencies such as reduced
resource waste and savings on the CapEx front (see
figure 1).“My executives are thrilled to have more
features and capabilities, greater accessibility and bet-
ter security, all at a fraction of any reasonable cost one
could put on in-house systems,” Shull says.
Still, many IT professionals are reluctant to relinquish
management responsibility to outside parties. “Hybrid
cloud implementations effectively straddle internal and
public infrastructures, and can introduce complexi-
ties,” says Martin Capurro, director of Applications and
WP101366 12/10
Market Pulse
2
Infrastructure Solutions for Qwest, a network services
provider based in Denver. Working with two separate
infrastructures, CIOs must coordinate efforts, commu-
nicate and even share data with their cloud provider.
What’s more, today’s fluid perimeter—pocked with
mobile devices and social networking sites—becomes
harder to monitor in a hybrid environment.
Sorting Out Security Those issues eventually give way to the nagging
security concerns in the cloud, the greatest of which
is the protection of sensitive data. Survey respondents
are most focused on preventing data leaks, setting and
maintaining security policies, managing data access,
preventing intrusions and maintaining compliance (see
figure 2). And those risks can be compounded by a
dual environment. “A threat in one environment could
permeate the other,” explains Troy Herrera, enterprise
marketing director for Juniper Networks, a network
infrastructure provider based in Sunnyvale, Calif. A
hacker who gains access to a cloud application, for ex-
ample, could make his way into the enterprise network,
while an error in access control rights on the corporate
network could affect cloud application security.
Yet the security of the cloud does not appear to be
as pressing as other threats, with only 49 percent of
survey respondents considering cloud
security to be a significant risk. Seventy-
five percent consider lost or stolen devices
to be a significant security risk, 65 percent
fret about IT consumerization, and 56
percent worry about mobility.
All said, only 40 percent of the technol-
ogy and business leaders surveyed are
extremely or very confident that their
security infrastructure is prepared to pro-
tect data in the cloud. And that has them
weighing their cloud security options: Is it
better to own all aspects of security or to
outsource the whole function? On-premise
implementations offer a single security au-
thority, more control over data protection,
full visibility into one’s risk and compliance
posture, and less complexity. Managed services, on the
other hand, release CIOs from the financial and man-
agement burden of in-house solutions while enabling
them to leverage the security resources and expertise
of a third party.
“In biology, hybrids are often bred to gain the best
features of multiple breeds,” Shull says. “So is the ad-
vantage of combining multiple technologies to ensure
better security.” Some 45 percent of the survey respon-
dents agree, indicating they prefer a hybrid or mixed
approach to cloud security. With a mixed security
model, CIOs can maximize the advantages of managed
security services while maintaining control over their
critical data protection strategy.
Outsourcing to a third party can also be an afford-
able way to add security capabilities when budgets
are tight. Of course, there may be challenges in terms
of visibility and the ability to enforce security; but,
by working together holistically, communicating, col-
laborating and sharing reports, the internal-external
partnership can prove very beneficial.
Integrating Internal with External “A service provider can complement what you’re doing
and even enhance protection,” Herrera explains. “The
Benefits of a Hybrid Cloud Approach
Source: IDG Research, October 2010
Greater flexibility to react to changing market conditions
Reducing resource waste
Enabling business continuity
Savings on CAPEX
Enabling innovation
Improving customer support or services
Gaining a competitive/ information edge
Expanding revenue opportunities
Other
Don’t know
51%
48%
47%
43%
37%
34%
25%
19%
8%
3%
Market Pulse
3
to extend the network into the cloud.” Of
course, the networking component is still
evolving. Today, it’s all Internet-based, but
eventually the cloud will be delivered on
different fabrics, such as Ethernet. That
will enable technology leaders to create,
deploy and manage their infrastructure as
they have in the past, and thus maintain
the desired level of security, performance
and control over operations.
It’s equally important to establish process
integration. Setting up procedures by
which partners can share reports and
logs is critical, as is agreeing to common
escalation procedures, security policies
and compliance milestones.
Still, some level of separation can be advantageous:
“Keeping the multiple parts of our hybrid and multilay-
ered defenses disconnected adds important indepen-
dence and resiliency to them,” Shull says.
Investing Wisely As for specific technology integrations, CIOs have
zeroed in on the most pressing hybrid cloud security
concerns. Most respondents—about 80 percent—say
they have already implemented anti-virus, spyware,
spam filters and VPN technology. Web filtering, intru-
sion detection, network access control and firewalls
are nearly as popular (see figure 3). “These core tech-
nologies have been part of IT for a while,” Herrera says.
“Now CIOs need to focus on upgrades to accommodate
the changing environment and performance shift that
come with cloud infrastructure.”
New technology investments are critical as infra-
structure becomes more complex. The top priority for
50 percent of respondents going forward is security
incident and event management (SIEM), which offers
crucial visibility into event anomalies and provides a
centralized portal in which to view logs. Data loss pre-
vention and identity and access management (IAM)—
which can work in conjunction with one’s NAC solution
to protect data and enhance access control—were also
key is to implement the proper security measures with
the goal of achieving end-to-end security, and to be
cognizant not to weaken security along the way.”
One of the IDG survey respondents concurs, advis-
ing that CIOs “start by extending existing capabilities
into the cloud.” Security has long been integral to
internal infrastructure, and those investments should
be expanded into the cloud. Some 82 percent of
respondents agree, saying interoperability with existing
security solutions is very important.
Many security solutions can work together, whether
on-premise or in the cloud, Herrera adds. For example,
an in-house network access control solution can
identify users by communicating with an outsourced
VPN. A Web services application secured in the cloud
could store underlying data in an internal SAN. And a
service provider offering can federate with the internal
environment to protect and enforce identities. CIOs
just need to coordinate with their vendors to ensure
interoperability.
Part of that process, Capurro suggests, involves inte-
grating core infrastructure elements with the cloud
environment—including the network. In fact, one
respondent cautions technology leaders to “make sure
that the hosting provider has a clear strategy for how
Cloud Security Concerns
Source: IDG Research, October 2010
Preventing data leaks
Setting and maintaining security policies
Managing access to data
Detecting/prevent intrusion
Keeping compliant with data retention laws and regulations
Encrypting data
Backup and recovery
Detecting/prevent viruses and spam
Managing patches
61%
56%
54%
52%
52%
49%
49%
48%
36%
Market Pulse
4
cited as likely investments in the coming year.
Capurro believes IT professionals should put more
stock in service level agreements as well. Cloud envi-
ronments must provide not just scale and flexibility, but
also performance assurance, including speed and avail-
ability. Application performance management solutions
can supplement those agreements and give CIOs the
visibility they need to monitor platform performance.
Provisions must be made for data portability in terms
of moving and retrieving data.
The Bottom Line Since moving certain critical business applications,
including e-mail, to the cloud, Shull says he is “enjoying
better security” than he could provide in-house. The
IDG survey respondents already using cloud services
agree: They expect hybrid cloud implementations to
enhance security through improved service perfor-
mance, 24/7 support, higher levels of expertise, a reduc-
tion in dedicated security staff resources and lower
security management costs.
So can CIOs really trust the cloud with their most criti-
cal data? “Absolutely,” Herrera says. “You just have to
be smart in its management.” So go ahead and reach
for that cloud—and its silver lining.
About Juniper Networks
Juniper Networks is in the business of network innova-
tion. From devices to data centers and consumers to
cloud providers, Juniper Networks delivers the software,
silicon and systems that secure infrastructure and trans-
form the economics of networking. For more informa-
tion, visit (www.juniper.net).
About Qwest
Building on unparalleled network services, Qwest helps
businesses leverage existing and emerging technology.
In addition to services utilizing over 173,000 network
miles, Qwest has technology and expertise that extends
to broader applications and technologies. For more
information, visit (http://www.qwest.com/business/
solutions/why-qwest/list.html
The right approach to securing a hybrid cloud
infrastructure can quickly dispel any lingering
doubts about data protection. Some of the IDG
survey respondents offer the following advice:
Do the proper planning. “Understand your
company’s current needs as well as those for
the next five to 10 years. That will save you
time and effort as well as money,” says one
respondent. CIOs are advised to take their time
and think holistically. Others suggest engaging
in a third-party security audit, site inspec-
tions, penetration testing and piloting before
deploying any solution. And always read the
fine print, they say, especially in service level
agreements.
Shop for the right partner. “The cloud is as dan-
gerous as posting your data to Facebook if you
have not done a security review of the cloud
vendor,” warns one respondent. CIOs should
make sure they know who they are dealing
with. Understand not just the vendor’s security
practices and infrastructure capabilities but
also their long-term plans and financials.
Partners should be well rounded, with multiple
offerings and expertise in transport as well as
security products.
Choose solutions carefully. “Use only trusted
solutions,” advises a respondent. When it
comes to infrastructure, CIOs must evaluate
an offering’s scalability and performance.
Establish a “trust zone” for data protection,
and inspect data center facilities. Technology
solutions should be geared toward longevity—
consider open-standards approaches to
ensure interoperability with new technolo-
gies. Look for manageability and operational
simplicity. And whenever possible, strive to
consolidate multiple security solutions onto a
single platform.
A Few Words from Your Peers