devopsy.kinsta.cloud

Category: Cloud Management

  • Five Major Mistakes to Avoid in Enterprise Multi-Cloud Strategies

    Five Major Mistakes to Avoid in Enterprise Multi-Cloud Strategies

    Employing a multi-cloud strategy is not as straightforward as it seems for enterprises due to the huge amounts of data and applications involved. Hence, mistakes are common in multi-cloud implementations. What are these mistakes and what can enterprises do to avoid them?

    The Growth of the Multi-Cloud

    The multi-cloud is now a staple in most enterprise IT infrastructures. This is a result of companies having to ramp up their data access and management processes to scale with rapid market demand.

    A study by data analytics firm, Sumo Logic, showed that multi-cloud usage in enterprises grew 50% each year for the past few years. The market is also expected to hit close to $8 billion with an excellent CAGR of 32.1% from 2017 to 2024. 

    Figure 1: The share of cloud environments in enterprises. Source: Forbes.

    This accelerated growth is justified by several factors. For starters, multi-cloud environments save businesses from locking into one vendor for cloud solutions—a common issue enterprises face when dealing with providers. The great bang for the buck ROI and exceptional performance of multi-cloud implementations are also two major contributors to its success.

    The Impacts of Deploying Multi-Cloud Strategies the Wrong Way

    Any tech trend that grows as fast as multi-cloud will come with concerning downsides. Enterprises may not have the skills and resources needed to effectively work with multi-cloud. This can impact performance, increase costs, or worse, create security vulnerabilities that can cripple unprepared organizations.

    The average company uses 16 SaaS tools at one time. While SaaS applications have built-in security, organizations are still responsible for securing their environments, especially for dependencies. A vulnerability in one application can affect the entire ecosystem without adequate recovery measures in place.

    Nominet’s multi-cloud survey respondents said they faced at least one data breach in 2019—50% more than hybrid and single-cloud users. With data breach penalties reaching millions today, enterprises cannot afford to impact their already tight margins by paying unnecessary fines. This is why multi-cloud strategies need to be approached with extra caution.

    Below are the five major mistakes to avoid in enterprise multi-cloud strategies.

    Going Multi-Cloud Without the Required Competency

    Organizations used to single cloud deployments run the risk of failure if they work with the multi-cloud without the required competency. Experience working with SaaS applications is not enough to warrant complete multi-cloud shifts. Enterprises should at least have the right technical expertise, tools and technologies in place.

    Development teams will have to revamp their mentality to work efficiently in multi-cloud environments. Other important business units also need to be reworked to accommodate this change. In other words, your company must establish a multi-cloud-focused culture, not treat it as just another new piece of technology.

    Invest in training to get team members up to speed with necessary multi-cloud skills. It can be expensive, but the ROI generated from productive employees far outweighs the cost of training. Your recruitment process should also prioritize candidates with proven experience in the field to make onboarding easier.

    Work with industry-standard tools to ease development in areas like pipeline automation, CI/CD and monitoring. This reduces the burden of QA while also giving developers peace of mind when working with the multi-cloud due to reduced deployment anxiety. Ultimately, your team should be able to build, test, deploy and monitor code in the cloud with minimal friction.

    Not Addressing Cloud Sprawl

    Unless you’re locked in, you will be dealing with various providers and technology stacks in your multi-cloud. Your environment may be overloaded with unnecessary assets and dependencies, leading to cloud sprawl, which negatively impacts budgets and performance. 

    To overcome cloud sprawl, plan your cloud infrastructure meticulously with respect to organizational goals. Only integrate core applications that fit your requirements to a tee. Nice-to-haves eat up valuable resources and can be postponed for later when your multi-cloud is mature.

    Rightsize your environment to make planning easier. Rightsizing matches resource allocation to your multi-cloud workload. It’s often automated or offered as a service by cloud providers. Enterprises can cut as much as 40% of operating costs by rightsizing their infrastructure—a huge advantage in today’s fierce markets.

    Not Accounting for Complexity

    More assets in your environment means more complexity challenges. Scalability, security and resource optimization are the three key areas where enterprises need to pay close attention. Integration will be tough as well since not all providers offer seamless connections with other tools. 

    Consider working with popular cloud applications if this is the first time your organization has worked with multi-cloud. Bespoke solutions are best implemented in stable environments and when there is a real need.

    Another factor to consider is your infrastructure’s load balancing strategy. Which resources have higher priority and which can be sacrificed when demand peaks? Automation is a must-have for load balancing, especially if your environment consists of thousands of assets—as is common in enterprise systems.

    Other complexity factors to consider in your multi-cloud strategy are:

    • Compliance.
    • Asset and data visibility.
    • Cost management.
    • Performance.
    • System design.

    Paying Too Much for Unused and Underutilized Resources

    Multi-cloud is not as cost-effective as expected if you spend too much on unused and underutilized resources. Fifty-two percent of enterprise cloud resources barely reach their optimal usage while cloud waste hit an all-time high of $14 billion last year.

    Thankfully, cost optimization is achieved as a side effect of mitigating cloud sprawl and rightsizing. Doing these two things, combined with best practices such as streamlining unused EBS volumes and snapshots, will significantly reduce your costs.

    Poor Visibility

    The number of assets in the average multi-cloud environment requires total visibility for your team to navigate through it. Without visibility, developers will have their work disrupted by intricate dependencies and foreign configurations that ruin the productivity of your organization. This can also result in security breaches should a dependency be compromised—how can your team find the root of the problem if they can’t see architecture?

    Map out every asset and dependency with mapping tools. By improving visibility, you bolster the security of your multi-cloud while allowing developers to deploy code with confidence when they have a full overview of your ecosystem. Integrate mapping insights with your organization’s technical documentation to further improve results.

    Bolster Your Multi-Cloud Today

    The easiest way to generate optimal performance from your multi-cloud is to avoid common pitfalls as early as possible. With the tips mentioned above, you can improve scalability, cost and performance without succumbing to complexity challenges.

    — Soumik Sarkar

  • Three Priorities for IT Operations Continuity During the COVID-19 Pandemic

    Three Priorities for IT Operations Continuity During the COVID-19 Pandemic

    The world has been turned upside down amidst the COVID-19 pandemic, and organizations that are trying to maintain best IT and security practices are faced with new challenges such as sudden remote workforces, increased COVID-19-related phishing and business e-mail compromise scams, and quarantine-imposed travel restrictions. 

    Are you facing disruptions in your workforce, limitations in the supply chain and up-ended disaster plans? You’re not alone. A recent survey, Critical Gaps in Business Continuity Plans: Exclusive Survey Results, reported that 62% of businesses surveyed have business continuity plans, but 48% said their plans only cover emergency operations for two to three weeks.

    With increased limitations affecting enterprises, what are the top three things organizations must prioritize for optimal security and minimal outages to aim for business as usual?

    Consider the Cloud

    If you have been considering the cloud for your IT and information security infrastructure, now might be the right time to explore all your options and make strategic moves. Eighty-three percent of enterprise workloads will be in the cloud this year, according to a recent LogicMonitor cloud study, and security hardware and applications will be no exception to that trend. The cloud can increase your capacity and facilitate remote access to vital business functions, especially now when redundancy and scalability are more important than ever. 

    For example, the cloud could be a temporary solution for a retailer whose existing payment processing infrastructure is overloaded and declining transactions as a result. It doesn’t replace their existing on-premises environment, but it augments it by adding on-demand scalability. This could cover a temporary surge in demand or stand in during a full-blown outage. Do you know whether your existing applications have cloud-based extensibility?

    Quite often, organizations aren’t aware of the cloud capabilities they can already utilize. During times of uncertainty, the cloud can be a good temporary approach and does not have to be a big expenditure. Organizations can pursue the cloud with a low commitment, month-to-month contract, and consider it more permanently at a later date.

    When moving workloads to the cloud, considering security is of paramount importance. Many public cloud providers such as AWS, Azure and Google Cloud Platform offer functions to help secure these workloads and applications, and one gaining a great deal of attention is encryption key management. All major public cloud providers offer methods for their users to self-manage the keys used to encrypt, decrypt, digitally sign,and validate data. This technology is known as Bring Your Own Key (BYOK) and is a high assurance method for letting organizations retain control of their own cryptographic keys even after moving to the cloud.

    Ensure Redundancy

    System failures are not an option in mission-critical environments, and redundancy will offer up backup to increase the reliability of your systems. Given the current COVID-19 situation, do you have backup resources that can continue to process data without interruption? What if your data center is out of service altogether? Do you have another that can keep your infrastructure operational? 

    As an example, let’s look at cryptographic key management. Numerous business applications offload private key storage to purpose-built devices known as hardware security modules (HSM). HSMs are tamper-evident, tamper-responsive servers typically certified to rigorous requirements such as FIPS 140-2 Level 3. A typical information security infrastructure may only have throughput requirements to justify a single encryption HSM that is partitioned to provide services to multiple business applications. But if this single HSM fails or must be taken offline, any application relying on it for cryptographic key management may also become unavailable. 

    In this scenario, the ideal data security infrastructure would comprise multiple HSMs along with at least one centralized management server, split between multiple geographically separated data centers. This example can be extended out to virtually any other type of IT hardware, but it is particularly important for resources representing a single point of failure, where their outage would have cascading impacts throughout your enterprise ecosystem.

    To mitigate these risks, talk to your vendors about data security and redundancy options; you might be surprised at their offerings. And consider more than just individual device outages, too. What if you can’t get into your data center? Taking a hybrid approach to infrastructure design, where you rely on a diverse set of tools to prepare you for a wide range of potential problems, will let you maintain the redundancy and high availability that your users and customers expect.

    Monitor Your Data Centers

    Now is the time to monitor your IT operations even more closely than usual to spot extremes and help with scalability and capacity planning. Can your infrastructure handle the increase of users and transactions? Are you accounting for handling higher volumes that come with an increasingly remote workforce? How would your organization handle a service disruption if you experienced an outage? Closely monitoring your IT and security resources to look for spikes and surges can guard against oversaturation and could help justify offloading workloads to cloud data centers.

    Malicious actors often ramp up their activities in times of crisis, specifically because they know that companies’ focus is otherwise occupied. Automated monitoring can greatly assist in preventing these types of attacks, but only if proper baselines and profiles are established. For example, looking at an enterprise cryptographic ecosystem, if a bank knows its HSMs are validating 10,000 PINs per second on average, and suddenly that number spikes to 100,000 per second, they should immediately investigate. Intelligent monitoring and health-checking technology is designed for these exact types of scenarios, as well as to identify infrastructure health issues so administrators can respond proactively rather than reactively.

    Your organization’s IT infrastructure and data security are depended on to be reliable, and your IT operations continuity effort needs to be prioritized now more than ever. Here’s to keeping your employees, and your IT infrastructure, in good health.

    — Ryan Smith

  • Comparing Three Approaches to Multi-Cloud Security Management

    Comparing Three Approaches to Multi-Cloud Security Management

    Moving to a multi-cloud environment can bring many advantages, but it also brings huge challenges in managing both the everyday operations and security of multi-cloud infrastructures.

    To meet these challenges, several approaches to multi-cloud management have arisen. The most common can be roughly grouped into three categories: Cloud Management Platforms (CMPs), Infrastructure as Code (IaC) and cloud-native abstraction. The differences between these approaches reflect the differences between top-down and bottom-up cloud management, as each management process suits a different set of companies.

    In this article, we’ll take a look at all three approaches, explain what the advantages and disadvantages of each are and then explore whether new approaches to multi-cloud management are required.

    CMPs

    CMPs are the highest level approach to cloud management—the approach that is furthest away from the native code that your clouds run on. The rise of CMPs has come as the result of a simple observation: public cloud services are redundant and overlapping, and can therefore be managed through an abstraction layer that hides the complexities of what is happening at a cloud-native level.

    By using a CMP, admins do not need to understand the differences between AWS and Microsoft public clouds (for instance), but instead use a consistent interface to manage both.

    This has some huge advantages, primarily when it comes to improving cloud security. CMPs allow IT operations teams to implement a common security layer within multi-cloud environments, and apply the same identity and access management (IAM) processes across all the clouds they are working with. 

    This is particularly useful with cross-cutting applications that interfaces with multiple, critical portions of your cloud storage to help simplify, and which requires highly complex user access policies. This is ultimately one of many reasons why security breaches of cloud-based data are so rare, as 99% of businesses in the UK that rely on cloud-based software have never experienced a security breach. 

    IaC

    IaC is a second approach to multi-cloud management. This approach arose in response to utility computing and second-generation web frameworks, which gave rise to widespread scaling problems for small businesses.

    Administrators took a pragmatic approach: they modeled their multi-cloud infrastructures with code, and were therefore able to write management tools that operated in a similar way to standard software.

    IaC sits in between the other approaches on this list, and represents a compromise solution. It gives more fine-grained control over cloud management and security processes than a CMP, especially when used in conjunction with SaaS security vendors whose software can apply a consistent security layer to a software model of your cloud infrastructure. This is important because SaaS is growing rapidly in popularity, with 86% of organizations expected to have SaaS meeting the vast majority of their software needs within two years. 

    On the other hand, IaC requires a greater level of knowledge and vigilance than either CMP—or cloud-native approaches. If admins are knowledgeable enough to write code that can accurately (and reliably) model multi-cloud infrastructures, IaC can be a powerful way to improve DevOps security. These software models, however, will require constant monitoring to ensure that changes in the cloud-native layer do not introduce vulnerabilities into management tools.

    Finally, IaC can be significantly more efficient, when it comes to computing and network resources, than a CMP. Because IaC software runs closer to the cloud-native layer than (most) CMPs, it can execute common tasks much more quickly.

    Cloud-Native Abstraction

    The final approach to multi-cloud management is to manage your environment using only cloud-native tools. This approach has grown in popularity recently, as developers grew increasingly comfortable with working with containers and Kubernetes directly. Cloud storage providers have responded by offering increasingly complex tools designed to work directly on the cloud-native layer, and the storage provider you use should come with these tools.

    Cloud native application management has several advantages, and several disadvantages. The most obvious advantage is that cloud-native tools give admins a much greater level of control over their multi-cloud environments than the other approaches on this list. Because these tools run natively, they are also typically faster and more efficient than the other approaches we’ve mentioned above.

    On the other hand, saving computing time comes at the cost of increasing the workload for administrators. If you are working across a large number of clouds, managing each separately using each cloud’s native applications can quickly turn into a full-time job. In addition, managing multiple and complex access and usage policies at a cloud-native level can make it difficult for admins to keep on top of how their IAM processes are running, and increases the risk of mistakes. 

    Is It Time For a New Approach?

    All of the approaches above are a different solution to solve the same problem, namely the challenges caused by rapid adoption of multi-cloud technologies. Each, as we’ve seen, has a primary advantage when compared to the others. But in truth, none of the approaches above represents a completely adequate solution to managing security in multi-cloud environments.

    The choice of which approach to take must therefore be a pragmatic one. For companies who are blessed with the knowledge, talent and time to manage multi-cloud infrastructures at a cloud-native level, this is likely to be the best solution, especially at a time when cloud waste is booming. If you take this approach, however, you should also be aware that implementing it will require putting in place thorough and rigorous code auditing processes in order to ensure that any small IaC elements that run on top of cloud-native tools do not introduce common security vulnerabilities into your network.

    For small to medium size businesses, or those running hugely complex multi-cloud systems, CMPs will be a safer bet. The reduced efficiency of these services–both in terms of computing resources and capital investment–is likely to be more than made up for by the reduced load on the admins who spend their days working with them, and the reduction in the number of mistakes that are made.

    Ultimately, it’s apparent that a new approach to multi-cloud management is required. One that combines the flexibility and speed of cloud-native with the ease of CMPs. But at the moment, it’s difficult to ascertain what that will look like.

    — Gary Stevens

  • Survey Finds More Data Disruption Occurring

    Survey Finds More Data Disruption Occurring

    A global survey of 1,000 IT decision-makers with more than 250 employees conducted by Dell Technologies finds on average organizations managed 13.53 petabytes (PB) of data in 2019, a nearly 40% increase since 2018.

    The same survey also finds that as the amount of data has increased, so, too, has the cost of downtime. Those costs increased by 54% in the same period, resulting in an estimated total cost of $810,018 in 2019.

    The survey also notes 82% of respondents suffered a disruptive event in the last 12 months, with the total cost of a data loss now on average exceeding $1 million.

    Not surprisingly, the survey finds that a lot of the data that organizations are trying to protect resides in the cloud, thanks mainly to the rise of a variety of application use cases. The top five areas of investment cited by survey respondents include cloud-native applications (58%), artificial intelligence (AI) and machine learning (ML) (53%), software-as-a-service (SaaS) applications (51%), 5G and cloud edge infrastructure (49%), and Internet of Things/endpoints (36%).

    Nearly, three-quarters of respondents (71%) noted these emerging technologies create more data protection complexity and 61% said they increase risks. The survey also finds 81% of respondents said their existing data protection solutions will not be able to meet all future business challenges.

    Specific areas where existing data protection platforms are expected to fall short include being able to recover data after a cyberattack (69%), recover data from a data loss incident (64%), comply with regional data governance regulations (62%), and meeting backup and recovery service level objectives (62%).

    Among organizations that have adopted these emerging technologies the percentage of organizations struggling with adequately protecting data is as follows:

    • 5G and cloud edge infrastructure (67%)
    • AI and ML platforms (64%)
    • Cloud-native applications (60%)
    • IoT and endpoint (59%)
    • Robotic process automation (56%)

    The survey also finds organizations prefer public cloud/SaaS (43%), hybrid cloud (42%) and private cloud (39%) as deployment environments for new applications. In the case of edge computing deployments, 62% cited private clouds as being the platform that will be relied on most to protect data.

    Bob Ganley, senior marketing consultant for cloud at Dell EMC, said the biggest challenge for organizations will be finding a way to centrally manage backup and recovery across multiple cloud computing platforms. Those platforms inevitably will span multiple types of public and private clouds accessed as a service and deployed in local data centers. Most organizations are relying on a “mash-up” approach to cloud computing where there is no unified control plane, so as they add each new cloud platform their total cost increases, he said Ganley, noting it’s now only a matter of time before IT organizations start to centralize the management of those multiple clouds to rein in those costs.

    It’s not clear to what degree that centralization effort will revolve around IT automation enabled by application programming interfaces (APIs) and best DevOps processes versus traditional data protection tools based on graphical user interfaces (GUIs). However, given the amount of data involved, it is more than likely that existing approaches to data protection are not going to scale, so a fundamental change in how backup and recovery is managed is now all but inevitable.

    — Mike Vizard

  • Mission Makes AWS Expertise Available for Free

    Mission Makes AWS Expertise Available for Free

    Mission, a provider of managed services for the Amazon Web Services (AWS) cloud, this week announced it will make its cloud optimization expertise available free of charge for any IT organization that acquires AWS licenses through it.

    Alex Beal, director of product for Mission, said as cloud sprawl continues to be an issue, many internal IT teams simply don’t have the expertise required to rein in those costs. However, rather than charge extra for the expertise Mission will now make its tools and consultants available for free under the auspices of the Mission Cloud Foundation service to any organization that employs Mission to acquire AWS licenses, he said, noting every Cloud Foundation customer will get access to a designated Mission Cloud Analyst who will provide regular account reviews and guidance on implementing best practices.

    Mission can provide the free service because it acquires licenses from AWS at a lower cost. Effectively, AWS is paying for the services being provided by Mission, said Beal.

    As more workloads move into the public cloud, IT teams are struggling to navigate a complex mix of service levels from AWS that range from spot pricing options to reserved instances that can be licensed for specific periods of time at a deep discount. However, determining which workloads lend themselves best to various AWS pricing options can be challenging to determine, especially for developers who spin up virtual machines without consulting with internal IT teams. Collectively, organizations are wasting millions of dollars each year because of suboptimal usage of public cloud resources. Beal estimated that the average IT organization is wasting about $5,000 a year on cloud infrastructure resources that could be better allocated to other IT initiatives.

    Beal said Mission will work with those internal IT teams to identify unused resources and rightsizing candidates, set up budget alerts and recommend better options for specific types of workloads using a combination of monitoring tools from third parties such as CloudHealth and one developed by Mission. Those monitoring tools are also employed to enforce budget constraints and run security checks.

    Mission Cloud Foundation also includes tools to reallocate charges, reference purchase order numbers and set up automated custom reports.

    Most IT organizations could develop much of this expertise on their own. However, Beal said most IT teams also have better things to do with their time that add more value to their organization. Instead of acquiring licenses direct from AWS, Mission is making a case for an alternative approach that provides a level of service and support that AWS generally only provides to Global 2000 customers.

    Other managed services providers (MSPs) may or may not also provide tools and expertise free of charge. Savvy IT teams, however, may soon force the issue. After all, while public cloud represents the most widely employed form of IT infrastructure as code, from a cost perspective it’s also clear public clouds can also quite easily become too much of a good thing.

    — Mike Vizard

  • Challenges with the Rapid Adoption of Cloud-Native Technologies

    Challenges with the Rapid Adoption of Cloud-Native Technologies

    To keep pace with the ever-changing digital landscape, today’s enterprises are trying to move to the cloud as fast as possible. As more and more companies move toward implementing cloud native and open source technologies to enable agility and increased time-to-value, the operational impacts to the business can be significant. While these challenges can cause serious setbacks and complexity, if an organization addresses them from the very beginning as part of its cloud strategy, it can overcome any trial.

    The following are top challenges enterprises may face when rapidly adopting cloud native technologies. 

    Intense Competition and Market Pressure

    As businesses fight to keep their competitive edge, they are feeling significant pressure to adopt new initiatives to achieve greater business velocity. New initiatives such as data analytics, data science and cloud computing are being leveraged by organizations to gain an advantage while disrupting how businesses have traditionally been performed. 

    Lack of Maturity and Interoperability of Many Open Source Technologies

    Understanding the cloud landscape is a critical component for kicking off any digital transformation project, but the state of each technology varies significantly. Because so many of these technologies are open source, getting a true understanding of maturity can be challenging. Some solutions are in very early stages with low commercial adoption and support, while other solutions are at a later stage and much more mature.

    Unfortunately, most of these technologies were not built to ensure interoperability from the beginning and the efforts of jamming together multiple disparate solutions from the cloud native landscape is complex and rife with challenges. This is why it is imperative that modern organizations ensure its solutions are enterprise-grade, ready to scale and nearly fool-proof to challenges. 

    No Clear Best Practices or Architectural Standards

    Because many of these new technologies lack maturity, the right information and proper documentation is scattered and difficult to distill. How can developers trust if an application is safe to include in their implementation if they are unsure whether documentation is correct and up-to-date? Since many of these open source technologies do not have well-defined best practices or architectural standards, implementing these solutions can be a huge business risk.

    Limited Choices for Leveraging External Domain Expertise and Support

    In order to ensure that organizations’  Day 2 operations go smoothly, they need the right expertise to provide guidance and support. Unfortunately, because so many of these technologies are new, there is a very limited pool of talent—both internally and externally—organizations can pull from. Organizations need the right technical support and services to operate and scale effectively, and with limited options available, the complexities of long term success can be a huge barrier.

    The Complexity of Managing Ongoing Operations

    Implementation is just the beginning, what really enables businesses to be successful with any digital transformation initiative is tackling ongoing Day 2 operations. This means ensuring that technologies work well together, the team understands how to leverage the technologies and organizations have an operational readiness plan for continued development and ongoing improvement. So many businesses focus their attention on what happens before production and as a result, success is not always achieved. 

    When beginning a cloud native journey, enterprises must be conscious of the inherent challenges rapid adoption poses. Competition, lack of maturity and best practices, limited choices and complexity can all complicate an enterprise’s journey to the cloud. Awareness of potential problems can help stop issues before they arise while easing the transition to the cloud.

    — Tobi Knaup

  • Castles in the Cloud: How to Take Your Business Kingdom Off-Prem with Confidence

    Castles in the Cloud: How to Take Your Business Kingdom Off-Prem with Confidence

    Cloud transformation requires migrating all or part of an organization’s virtual assets off-premises, typically to a public cloud.  This enables greater efficiency and cost savings, among other benefits, but it brings heightened risk as well. At the same time, many organizations moving to the cloud don’t fully understand the implications in terms of security. Consequently, successful cloud migration requires a shift in mindset.

    A Medieval Metaphor for Cloud Infrastructure

    Think of your organization as a kingdom surrounded and protected by a castle. Traditionally, this castle would be outfitted with defensive layers designed to protect the residents, the royal family and the possessions within. Protection of the castle is straightforward. A moat surrounds the castle with drop bridges in and out at strategic points (firewalls).

    In addition, guards are stationed at each entry point, conducting a thorough inspection of the people, carts and the content that they carry both in and out of the castle (IDS/IPS). The guards also check credentials at the gates and within the castle to ensure patrons are cleared for access and use of rooms and resources (IAM). The perimeter and interior walls are continuously checked for weaknesses that could introduce potential blind spots that are unguarded (vulnerability management).

    The castle has a variety of rooms, each with its own function, content and worth. Each door has a lock (AV). Within each room and the correlative hallways exist guards who check credentials, monitor the people who enter and the contents they carry, etc. (behavioral detection and endpoints). In addition, multiple other measures are in place that bolster prevention, detection and response capabilities (DLP, deception, etc.). Information from all of these sources is noted in a central location by a scribe. Guards analyze the information, looking for additional indicators of potential threats to the kingdom (SIEM) and respond accordingly.

    Comprehensively, protection of the kingdom requires an overall model and policies that accounts for new threats and tactics from rival kingdoms and thieves. Architecture of security measures are continuously updated and adaptable. In the event of an incident, the guards have designed and exercised a plan to respond. 

    Understanding the Three Different Models of Cloud 

    Clearly, this is a basic metaphor for the on-prem approach. Moving to the cloud introduces a new level of complexity to protection spread across three different models: Infrastructure as a service (IaaS), Platform as a service (PaaS) or Software as a service (SaaS).

    In the context of our castle analogy, let’s assume the castle has reached productive capacity. Neighboring rivals are creating competitive pressures, offering residents (who pay taxes) the possibility of a better life if they relocate. To keep residents happy, productivity requires expansion beyond castle walls. As production expands, neighboring kingdoms offer different models to achieve productivity. However, each model presents different levels of shared responsibility in protection (referred to as the Shared Responsibility Model).

    • IaaS: In this model, the on-premises kingdom (kingdom A) decides to expand all operations to a neighboring castle (kingdom B). The castle itself and the moats are all controlled and provided by kingdom B. However, the infrastructure, moats, hallways, rooms, access lists, monitoring of activity and protection and usage of its contents are the responsibility of kingdom A.
    • SaaS: Kingdom A decides to have blacksmithing conducted in a neighboring castle (kingdom B). The castle itself, the moats, infrastructure, hallways and blacksmithing room are all protected by kingdom B for a charge. Kingdom B’s responsibility is to control access to the room, but maintaining who’s on the access list to the room and the protection of its contents and usage are the responsibility of kingdom A.
    • PaaS: Kingdom A decides to house and build military operations in a neighboring castle (kingdom B). Kingdom B is responsible for the basic controls, but the configuration and monitoring remain the responsibility of Kingdom A.

    With this transformation, Kingdom A faces a more complex security landscape. Innovation and efficiency are critical to meeting the growing and changing demands of their kingdom, but not without additional risks. New operating models bring new risks and potential vulnerabilities to their system(s). Methodologies and processes used to secure their own kingdom do not necessarily work or apply to protecting their new partner kingdoms. Additionally, people–and experience–that understand these new complexities are harder to come by while the thieves and rival kingdoms discover vulnerabilities and weaknesses and begin to exploit and steal valuables that put the entire kingdom and its residents at risk.

    Protecting Your Castle in the Cloud Takes a Deep Understanding

    Moving to the cloud is almost inevitable at this point, and it carries so much potential to accelerate business outcomes. It takes a different mindset to secure it than what we are used to as an industry–the landscape has been changed from a security perspective. By fully studying and understanding the differences, organizations can continue rapid and secure adoption of the cloud, while reaping the benefits that it promises to bring.

    — Sean Blenkhorn

  • Red Hat Updates OpenStack Platform

    Red Hat today made available an update to its distribution of OpenStack that enables it to run on Red Hat Enterprise Linux (RHEL) 8 operating system.

    Sean Cohen, senior manager for product management at Red Hat, said Red Hat OpenStack Platform 16 combines three releases of OpenStack, known as “Rocky,” “Stein” and “Train” into a single update that the company plans to update on a streaming basis. In addition, future updates to Red Hat OpenStack Platform will be aligned with updates to RHEL 8, said Cohen.

    Red Hat OpenStack Platform 16 is also now being made available under a long-term support subscription as well.

    Red Hat Open Hybrid CloudCohen said Red Hat continues to see continued growth in terms of customers adopting OpenStack to build their own cloud computing platforms. Telecommunications companies have already made major investments in cloud frameworks that are now being extended to the network edge. Earlier this week, Orange Egypt announced it will be using Red Hat OpenStack Platform to deploy virtual network functions (VNFs) to manage network traffic. Enterprise IT organizations, meanwhile, are building their own private clouds on top of an open source platform.

    In some cases, enterprise IT organizations are relying on OpenStack to provide the foundation on which cloud-native applications based on Kubernetes are deployed, added Cohen. The goal is to take advantage of the virtual machines on which OpenStack is deployed to ensure isolation between instances of containerized applications running on top of Kubernetes. In other cases, IT organizations are taking advantage of tools such as Ironic to automate the deployment of Kubernetes cluster on bare metal machines, said Cohen.

    The relationship between OpenStack and Kubernetes, however, remains complicated because there are those organizations that are deploying Kubernetes clusters in on-premises IT environments without relying on any legacy infrastructure-as-a-service (IaaS) platforms such as OpenStack or VMware vSphere. Nevertheless, Cohen said Red Hat expects to see wider adoption of the Red Hat OpenShift application development and deployment platform, which is based on Kubernetes, on top of Red Hat OpenStack Platform 16.

    Cohen said there is a high correlation between organizations that have embraced best DevOps practices and usage of OpenStack as IT organizations move to automate the management of IT infrastructure at scale. The challenge organizations face is determining which modules of a very comprehensive OpenStack framework to employ. In fact, that challenge is why organizations rely on Red Hat to curate OpenStack on their behalf. In terms of adoption, Red Hat has the largest market share of any OpenStack distribution, said Cohen.

    It’s not clear to what degree the shift toward cloud-native applications based on Kubernetes might result in increased adoption of OpenStack. As organizations look to build hybrid cloud computing environments, the ability to deploy a common framework on-premises and in the public cloud has a certain appeal. However, public cloud computing platforms such as Amazon Web Services (AWS) already make available a proprietary platform for managing their IaaS environment. Many IT teams would naturally prefer to integrate with that AWS platform rather than replace it. Regardless of the approach to hybrid cloud computing, however, chances are high OpenStack will be in the mix in one form or another.

    — Mike Vizard

  • vArmour CEO: Cloud Security Needs Simplicity

    vArmour CEO: Cloud Security Needs Simplicity

    Cloud computing promised cost savings and simplified IT management, among other things. In many ways, the cloud has lived up to its ideals, and in other ways, such as API security, shadow IT and the securing of clouds across hybrid environments, the cloud has proven challenging.

    To get a sense of how enterprises and security vendors are adapting, we reached out to Timothy Eades, CEO at cloud application security provider vArmour. vArmour was founded in 2011 with backing from Highland Capital Partners, Menlo Ventures, Citi Ventures, Work-Bench Ventures, Redline Capital and Telstra. Timothy Eades has been the CEO since 2013; prior to that role, he was the CEO at Silver Tail Systems.

    Here’s an edited version of our conversation.

    DevOps: How do you see cloud architectures evolving over the years ahead?

    Timothy Eades: There is considerable evolution coming. At vArmour, we have a philosophy about this: Bet on the road maps, not against them.

    I think we are seeing a lot of security vendors starting to scratch their heads and wonder: Where do we invent new security technologies that can help us differentiate? The road maps for winners are going to be those that bake security into their products. This way, cloud technology will only get stronger and more secure. If one imagines an x- and y-axis and the x-axis is the strength of security capability and the y-axis is simplicity, the vendor road maps, for those who will be successful, will be about getting that balance right.

    Currently, there’s considerable complexity involved when it comes to configuring and securing the public cloud. If you are Tim’s Pizzeria and you are running on AWS, it has to be made simple and more intuitive. I was talking to some friends recently about the Windows operating system and how everything has become so simple. But back in the day when you and I were growing up, we used to say “RTFM” almost daily. Nowadays, there is no manual.

    That’s mostly thanks to Steve Jobs. Steve Jobs came along and made everything so simple that it shouldn’t require a manual. The worst-case was it might require a YouTube video to understand.

    The cloud has to go through that same transition. Everything has to be made simpler, more intuitive. Otherwise, we are just going to get very weak configurations, because people are not going to configure it right. They’re not going to secure them right. They believe that they are inherently secure.

    DevOps: What do you think will be the catalyst that will continue to drive cloud vendors getting the simplicity and security balance right?

    Eades: I think it’s going to be a competition. I think the market sees the need for the drive to simplify. And it’s going to take the competition to get there. That’s a real battle between AWS, Azure, VMware and others. The good news is that VMware is going to embed a lot of security capabilities, and that will force Amazon, Azure, and Google Cloud to respond.

    DevOps: Cloud can get complicated quickly; even that small pizza shop may run a dozen cloud services.

    Eades: Yes, they are running a bunch of different services. The funny thing is, there is always a lack of security skills at play, too. And we all know that when businesses put things in the cloud, that they think it just became secure. They don’t have the skills to understand that it’s not as secure as they believe. I think the regulators are still scratching their heads a little bit about all of this because Amazon has been preaching its “shared responsibility” model. But, as we now know, it’s not shared liability.

    And people haven’t woken up yet to that fact, that shared responsibility is not shared liability.

    DevOps: How do you see enterprises consuming the various modalities of cloud in the years ahead, on-premises, public, private cloud and the different mixtures of each?

    Eades: It’s just amazing. Consider a company located in Europe. They have to have data on servers everywhere. So they’re using AWS and Azure and others. I think the large enterprises will continue to be hybrid cloud, but they won’t have a private data center. They just won’t.

    A friend of mine runs cloud security at a large bank in New York. Their current data center will be their last data center. They’re not going to build another data center. They’re just not.

    It’s the lifetime of the applications that they look at, and they wonder: Do I still want a data center? It doesn’t take long for them to get to “no.”

    One of the banks we worked with over the last three years, as they were moving many of their applications into the public cloud, they were trying to understand the interaction of their apps. They wanted to know how stable the performance of their apps is in the public cloud. They will tell you now that they don’t see the difference between their Amazon cloud and their private cloud. There’s no difference because they’ve all the bandwidth that they need.

    If you can’t tell the difference from a usage and from a financial perspective, more enterprises are going to depart from their data centers.

    I think you are going to see a very, very long tail of private data centers among very large enterprises, but the cloud will consume the rest of IT.

    — George V. Hulme

  • SIOS Technology Automates Rebooting of AWS EC2 VM Instances

    SIOS Technology Automates Rebooting of AWS EC2 VM Instances

    SIOS Technology Corp. this week launched SIOS AppKeeper, a tool that automatically reboots instances of EC2 virtual machines anytime they fail.

    Michael Bilancieri, senior vice president of products and marketing for SIOS, said SIOS AppKeeper is an extension of the work SIOS has historically done to enable servers and clusters to failover. However, many organizations don’t require that level of availability, so SIOS developed AppKeeper to provide a way to automate the process of restarting virtual machines in the cloud, said Bilancieri.

    SIOS AppKeeper also provides a dashboard through which DevOps teams can centrally manage the stream of alerts that are generated when there is an EC2 issue, he said. SIOS AppKeeper is a software-as-a-service (SaaS) application so there is no software to be installed. Instead, organizations log into their AWS account and select which instances and services to monitor and the level of protection they want SIOS AppKeeper to provide.

    Pricing for SIOS AppKeeper starts at $40 per EC2 instance. Monitoring and alert capabilities are provided by default. Restart services, reboot instances and reboot instances only if a restart of services fails are all options. Organizations can opt to access SIOS AppKeeper either via the graphical user interface provided or via an application programming interface (API), Bilanieri said.

    Previously, SIOS AppKeeper was only available in Japan. Based on data from those customers, the average customer with only three AWS EC2 instances experienced downtime at least once a month. With SIOS AppKeeper, customers were able to reduce downtime by 90%, Bilancieri noted.

    SIOS will consider adding support for other public clouds based on customer demand, he said.

    Cloud service providers, in keeping with the “pets versus cattle” ethos, tend to view virtual machines as being disposable. However, whenever there is an issue someone on the IT team still needs to take the time to restart a virtual machine, Bilancieri said.

    Despite the drive to ruthlessly automate in the management of IT in the age of DevOps, there are still many tasks being performed manually. As the number of workloads in cloud computing environments continue to increase, those tasks conspire to slow IT operations. There are, of course, many ways to automate IT processes in the cloud. SIOS is making a case for a simpler approach to managing EC2 instances that doesn’t require IT teams to set up an entire IT automation framework.

    Many IT teams will opt to create their own scripts to manage EC2 instances. However, it’s all too often the case that those scripts are poorly documented and don’t scale especially well over time. In addition, each time the IT professional who wrote a script that the organization depends on leaves the organization, there is no one left to update and maintain the script and new members of the IT team wind up writing yet another script to perform the same function.

    There will always be some type of script floating around the IT environment. However, in the age of DevOps, the time to start reducing the number of those scripts that need to be supported might be at hand.

    — Mike Vizard