For many people on IT,
the movement towards the cloud is done a little bit apprehensively,
especially for people in security who realize that going to the cloud,
maybe we lose a bit of control over our direct security implementations.
I do say sometimes, though,
that organizations very often do securely poorly on their own,
and therefore,
going to the cloud may actually be more secure than
what they've been doing until now.
However, if I don't do things well on my own,
there is a very good chance I won't do it very well when it depends on
a relationship with another organization as well.
So those are the things that we have to consider,
but an organization is going to go to the cloud whether or not we,
as security professionals, want it.
Therefore, we have to have ways to make it secure.
We have to understand what are the risks associated with the cloud.
So why would an organization choose to go to cloud computing?
Well,
beyond the fact that maybe the cloud service
providers have very good sales people,
there are a number of other convincing arguments that can be made,
such as capital cost control, the flexibility,
access to skilled staff, and even environmental impact.
If 15 companies move to cloud provider,
that means that 15 companies can get rid of backup diesels,
and batteries, and spare equipment, and so therefore,
there can be quite an advantage, even environmentally as well.
So the question comes,
is the cloud secure or is the cloud more secure than what I have now?
It's not an easy question because, of course,
there is a wide variety of different cloud providers,
and so therefore,
we'd have to come back with that answer that means nothing saying,
well, it depends.
It depends on the maturity of the organization,
both of the cloud consumer and of the cloud service provider.
And it also depends on what I'm paying for,
what services are stipulated in the contract because you can be fairly
certain that if I have not put things into the contract,
they won't end up being provided either.
We also have to understand the legal and regulatory
constraints and requirements of going to the cloud.
Many organizations have even adopted cloud‑first strategy.
We're going to go to the cloud unless there is a convincing reason not to.
And that has been, in some cases, very good for governments and organizations,
but we do have to consider things like legal jurisdiction.
Where is my data stored?
Where is it processed?
Is it secure, for example.
We need to understand that when we go to the cloud as a cloud consumer,
it's not that I get rid of my security responsibilities.
No,
I have to make sure that I'm still executing due diligence to protect
my data even though it's on somebody else's systems.
We also have to look at the business case.
Not all businesses are suited for the cloud.
For example,
you take something which is real time sensors that require
immediate reaction in case of say a safety issue.
It could be the latency or delay of going to a cloud or the unreliability
of a network could mean a life threatening situation.
So therefore,
some services just don't really lend themselves to a cloud type of environment.
We also know that a person who works for a cloud service
provider very often will have access to my data.
If my data is highly sensitive, maybe that could be a problem.
Maybe that data could be leaked either intentionally or accidentally.
So these are things we're going to look at in more detail
as we get into this course as well.
The idea of migrating to the cloud and moving to a cloud type of
environment requires us to consider some important factors.
What type of business we are,
what are the legal requirements such as reliability,
we could call that up time, as well as reporting.
Will I be able to report if there is any problem,
issue, what is my level of insight into the cloud,
as well as there are many different cloud options available.
Which is the best for me?
Go with one of the big companies or maybe go with a small boutique
firm that maybe can provide better customization and maybe even a
better price than the large guys.
We have to look at what type of delivery model works for us,
and that, of course,
could look at from anything on‑site private to
offsite private to community cloud.
There are many different options, of course,
even from a Software to Platform as a Service.
Very often, one of the considerations for going to the cloud was economic.
You'll save money.
Well, that's not always the case.
It could well be that I can change the way I pay,
but in many cases,
we find that companies thought that they would save money by going to the cloud,
and in the end, found out they didn't really,
but there are some very good advantages to the cloud.
When I need to understand the business,
I have to understand what type of business am I in,
a competitive, a am I a service‑oriented organization,
and of course, where do I do business,
just locally or do I do it nationally or even internationally?
That can very much affect cloud service as well.
Who are my customers and what are the expectations of my
customers for protecting their data?
We also have to look at network requirements.
Do I have a network capacity that will support my
business in real‑time operations,
or will maybe there be latency or unreliability there with networks?
We have to look at how much data storage and processing do we need.
Very often,
the cloud works well when my level of data storage or processing can vary
because I can change the number of services available,
but that also comes at a price as well.