Welcome!

Related Topics: @CloudExpo, Java IoT, Linux Containers, Containers Expo Blog, Cloud Security, @DXWorldExpo

@CloudExpo: Article

Mastering the Balancing Act of #Cloud Security and Business Agility

There are three clear control capability areas needed for IT to effectively manage financial, reputation and legal risk

In 2012, an IDG survey of enterprise cloud computing adoption showed that 70 percent of respondents said security was among their top three concerns, and two years later, not much has changed. The Everest Group Enterprise Cloud Adoption Survey released in March of 2014 shows that 70 percent of enterprises prefer private cloud because it offers higher security - a clear indication that security concerns still weigh heavily on the minds of enterprise leaders. Centralizing cloud resource access could prove to be the path through, addressing security concerns while providing the agility cloud computing promises.

It is understandable how cloud security presents itself as a chief IT concern when you consider that cloud computing transfers control from IT to business users and developers. And that adopting cloud entails replacing numerous IT processes with self-service portals.

While there are innumerous benefits to adopting cloud computing, transferring control away from IT does open the business to risk as it diminishes IT's ability to protect the organization's resources and data against unauthorized access and misuse. It also ties IT's hands when it comes to identifying and resolving security issues, and enforcing compliance with industry regulations. These are critical functions that have direct impact on business risk.

Addressing Business Risk via Security Controls
Cloud computing transforms the way infrastructure is provisioned in an organization. It replaces the centralized IT-controlled infrastructure provisioning model where developers make an infrastructure request that IT reviews and then fulfills, with a new, distributed developer-centric infrastructure provisioning process where developers effectively bypass IT. As a result, enterprises adopting cloud find themselves in a paradoxical situation where IT is responsible for the infrastructure security that developers now control.

There are three clear control capability areas needed for IT to effectively manage financial, reputation and legal risk.

  • Preventive capabilities: IT must be able to prevent insecure provisioning requests from being fulfilled, on both a per-user-role and per-environment basis. For example, IT must be able to enforce specific firewall policies for production infrastructure.

    In order to satisfy developer requirements, it is obvious that IT cannot change the way cloud infrastructure is accessed: provisioning must remain self-service. As a result, IT needs transparent and automated policy enforcement. Provisioning requests made to the organization's cloud need to be inspected in real-time and checked against governance policies that are in place. When approved, requests must be forwarded to the relevant cloud API; when denied, the developer that made the request must be immediately informed. Ideally, the developer should be provided with an explanation and an alternate course of action should be suggested.
  • Detective capabilities: IT must have a centralized view of infrastructure to identify vulnerabilities and intrusions; IT must be able to understand the purpose of every resource provisioned by the business. For example, IT must be able to identify the configuration of every deployed resource and the environment to which it belongs. That knowledge can then be used to decide whether an unusual firewall configuration or activity pattern should trigger an alert.


To satisfy these requirements, IT needs a federated view and understanding of all of the business's cloud resources, ensuring visibility over the organization's cloud resources. To do so, IT must ensure that every provisioning request is associated with a legitimate owner and use case (ideally in an automated fashion); that all provisioned resources remain visible throughout their lifecycle; and that metadata regarding their purpose remains accessible.

  • Corrective capabilities: IT must control access to the business's cloud infrastructure.  For example, IT must be able to revoke access for employees that leave the company, and be able to centrally identify and patch affected resources when a vulnerability is identified.

    To do so, IT needs centralized credential management to govern access to cloud resources. IT must ensure that access to cloud resources is controlled by the organization's existing identity management infrastructure, and not by ad-hoc SSH keys or RDP passwords created by developers. Naturally, in order to not hinder developer productivity, IT must ensure that developers can still access the resources for which they have a legitimate use.

Where the Rubber Meets the Road
Cloud security has been an issue since 2006 when cloud emerged with the release of AWS EC2. Back then, all cloud instances were exposed to the Internet, and access was only available with root keys. To address these respective problems, Amazon announced AWS Virtual Private Cloud and AWS Identity and Access Management. Some AWS competitors have also issued access control management, though they remain somewhat limited. Yet, these controls only address IT's preventive needs, are only available on AWS as of this writing, and are often complex to use.

As a result, IT is frequently opting to deploy a cloud management platform (CMP), an often on-premise, web-based application, that sits between end-users and the multiple cloud platforms that they may use. CMPs are extensible platforms that let IT departments customize the CMP's behavior to fit their organization's workflows and policies.  In turn, CMPs enforce those IT policies in a fully transparent and automated fashion, so that developers aren't slowed down by red tape when getting work done. As a result, CMPs ensure that IT is provided the security capabilities it requires, while ensuring developers retain the agility they need.

Most importantly, CMPs play a critical role in addressing all three control capability areas:

  • Preventive: CMPs can provide IT with governance and role-based access control capabilities, and empower IT to secure and control access to cloud resources on a per-user or per-user-group basis. Using a CMP, these policies can be enforced in real-time, so that developers are not slowed by their enforcement. IT can, for example, ensure that specific firewall rules are automatically added for every single instance that is launched, and that instances are automatically launched in secure networks (e.g. a specific AWS Virtual Private Cloud, or VPC).
  • Detective: Because CMPs are used for the provisioning of all the organization's resources, they may automatically keep a precise account of the resources that were provisioned, by whom, and for what purpose. As a result, resource tracking can be performed automatically, and developers won't have to perform extra effort to comply with IT policies.
  • Corrective: CMPs may centralize the creation and use of CMP-controlled credentials and make those available to dev and IT, or automatically configure cloud resources to leverage the company's existing identity management framework instead. For example, with a CMP, IT can enforce developer use of Active Directory credentials to login to their instances.

While cloud momentum continues to grow, so does concern - rightfully so - for cloud security. While IaaS providers have taken steps to address these concerns within their systems, they do not currently address the spectrum of capabilities needed to fully address business risk. CMPs are an effective option that can be deployed in a way that addresses IT, business, and developer needs.

More Stories By Sebastian Stadil

Sebastian Stadil is founder and CEO of Scalr. He has been a Cloud developer since 2004, starting with web services for e-commerce and then for computational resources. He founded the Silicon Valley Cloud Computing Group, a user group of over 8000 members that meets monthly to present the latest developments in the industry. As if that weren't enough, Sebastian founded Scalr as an open source project in 2007. Sebastian is a frequent lecturer on cloud computing at Carnegie Mellon University, and sits on the Google Cloud Advisory Board. When he is not working on Scalr, Sebastian likes to make sushi and play rugby.

Comments (0)

Share your thoughts on this story.

Add your comment
You must be signed in to add a comment. Sign-in | Register

In accordance with our Comment Policy, we encourage comments that are on topic, relevant and to-the-point. We will remove comments that include profanity, personal attacks, racial slurs, threats of violence, or other inappropriate material that violates our Terms and Conditions, and will block users who make repeated violations. We ask all readers to expect diversity of opinion and to treat one another with dignity and respect.


Latest Stories
Data is the fuel that drives the machine learning algorithmic engines and ultimately provides the business value. In his session at Cloud Expo, Ed Featherston, a director and senior enterprise architect at Collaborative Consulting, discussed the key considerations around quality, volume, timeliness, and pedigree that must be dealt with in order to properly fuel that engine.
Detecting internal user threats in the Big Data eco-system is challenging and cumbersome. Many organizations monitor internal usage of the Big Data eco-system using a set of alerts. This is not a scalable process given the increase in the number of alerts with the accelerating growth in data volume and user base. Organizations are increasingly leveraging machine learning to monitor only those data elements that are sensitive and critical, autonomously establish monitoring policies, and to detect...
"I will be talking about ChatOps and ChatOps as a way to solve some problems in the DevOps space," explained Himanshu Chhetri, CTO of Addteq, in this SYS-CON.tv interview at @DevOpsSummit at 20th Cloud Expo, held June 6-8, 2017, at the Javits Center in New York City, NY.
Andi Mann, Chief Technology Advocate at Splunk, is an accomplished digital business executive with extensive global expertise as a strategist, technologist, innovator, marketer, and communicator. For over 30 years across five continents, he has built success with Fortune 500 corporations, vendors, governments, and as a leading research analyst and consultant.
In his session at @ThingsExpo, Dr. Robert Cohen, an economist and senior fellow at the Economic Strategy Institute, presented the findings of a series of six detailed case studies of how large corporations are implementing IoT. The session explored how IoT has improved their economic performance, had major impacts on business models and resulted in impressive ROIs. The companies covered span manufacturing and services firms. He also explored servicification, how manufacturing firms shift from se...
You know you need the cloud, but you’re hesitant to simply dump everything at Amazon since you know that not all workloads are suitable for cloud. You know that you want the kind of ease of use and scalability that you get with public cloud, but your applications are architected in a way that makes the public cloud a non-starter. You’re looking at private cloud solutions based on hyperconverged infrastructure, but you’re concerned with the limits inherent in those technologies.
IoT solutions exploit operational data generated by Internet-connected smart “things” for the purpose of gaining operational insight and producing “better outcomes” (for example, create new business models, eliminate unscheduled maintenance, etc.). The explosive proliferation of IoT solutions will result in an exponential growth in the volume of IoT data, precipitating significant Information Governance issues: who owns the IoT data, what are the rights/duties of IoT solutions adopters towards t...
In his keynote at 18th Cloud Expo, Andrew Keys, Co-Founder of ConsenSys Enterprise, provided an overview of the evolution of the Internet and the Database and the future of their combination – the Blockchain. Andrew Keys is Co-Founder of ConsenSys Enterprise. He comes to ConsenSys Enterprise with capital markets, technology and entrepreneurial experience. Previously, he worked for UBS investment bank in equities analysis. Later, he was responsible for the creation and distribution of life settl...
With tough new regulations coming to Europe on data privacy in May 2018, Calligo will explain why in reality the effect is global and transforms how you consider critical data. EU GDPR fundamentally rewrites the rules for cloud, Big Data and IoT. In his session at 21st Cloud Expo, Adam Ryan, Vice President and General Manager EMEA at Calligo, examined the regulations and provided insight on how it affects technology, challenges the established rules and will usher in new levels of diligence arou...
For organizations that have amassed large sums of software complexity, taking a microservices approach is the first step toward DevOps and continuous improvement / development. Integrating system-level analysis with microservices makes it easier to change and add functionality to applications at any time without the increase of risk. Before you start big transformation projects or a cloud migration, make sure these changes won’t take down your entire organization.
When you focus on a journey from up-close, you look at your own technical and cultural history and how you changed it for the benefit of the customer. This was our starting point: too many integration issues, 13 SWP days and very long cycles. It was evident that in this fast-paced industry we could no longer afford this reality. We needed something that would take us beyond reducing the development lifecycles, CI and Agile methodologies. We made a fundamental difference, even changed our culture...
Digital transformation has increased the pace of business creating a productivity divide between the technology haves and have nots. Managing financial information on spreadsheets and piecing together insight from numerous disconnected systems is no longer an option. Rapid market changes and aggressive competition are motivating business leaders to reevaluate legacy technology investments in search of modern technologies to achieve greater agility, reduced costs and organizational efficiencies. ...
Organizations planning enterprise data center consolidation and modernization projects are faced with a challenging, costly reality. Requirements to deploy modern, cloud-native applications simultaneously with traditional client/server applications are almost impossible to achieve with hardware-centric enterprise infrastructure. Compute and network infrastructure are fast moving down a software-defined path, but storage has been a laggard. Until now.
DXWorldEXPO LLC announced today that Kevin Jackson joined the faculty of CloudEXPO's "10-Year Anniversary Event" which will take place on November 11-13, 2018 in New York City. Kevin L. Jackson is a globally recognized cloud computing expert and Founder/Author of the award winning "Cloud Musings" blog. Mr. Jackson has also been recognized as a "Top 100 Cybersecurity Influencer and Brand" by Onalytica (2015), a Huffington Post "Top 100 Cloud Computing Experts on Twitter" (2013) and a "Top 50 C...
In his session at 20th Cloud Expo, Mike Johnston, an infrastructure engineer at Supergiant.io, discussed how to use Kubernetes to set up a SaaS infrastructure for your business. Mike Johnston is an infrastructure engineer at Supergiant.io with over 12 years of experience designing, deploying, and maintaining server and workstation infrastructure at all scales. He has experience with brick and mortar data centers as well as cloud providers like Digital Ocean, Amazon Web Services, and Rackspace. H...