Page 129 - Cyber Defense eMagazine June 2020 Edition

Deterministic or Accidental Multi-cloud Complexity – It All Needs to be Secured

It’s easy to understand why the proliferation of multi-cloud environments has tended to outpace the
evolution of multi-cloud security. While the move to multi-cloud is often part of a clearly defined and
intentional strategy, this isn’t always the case. For many organisations, the shift happens on a more ad
hoc basis. For example, it may happen when a company with a single-vendor cloud strategy acquires or
merges with another organisation using a different cloud platform. Business units and development teams
may source their own cloud resources, with or without IT’s blessing as shadow IT. New requirements for
specific services, data sovereignty (such as GDPR), or integration lead IT to add new vendors to the
environment. As a result, most companies end up in a more complex multi-cloud setup than they had
envisaged.

Intentional or not, the evolution to multi-cloud environments typically focuses on the business and IT
factors driving it. As with many technologies in IT operations, organisations first provision the services
they need to address various requirements, and only then turn their attention to how best to control,
govern, and manage the resulting environment. This often proves more difficult than anticipated, as
shown in the results of the survey. Nearly two-thirds of respondents (63 percent) said that ensuring
security across all clouds, networks, applications and data was the top challenge of multi-cloud IT, which
is good news, as it is top-of-mind, even if the solutions are not ubiquitous today. Management skills and
expertise (37 percent) and centralised visibility and management (33 percent) were also cited—both key
concerns for effective multi-cloud security.

Essential Security Capabilities and Practices

As IT, security teams, and business leaders have worked to close the security gap in their multi-cloud
environment, a clear sense of the most relevant technologies to leverage is needed. In the BPI report a
majority named centralised visibility and analytics into security and performance (56 percent), automated
tools to speed response times and reduce costs (54 percent), and centralised management from a single
point of control (50 percent) as the top capabilities for improving multi-cloud security, reliability, and
performance. With the volume of digital business data and transactions constantly rising, 38 percent of
respondents also pointed to the need for more scalable, higher-performing security solutions. This will
only be exacerbated over time, especially with the rise of IoT and the emerging 5G connectivity.

Looking at the most important considerations in protecting the security and reliability of multi-cloud
environments, 62 percent of survey respondents agreed on the importance of centralised authentication
or pre-authentication to help maintain effective control over the users, admins, and systems allowed to
access various resources across multiple clouds. One respondent, Raja Mohan, senior strategic architect
for cloud and platform services at Franklin Templeton, explained the reasoning behind this emphasis:
“How do we deliver highly secure applications in a way in which it doesn’t matter where they reside? How
do we provide seamless, secure services? That’s the goal.”

An answer to this question is seen in the high ranking of centralised security policies as a critical practice
for multi-cloud IT (46 percent). Among defensive technologies, many respondents called out specific high

Cyber Defense eMagazine –June 2020 Edition 129
Copyright © 2020, Cyber Defense Magazine. All rights reserved worldwide.