Mentioning cloud can sometimes set off warning lights in the minds of stakeholders. When these danger signs bring on instant feelings of foreboding, we should all step back and look at what really gives us fear: Is it the cloud infrastructure itself or the path our data takes to get there?
The root of cloud security concerns is normally about trusting a third party with important data. As businesses transition to a software-defined data centre, they’re often focused on how to replicate the layers of security to which they are accustomed. But the most common misconception that influences cloud security concerns is the notion that using cloud means using the Internet.
There is plenty of debate around the definition of cloud computing, but when thinking about cloud security, it’s important to note that many formal definitions avoids the term ‘Internet’ at all. The U.S. National Institute of Standards and Technology defines cloud computing as requiring ‘broad network access.’ It is a deployment, procurement and control paradigm; it does not need to be synonymous with using the Internet.
As cloud adoption increases, and private clouds proliferate, businesses are asking the important question: “Why can’t I just tap into public cloud over the corporate network I already pay for?” It’s beginning to dawn on companies that they don’t require Internet transit.
Increasingly, cloud providers are offering tunnel-based and cross-connect-based methods for accessing public clouds. These offerings are a good first step, but they face the same scalability concerns as the “spaghetti” problem of leased-line proliferation.
Virtualising private access paths through the wide area network is another good idea that’s been around for over a decade – and having cloud computing resources at some of the end points doesn’t change that. An effective strategy for mitigating risk lies in taking a blended approach that uses services like private IP-VPN bundling, network-based firewalling and software-defined data centre clouds.
Providers that integrate these services can help remove burdens like the ‘cloud tax’, which arises when businesses get charged market-rate network fees for accessing their data once it’s in the cloud. These providers can also help decrease network sprawl, allowing businesses to keep the same security perimeter they’ve always known, while still accessing cloud computing resources. This is the real benefit of what we mean when we talk about “hybrid cloud.”
Increasingly, there are two types of cloud computing players: those that push a software platform, and those that stress network connectivity. Neither approach can be achieved without borrowing technology from each other. Perhaps that’s why we’re increasingly seeing customers build enterprise architecture that leverage both paths. The public cloud is optimised for software agility and mobile application models, while the private/hybrid cloud enables, secure, cost-effective connectivity across established business partners and platforms.
The next time you’re in a discussion regarding cloud security concerns, ask your team the question: “Are we concerned about the cloud or are we concerned about the method for getting there?” Answering this question is imperative when finding the right type of cloud services platform.