The bi-directional cloud highway

1 September 2019 Editor's Choice, Information Security, Integrated Solutions

The development of the cloud over the last 15 years is one of the most significant convergences of computing and communications technologies in history. It provides unprecedented agility and scalability for organisations, immediate access to information and transactions for individuals and has transformed our global economy similar to smartphones and IoT devices.

It has also resulted in one of the most unique technology transitions in history. Traditionally, whenever a new technology arrives – whether the steam engine or the Internet – there has been an orderly and often rapid transition from old to new tools. The advent of the cloud looked to be on a similar trajectory based on the initial assumption that it would be the best choice for all IT infrastructure.

However, according to a recent IHS Markit survey sponsored by Fortinet, infrastructure, applications, and data are continually moving back and forth between on-premise physical networks to private/public cloud infrastructures as organisations try to figure out where and how it is most appropriate for them to use the cloud.

Multi-cloud is here to stay

Of the 350 companies surveyed, 74% had moved an application into the public cloud, and then for a variety of reasons and circumstances, decided to move it back into their on-premises or private cloud infrastructure. This doesn’t mean they reversed all of their cloud deployments, just that they are encountering cases for bi-directional movement.

For example, 40% of respondents noted that, in some cases, the cloud deployments they moved back into their infrastructure were ‘planned temporary’ deployments. This could be due to a variety of factors, such as the need to set up a temporary infrastructure during an IT transition associated with a merger or acquisition. However, there are many other issues at play that could also be responsible, including concerns about security, the need to manage costs, poor performance in the cloud, shifting regulations, development of new applications, and changes in underlying technologies.

Whatever your plans, plan for change

One crucial reality of the forces that drive these changes is that they are in constant flux, making the dynamic multi-cloud the new environment that many companies now need to live in. Companies deploying applications and other resources into the cloud, and the technology providers that help them with infrastructure, management, and security, now need to consider this new reality as a baseline condition and build products and services with bi-directional movement and co-existence in mind.

To truly take advantage of the best of the cloud, organisations need to make sure the tools and technologies they use are offer consistent capabilities, the ability to automate operations and good visibility across environments, meaning they should operate across a variety of public cloud environments, as well as in private clouds and on-premises physical networks. While moving applications and DevOps services between cloud environments is seamless and straightforward, security can be more of a challenge.

When cloud deployments keep shifting, who owns security?

The first challenge is identifying who owns security in the event of a malicious cyber incident. When asked about the factors driving them to move applications back into their infrastructure, the top two responses – each selected by 52% of respondents – were performance and security.

While performance is likely to improve over time as practices building applications in the cloud improve and organisations better establish expectations, security is a more vexing problem because many companies don't have a good handle on who is responsible for what. In a best-case scenario, where it is clear who should be responsible (such as the existence of a vulnerability in the virtualisation/cloud platform), only about half of respondents were able to pin the root cause where it truly belongs: on the company who built or implemented the vulnerable technology.

Of course, this is a cynical response built on long experience working with flawed technology riddled with vulnerabilities for which IT and security teams accept responsibility, and in most cases, where they have made the decision to go with these technologies. Conversely, a high percentage of respondents incorrectly held their cloud provider responsible for higher layer threats (like APTs) affecting vulnerable systems they have chosen to deploy where in fact the organisation itself is responsible.

While security responsibilities can be generally divided between the underlying cloud infrastructure (which needs to be secured by the cloud provider) and the software, data, and applications running on top of that infrastructure (which are the responsibility of the consumer), those divisions aren’t always so neatly divided – especially as we step into PaaS and FaaS.

The best rule of thumb is that one must consult with best practices pertaining to every cloud service that the company is consuming. And expect the cloud provider only to provide an isolated, available work environment to run these services. The cloud is a shared infrastructure, and when it comes to security events, it’s important to distinguish between the organisation’s responsibility to the cloud provider in order to effectively address risk.

The other challenge is that security tools, functions, policies, and protocols don’t operate similarly between different public cloud platforms, private clouds, and physical infrastructures. While moving an application or service from one environment to the next may be straightforward, many security solutions require a significant amount of IT resources to redeploy and validate a security solution, especially when workflows, applications, and data need to be inspected and secured as they flow between different environments.

Resolving this issue can be complicated. It starts with standardising with a single security vendor that has solutions that run consistently across the broadest possible range of public cloud, private cloud, and physical environments. Next, these tools need to run natively in the various public cloud environments to maximise effectiveness, while seamlessly translating policies, functions, and protocols between different environments using some form of cloud objects abstraction layer. These will yield the best results as existing security operational models remain applicable across a diverse and dynamic environment.

Conclusion

The transition to the cloud has been anything but an orderly process. However, for the foreseeable future, applications and services are going to constantly be moving back and forth between different environments until organisations find the combination of public, private, and on-premises solutions that work best for them. And even then, there will continue to be plenty of reasons why applications, infrastructure, and other resources will need to be moved.

In this new dynamic environment, security cannot afford to be something bolted on after the fact or implementing multiple diverse tools. This approach inevitably leads to issues like vendor sprawl, deployment delays, and security gaps due to things like configuration incompatibilities and differences in functionality and policy enforcement between security solutions deployed in different environments.

As a result, adopting an integrated security strategy that can be used using a streamlined security management operational model, see and manage security devices and policies across the entire distributed network, that run natively in different cloud environments while maintaining consistent enforcement, and that can adapt seamlessly as network continues to evolve, are table stakes in today's new digital economy.




Share this article:
Share via emailShare via LinkedInPrint this page



Further reading:

Phishing attacks through SVG image files
Kaspersky News & Events Information Security
Kaspersky has detected a new trend: attackers are distributing phishing emails to individual and corporate users with attachments in SVG (Scalable Vector Graphics) files, a format commonly used for storing images.

Read more...
A passport to offline backups
SMART Security Solutions Technews Publishing Editor's Choice Infrastructure Smart Home Automation
SMART Security Solutions tested a 6 TB WD My Passport and found it is much more than simply another portable hard drive when considering the free security software the company includes with the device.

Read more...
Navigating the complexities of privileged access management
Editor's Choice Access Control & Identity Management
Privileged Access Management and Identity Access Management are critical pillars of modern cybersecurity, designed to secure access to sensitive resources, enforce principles like least privilege, and implement just-in-time access controls.

Read more...
The impact of GenAI on cybersecurity
Sophos News & Events Information Security
Sophos survey finds that 89% of IT leaders worry GenAI flaws could negatively impact their organisation’s cybersecurity strategies, with 87% of respondents stating they were concerned about a resulting lack of cybersecurity accountability.

Read more...
Rewriting the rules of reputation
Technews Publishing Editor's Choice Security Services & Risk Management
Public Relations is more crucial than ever in the generative AI and LLMs age. AI-driven search engines no longer just scan social media or reviews, they prioritise authoritative, editorial content.

Read more...
Efficient, future-proof estate security and management
Technews Publishing ElementC Solutions Duxbury Networking Fang Fences & Guards Secutel Technologies OneSpace Technologies DeepAlert SMART Security Solutions Editor's Choice Information Security Security Services & Risk Management Residential Estate (Industry) AI & Data Analytics IoT & Automation
In February this year, SMART Security Solutions travelled to Cape Town to experience the unbelievable experience of a city where potholes are fixed, and traffic lights work; and to host the Cape Town SMART Estate Security Conference 2025.

Read more...
Historic Collaboration cuts ATM Bombings by 30%
Online Intelligence Editor's Choice News & Events Security Services & Risk Management
Project Big-Bang, a collaborative industry-wide task team, has successfully reduced ATM bombings in South Africa by 30,7% during the predetermined measurement period of November, December and January 2024/5.

Read more...
Security industry embraces mobile credentials, biometrics and AI
AI & Data Analytics Access Control & Identity Management Integrated Solutions
As organisations navigate an increasingly complex threat landscape, security leaders are making strategic shifts toward unified platforms and emerging technologies, according to the newly released 2025 State of Security and Identity Report from HID.

Read more...
World-first safe K9 training for drug detection
Technews Publishing SMART Security Solutions Editor's Choice News & Events Security Services & Risk Management Government and Parastatal (Industry)
The Braveheart Bio-Dog Academy recently announced the results of its scientific research into training dogs to accurately detect drugs and explosives without harming either the dogs or their handlers.

Read more...
The need for integrated control room displays
Leaderware Editor's Choice Surveillance Training & Education
Display walls provide a coordinated perspective that facilitates the ongoing feel for situations, assists in the coordination of resources to deal with the situation, and facilitates follow up by response personnel.

Read more...