Contrary to what many people think, there is not a single cloud. There are a variety of cloud-based providers that have dedicated server space around the world. It should be evaluated how to find the best fit for your company.
Despite all the buzz in the last decade, the cloud remains a mystery to many users who rely on datacenters on a day-to-day basis. The cloud made it easy for companies to embrace a range of “as-a-service” technologies seamlessly and reduce operational cost by eliminating the need to purchase security tools and devices.
However, adopting cloud operations blindly – as with any new workflow or technology – comes with risk. This is especially important in the context of how these tools are delivered and whether they are appropriate for an organization based on specific needs.
There are a wide variety of cloud-based security providers that have space on dedicated servers around the world, and each offer is unique based on its own business focus and demographics. The cloud providers that operate most widely in the enterprise are cloud-sharing environments where customer data and information are managed in a database and controlled using the same central operating system.
Although a shared environment may not be very worrying when cloud applications are used for programs such as marketing, they do not involve customer data or other personally identifiable information. However, there may be significant impacts on companies that store and manage customer data in the cloud, for example, when security tools can redirect traffic from a customer from one jurisdiction to a data center in a location with a different set of standards of conformity. If a company operates within an industry that is devoid of heavy regulations – especially where geolocation and information sharing is a matter of concern, they need to make sure that their cloud provider is not bringing the data to a location that the leaves them exposed to compliance penalties.
A significant concern when implementing cloud security solutions from a shared cloud provider is that these tools can force organizations to deploy a range of non-compliant security solutions by requiring multiple management consoles to create a disjointed workflow. For example, in situations where organizations are collecting highly sensitive information, they may require a secure gateway to ensure that data is isolated from external traffic. The traditional “hybrid” solution – using cloud-based and on-site security tools to investigate traffic – does not provide a seamless view across the organization, resulting in blind spots of security that affect teams’ ability to respond to an incident.
Most new cloud security solutions within the industry decouple the physical from the virtual and provide a multi-client cloud with non-shared resources that offer the best of both worlds. The result is greater visibility across the organization, response times to lower incidents and substantial cost savings, avoiding the need to purchase equipment. Companies need to consider protections that can align their security mission without forcing teams to continually buy hardware and complicate their security infrastructure.