Building security into the cloud

While increasing digital communication capabilities, is driving corporations to take advantage of virtualisation and better bandwidth capabilities to move their data and applications into private and/or public clouds. They are transitioning desktop users to thin client computing, where users can have global access and share the data they need to conduct their business via commodity desktop and mobile devices across the Internet.

At the same time, malware has taken off to an unprecedented scale, as organised crime has been able to leverage the Internet far quicker than the traditional security vendors can deliver the appropriate counter-measures. It is a well established fact that antivirus solutions are, for example, unable to cope with the evolving malware threat coming at us.

This movement to the cloud is an entrenched trend, and one that has profound implications for security. There has been much publicity around sophisticated attacks, leading business decision makers to believe that not much can be done to secure them.

In fact, the majority of these high profile attacks can be traced to the exploitation of vulnerabilities that could have been easily eliminated or mitigated. Hacking into computer systems is certainly not new, and is typically the result of social engineering or identifying holes in systems and their protection. What has changed is the complexity and scale of the computing environment that needs protection.

As an example, a much publicised issue last year was the theft of credit card data. Today we see the underground market value of stolen credit card information dipping drastically, and cybercrime is moving to more lucrative grounds such as bank account information and healthcare records. This is because the Payment Card Industry (PCI) requirements, along with better fraud detection systems, have made cybercriminals less interested in going after credit card data. As we all know, lower demand generally produces lower prices.

Still, the easiest way for cybercriminals to steal valuable data is to enter through identified or unknown vulnerabilities, and what works in their favour is the huge proliferation of devices and the many ways they interact and exchange information. This makes them exponentially more vulnerable, and harder to protect. As opposed to enterprise computing, which has become highly distributed, heterogeneous and complex to manage, cloud computing technology enables the centralisation of data and the building of a fractal infrastructure. It offers expanded ability to more effectively protect data at a basic level, and streamline the patching and mitigation processes.

This allows a drastic reduction in the cost of securing your infrastructure, because resources can be distributed across thousands, and even millions, of users, and further reduced via automation. Corporations are now beginning to realise this, and as they move to private and public clouds, they are looking for security solutions that are more effective to deploy and to maintain in this atmosphere than the ones they are used to. They also are looking at solutions that can easily interoperate, as one vendor is unlikely to have a solution that covers all their needs.

Naturally, such a transition will not happen overnight. To stay relevant, security vendors have to retool their current offerings to adapt them to this new environment, and needless to say, this is not an easy task, and new security companies will emerge to rise to the opportunity.

The cloud offers us an opportunity to change enterprise security for the better.

Thank you for reading! And please feel welcome to leave a comment!

All information presented here is © copyright Carkean Solutions Ltd., 2010 - Not to be used without our permission - The views expressed here are the views of an individual not the corporation