A Renewed Focus On Cloud Security

IBA Group
Mark Hillary

Capital One bank in the US was recently targeted by a single hacker who managed to access the personal details of over 100 million customers, despite the bank having all the security you might expect of a large customer-focused organisation. The hacker was a former employee of Amazon Web Services (AWS), which hosted the bank database. They broke in by exploiting a poorly configured firewall, no doubt using some of their inside knowledge.

Once again we are watching as a major brand faces a data disaster. Capital One should be able to absorb the millions of dollars in fines and customer compensation, but for a smaller organisation this type of data breach could be the end. European fines are much higher than those in the US thanks to the European Union GDPR regulation, but why should companies be more focused on this question of data security now?

Because of cloud computing. A recent report in CIO suggested that 96% of companies are now using cloud computing. This means that almost every new database will be in the cloud. Justin Fier, the director of cyberintelligence at Darktrace recently suggested that the general approach to securing networks – mainly with firewalls – has not yet woken up to the fact that everything is now in the cloud.

Network security managers have spent years designing their systems with the concept of what is inside the organisation, what is outside, and how to protect network entry points. Now we are seeing a complete shift away from this structure to the cloud. Companies such as Microsoft and Amazon are offering cloud services that allow their customers to access unlimited storage and computing power.

But this also means that your personal customer data will be outside the organisation and physically located on a service managed by another company. Companies like Amazon have developed a reputation for security and are probably better at securing their systems than any old internal system you previously had, but what happens when a current or former employee goes rogue and hacks into the database they used to manage?

As Justin Fier suggests, there are some new approaches to data management and network security that are essential:

  • Better network oversight; your development and support team can probably create and use new servers instantly meaning that the security team often has no real oversight on the network that is really being used. Give them better tools that allow them to manage what is really out there on the network.
  • Look for malware; Capital One only ever found out about the hack, three months after it happened, because stolen data was seen online. Be proactive and seek out malware and other tricks that hackers will use to break in.
  • Explore Artificial Intelligence (AI); you often can’t prevent an insider launching an attack so create some digital oversight. Use an AI system to monitor all network activity so you can be alerted when any unusual activity takes place – and ensure that nobody can turn off this AI police officer.

The bottom line is that cloud computing offers too many advantages and opportunities for companies to avoid it. With an adoption rate that is now almost universal there is no going back, but we certainly need to consider how best to change and adjust network security for the cloud computing era.

The border or the organisation is no longer the office itself. People and their skills are sourced from suppliers and databases will be located in the cloud. Both people and data now move in and out of the central organisation in a porous way. Protecting this environment is the challenge we face today. Questions about a cloud security strategy should be amongst the first things any executive should be asking any potential IT partner and if the supplier fails to have any intelligent answers then why would you work together?

A Renewed Focus On Cloud Security

How Will Platforms Develop in 2019 – Especially Cloud?

IBA Group
Mark Hillary

One of the biggest changes in recent years in the IT market has been the use of platforms to deliver solutions. Software development may have moved on from the old waterfall style developments to agile delivery models, but many projects still required analysts to design solutions, developers to build them, and engineers to then deliver the product.

Consider just these three types of platform and the change becomes obvious:

1. Cloud; the ability to use a system remotely without local hardware or storage requirements and usually charged on a pay-as-you-use basis.

2. App Store; developing systems for Android or iOS and releasing them to the App Store allows software to be globally distributed instantly.

3. Social and mobile; the success of games such as Farmville or Mafia Wars has largely been because they were designed to be social – play is integrated into social networks such as Facebook so friends can actively engage with your game or compete with you.

These are all major changes to the way that software is designed and released. Not least, one of the biggest changes because of these platform adjustments is that business line heads – rather than the CIO – will make decisions on new IT systems. If the IT tools can be delivered without affecting the infrastructure of the client company then this is much more likely.

In particular, the cloud is changing how enterprise systems are delivered. Business users can pay for systems on a subscription basis without the need to plan for infrastructure and this is radically transforming how many companies see their use of IT and supportive software systems, such as ERP or CRM.

But even the cloud is undergoing rapid change. Many developers are now suggesting that there are some key trends to look for in the cloud market in 2019, such as:

1. Multicloud; AWS, Google, and Microsoft are the cloud giants and all have their strengths, but many companies are now exploring how to reduce their reliance on a single cloud supplier – for security, resilience, and to gain advantages from the strengths of each one.

2. Migration; it will be more common to migrate across different clouds to take advantage of deals or strengths from specific suppliers. New tools will make this much easier.

3. Governance; many companies still have fairly weak rules governing their cloud use and this will get stronger in 2019.

These are interesting points and worth noting. It has never been a good strategy to get locked into a single IT supplier and now we are seeing the same caution with cloud suppliers. 2019 will not only be a year of opportunity for various platforms, it will be a year where we start auditing how these platforms are being used.

Using The Cloud To Achieve Digital Transformation

IBA Group
Mark Hillary

Cloud computing has transformed how the enterprise uses both storage and applications. Local storage is no longer a requirement with remote server farms immediately managing any requirements and applications using cloud resources to cope with heavy loads – such as online retailers on particularly busy shopping days. All these benefits of the cloud have become normalised, but could we be achieving more with cloud-based services?

A recent feature in ZDNet suggests that we can – digital transformation. Most enterprises view digital transformation through the lens of a change in business model, for example a retailer with a focus on in-store sales shifting their attention to apps. However, the ZDNet research shows that enterprises with a requirement to quickly change business model or offer an improved digital service could be more effectively exploring cloud-based services.

The research group IDC claims that spending on digital transformation in 2017 topped $1.3 trillion, so this is a market where a lot of enterprises are spending, but are they getting the best value and results from that investment?

The problem in many cases is that the technology makes the problem look simple. The cloud, Big Data, the Internet of Things (IoT) – on the surface all these technologies are easy to understand. Executives can sit in the boardroom and proclaim that we need a business strategy that builds on the IoT, yet it is one thing to declare that you want to use a certain type of technology and another to figure out how to make that an integral part of your business in a way that delights your customers.

This is where ZDNet believes that a focus on the cloud can pay dividends. Too many enterprises do not have an efficient or well-structured IT department. There are disparate apps spread across different storage facilities and no easy way to share and analyse data across all the business applications being used. Rather than focusing on technology-led solutions, such as what can we do with AI or the IoT, it makes more sense to fix this central core of the organisation by using cloud-based services. Fix the platform and your applications and data use will naturally transform.

Secure cloud access is a proven technology and it is simple to deploy if you hire a good partner with cloud expertise. The initial focus can be on storage, but you can build out from there to centrally manage business applications and data.

This approach can drive digital transformation in your business, not because it is a radical change to manage storage or apps in this way, but because once you organise your systems around this central core, with strong business application support and the ability to share data across systems, you will be able to quickly design new solutions that could only ever work in this environment.

Sometimes it is better to build the platform and let the solutions arrive through innovation, rather than trying to build the solution on day one. Once you have a platform in place that allows data sharing, then the ideas will flow and your teams will automatically start exploring digital transformation options that are driven by business needs – not just technology.

IBA Group has been exploiting the capabilities of cloud computing, as well as other CAMSS technologies (cloud, analytics, enterprise mobility, social media, and security) to provide end–to–end business transformation services to our customers. In 2015, IBA Group opened its data center that offers various types of cloud services, including IaaS (Infrastructure as a Service), PaaS (Platform as a Service), and SaaS (Software as a Service).

Can We Really Rely 100% On The Cloud?

IBA Group
Mark Hillary

Companies across the world will recall February 28th 2017 as a bad day. It was a day when their patience was tested beyond anything most executives can remember in years. It was the day that the Amazon Cloud went down.

The Amazon Web Services (AWS) Simple Storage Service (S3) service now accounts for an enormous amount of Internet traffic. There are many major players in Cloud services, such as Microsoft, Google, and IBM, but AWS is the biggest. In fact, AWS is so big that their cloud revenue is about twice the total of those three other companies.

Forrester Research predicts that the cloud marketplace will be worth $236bn by 2020 – that’s up from around $95bn in 2016. So it is clear that this is an important market. It’s growing fast and it has changed the nature of IT services and IT outsourcing. Companies are now keen to buy end to end services that can be delivered over the cloud, rather than requiring infrastructure and software on site.

However, the AWS service failure in February shows that some companies have become complacent about the cloud. It was a simple human error by an engineer at AWS that took the service down for over 4 hours and affected millions of people. Why were so many companies taken by surprise and why did nobody have a backup plan?

This feature in Database magazine asks all these questions and suggests a few pointers for executives who want to mitigate against a similar disaster in future.

In general, cloud services are more reliable than setting up infrastructure inside your own office. Companies like Amazon invest enormous amounts to ensure that network and power outages are avoided. However, as we have seen, problems can happen and if your service needs to be available to customers 100% of the time, how can you offer your own guarantee when you can never be 100% sure that your own infrastructure providers will deliver?

In my opinion, the three best tips from the Database feature are:

1. Monitor services yourself – don’t just rely on your supplier. You might notice service issues before the cloud supplier ever tells you something is wrong.
2. Have an alternative provider ready – it’s expensive to duplicate, but if you really cannot afford any outage then mirroring may be required.
3. Communicate – make sure that you tell customers you have a problem so they can come back later or otherwise delay their interaction with you. By saying nothing, customers will expect a normal level of service.

IT services has been transformed by cloud based services and because it generally improves the reliability of services executives have often been blinded into believing these services can always be relied on. Mostly they can, but it’s worth remembering that even the biggest and best planned networks can fail. What would that mean for your business?