Bitglass, the Next-Gen CASB company, has cautioned that organisations need to adopt new strategies to avoid over-reliance on a single vendor and reduce the risk of threats such as DDoS attacks.
“A multi-cloud setup generates cost savings, yields performance optimisation, and improves up-time to ensure that operations run at all times. Three tactics will enable organisations to create a successful multi-cloud strategy,” said David Shephard, Bitglass Vice President Asia Pacific.
According to Shephard, the advantages include abandoning a ‘one-cloud-fits-all’ approach and using multiple services from different cloud providers delivers a raft of organisational benefits. Multi-cloud gives businesses the freedom to select offerings that suit their specific needs while structuring different workloads into separate environments to stay in line with their business goals and policies. They maintain their flexibility and operate in their preferred fashion.
Companies are moving their data to the cloud to automate operations, enabling bring your own device (BYOD) systems, as well as integrating technologies like AI, IoT, blockchain, and new cognitive tools in order to increase overall efficiency.
While improvements to cloud management tools have made it easier for multi-cloud IT environments to deploy and operate, some challenges remain. Security is a fundamental issue that can’t be ignored, and while cloud providers have appropriate protocols and tools to ensure that their offerings are safe, the responsibility for securing data (particularly at access) still lies with the enterprise.
CISOs usually understand the criticality of data and threat security, so they are selective when it comes to cloud vendors and third party tools for securing data access.
Three key factors are essential for enterprises seeking the benefits of multi-cloud without compromising on security.
#1 Come to grips with cloud reality
In using the cloud, and even more so with multiple cloud vendors, the traditional models of data management and security don’t apply. No longer confined to a controlled environment on premises, employees are able to access enterprise data from any location, on any device, and at any time. This means that information will be flowing in and out of cloud applications via infrastructure that the enterprise does not own or control.
Traditional security tools are not built to protect cloud data accessed from these personal devices and off-premises networks. As companies begin moving data from on-premises solutions to the cloud, they must address new cloud-specific types of threats and vulnerabilities.
As the number of cloud services adopted increases, monitoring their data flows can become increasingly challenging, yet companies must maintain full visibility and control over their information.
Similarly, enterprises need to re-evaluate how they protect against cyber threats like malware. Implementing tools that stop known and unknown threats in the cloud, on any device accessing data, and in real time is essential for complete security.
Unique security solutions are needed in this unique cloud environment.
#2 Gain visibility and control over data
While many cloud services come with native or built-in features that offer some degree of visibility and control within their specific applications, applying policies or making changes across every individual cloud service in use can be painful and problematic.
For example, a healthcare provider may need to comply with a new privacy regulation for health records or other protected health information (PHI). The institution would need to add new policies for identifying sensitive data patterns, as well as controlling who can access this data and when.
Dependency on native security tools alone would result in the IT team confronting the massive task of manually adding or editing policies in every application. This scenario is further complicated by the fact that some apps’ native security features may be less granular than others, making it difficult to apply these changes on a uniform basis; some apps simply cannot be secured as well as others.
To address these challenges, organisations need a single solution that delivers visibility and control across all their cloud applications.
#3 Replicate due diligence in the cloud
Making the move to multi-cloud doesn’t necessarily mean that the practices applied in on-premises environments should be discarded. While this may require different technologies and implementation strategies, enterprises will still need to maintain comprehensive data protection, threat protection, visibility and identity management to prevent unauthorised access to their data.
To ensure comprehensive protection, the security solutions selected must be easy to deploy and integrate with existing on-premises tools. This will assure continuous and consistent security across the enterprise no matter where its data goes. Advanced solutions will also need to be scalable enough to cope with the addition of more cloud applications and cloud-based workloads.
Initiating effective real-time security and governance that is appropriate for the multi-cloud world is vital to ensuring the delivery of persistent protection for data and its users. Recognising this need and reframing security strategies appropriately will ensure organisations can take advantage of a multi-cloud environment with confidence.
