Page 19 - Cyber Warnings December 2015

Migrating to a Hybrid IaaS Environment: Look Before You Leap

How should organisations approach moving key business applications to the public clouds,
while maintaining security and connectivity?

Nimmy Reichenberg, VP of marketing for AlgoSec shares his checklist of essentials

“The difficult, we do immediately; the impossible takes a little longer” is a phrase familiar to many IT
teams. That’s because they’re used to senior executives making challenging demands, such as
“Our competitors are making big savings by moving to the cloud, and we want to do that too.

So can we move our core business applications to the public cloud by the end of this year? It won’t
affect security, will it?”

If only it was that simple. Managing network security across a hybrid cloud environment is still an
emerging area with many challenges, as highlighted in a recent AlgoSec survey that looked at the
issues IT teams face in trying to unify security policy management across on-premise and public
cloud environments.

Of the 360-plus senior IT professionals surveyed, 66% agreed that it’s difficult for them to extend
the corporate network security policy to the public cloud. Worryingly, a third of companies planning
to deploy business applications in the cloud did not know which tools they will use to manage their
network security policies after deployment.

So moving to a hybrid IAAS environment isn’t something that can be done overnight – it needs
preparation and careful management to ensure security is maintained. To help with preparation,
here are 5 tips to help in devising a strategy for a migration.

Choosing the right security controls
There are three basic methods to secure network access on public clouds. Commercial-grade
firewalls for the public cloud are available, but the level of support and functionality varies greatly
between vendors.

Their benefits include unified management with their respective on-premise firewalls as well as
familiarity with how policies are defined and enforced. Cons include cost (although some vendors
are now offering pay-as-you-go or bring-your-own-licenses pricing models), scalability and a limited
feature-set for some vendors.

Alternatively, some cloud providers will provide their own security controls (e.g. Amazon Security
Groups). These controls are generally free – which is always attractive – and provide a good level
of functionality.

19 Cyber Warnings E-Magazine – December 2015 Edition
Copyright © Cyber Defense Magazine, All rights reserved worldwide