The myth of cloud insecurity
It’s not exactly clear when the term "cloud" was first used to describe shared pools for configurable IT resources. However, it’s safe to say that it started creeping into our lexicon less than ten years ago.
Back then, the official definition of cloud was even less clear than it is today. Regardless of what the cloud actually was, this mysterious cloud entity was widely assumed to be unsafe.
That said, even from the beginning, I saw that the cloud offered many security advantages, especially to smaller companies that couldn’t afford to make infrastructure investments and hire many highly-skilled staff to manage complex IT systems in their own on-premises data centers. Still, doubts about cloud security swirled.
But in 2014, a crazy thing happened. Defying conventional wisdom, the CIA, arguably the most security conscious organization in the world, announced their plan to work with Amazon Web Services (AWS) to adopt commercial cloud services. Shortly thereafter, C2S was born.
Even though countless other agencies had already adopted the cloud by 2014 -- the CIA and C2S gave the cloud instant credibility. It made federal agencies and highly regulated commercial organizations realize that if cloud technology is good enough, and secure enough for the CIA, than it must be secure enough for them. Granted, the C2S is an isolated environment, it was noteworthy that CIA made the often trumpeted "cloud first" policy a reality.
AWS recognized early on that security was important to ensure continued, widespread adoption of cloud services. For this purpose they introduced a shared responsibility model to help explain the security benefits you derive simply by hosting your workloads within AWS. Under this model, the customer is responsible for security in the cloud, and AWS is responsible for security of the cloud.
Not only does this shared responsibility model help address a number of security questions, especially in the areas of infrastructure and physical security, it also helps clients demonstrate compliance requirements more quickly and efficiently, because they can inherit results directly from AWS.
AWS certainly isn’t the only cloud service provider (CSP) in the game -- Azure and Google also understand how important the message of cloud security and compliance is to drive further cloud adoption.
Despite all of this it is essential for organizations to understand the potential security pitfalls of cloud adoption. It’s essential to know where your cloud service provider responsibility stops and customer responsibility starts. There have been a number of recent breaches resulting from unsecured cloud-based database deployments. Customers need to understand, and take seriously, their responsibility in protecting their systems, their applications and their data.
The cloud has come a long way over the last ten years. Much progress has been made to enhance security and promote these security and compliance benefits. However, there is still work to be done to address lingering security concerns, questions and perceptions to help drive even broader adoption of cloud services.
If you’d like to hear what CSPs have to say about the myth of cloud insecurity, join me on Wednesday, November 15 at NVTC’s Capital Cybersecurity Summit. I will be moderating a panel that will discuss the current state of cloud security and compliance, featuring prominent voices from the big three cloud providers: Google, Microsoft and AWS. I hope to see you there!
Photo credit: allepu / Shutterstock
As CEO and chairman of the Board of Telos Corporation, John Wood orchestrates the company’s support of corporations and governments worldwide in the critical areas of cybersecurity, secure mobility and identity. Prior to joining Telos in 1992, Wood worked on Wall Street. In 2014, he was appointed by executive order by Governor Terry McAuliffe to serve on the Virginia Cyber Security Commission. He is founding chairman of the Loudoun County CEO Cabinet and was chairman of Loudoun County’s Economic Development Commission.