Even though cloud computing has only been available publicly for about a decade, the rate at which businesses are moving to the cloud is increasing rapidly. When the decision is taken to move to the cloud, specifically the hybrid cloud model, it is important to compile a cloud strategy first. This should include both infrastructure and operational factors – however, one of the most important factors is hybrid cloud security.
If you want to skip ahead, the questions are listed below:
1. Do you fully understand all regulatory compliance laws pertaining to your data?
2. Can you configure and maintain your security policy uniformly across the entire network?
3. Have you decided where your data will be stored?
4. Is your data protected when moving between cloud demarcation points?
5. Are all your security tools, procedures and practices scaled for growth?
1. Do you fully understand all regulatory compliance laws pertaining to your data?
No matter the type of data your organization handles, from credit card data to confidential patient information, or whether your data is located across several countries, the onus is on you to prove and ensure that (at least) the minimum level of data security measures are met. Often your cloud provider will be able to tell you which compliance standards they meet; any additional compliance requirements falls on you to meet.
2. Can you configure and maintain your security policy uniformly across the entire network?
The primary goal of your hybrid cloud should be to do exactly that – configure and maintain your security policy uniformly across the entire network. This should include infrastructure policy such as firewall rules, IPS signatures and user authentication. It should be noted, however, that transferring security features is often a manual process which is why IT security professionals often look to multi-cloud management platforms to ease the burden by centralizing network and security policies.
3. Have you decided where your data will be stored?
Probably one of the most pressing issues for data security administrators is data visibility and a massive amount of thought needs to do into deciding where to store data. It is therefore important to have the necessary checks and balances in place to track data storage locations and traffic flows when moving sensitive data into the control of a cloud service provider.
4. Is your data protected when moving between cloud demarcation points?
It is always sensible to encrypt data while at rest but because you dealing with a multi-tenant scenario within a cloud service provider’s network, it becomes an absolute necessity and no longer just the sensible thing to do. You further have to consider protecting your data while in motion, in use and being processed by a cloud application. Doing so will ensure data protection throughout the entire lifecycle.
5. Are all your security tools, procedures and practices scaled for growth?
This is an important consideration when developing a hybrid cloud security strategy. You do not want to run into restricting cloud scalability because you failed to build a security architecture geared towards growing alongside your other infrastructure resources.
Fortunately, there are solutions to all five questions asked above. The important part is to identify your security needs as early as possible and before moving to the hybrid cloud.
