(upbeat music)
- [David] So when considering migration,
security is extremely important for obvious reasons.
Ultimately, if we're going to move applications and data
into the cloud, we need to protect those applications
and those databases from outside threats;
malware, ransomware, interception,
theft, breaches, things like that.
While that's very obvious
to most who exist in the world of IT,
in many instances in migrating to the cloud,
security tends to be an afterthought.
Even though it's desirable, many people think about it
after the application's already migrated to the cloud.
And by then, typically it's too late.
So we need to consider the aspect of privacy.
So keep in mind, we have a few things here.
We have ethical privacy, or basically the ability
to maintain protection of databases,
or ethics or policies of the company.
For example, if you're a customer of a power company,
you'd rather not have your data passed out
to other third parties.
Other things involved in terms of legal compliance.
In many instances, privacy is going to be mandated,
and types of data,
including personal identifiable information, or PII,
may not be passed out to other organizations by law.
You need to understand those.
Need to look at efficiency, or in essence,
how the protections are going to be placed
on the data in the cloud.
And in other words, if we're going to place security
on top of information that exists in the cloud,
we need to make sure that we're doing so in such a way
where we're not reducing the functionality
of the applications or the database.
In other words, it's able to keep up
with the same performance, and it doesn't necessarily add
a great deal of latency.
For instance, if you put encryption on everything,
including information in flight
are moving from one application to another,
or information at rest, including things
that are persisted in a storage system,
and we're encrypting everything.
Then in some instances that may cause a performance hit.
The ability to understand the impact of performance
and tune around it is going to be hugely important.
You need to figure out what to do around data loss.
Ultimately, we need to do business continuity
and disaster recovery operations on the information
that exists in the cloud, and ensure ourselves
that if things are disrupted, including an outage,
breach, the data is stolen, ransomware, things like that,
we're able to recover the data
and get it back to an operational state.
Then compliance.
We exist in a world of laws and regulations,
and ultimately, there's regulations that are associated
with your particular industry,
such as healthcare and finance, as well as regulations
that are associated with the country where you exist.
In other words, in some organizations, in some countries,
ultimately, we're living up to not only standards
within the company that are set by the company,
but standards within the industry,
such as healthcare's HIPAA requirements,
such as the protection of PII,
or personally identifiable information.
And then ultimately, the laws of land,
in terms of things that the government is dictating,
in terms of how data is going to be handled.
You need to understand what they are,
you need to understand where your data exists,
you need to understand the relevant legal issues
around the data in terms of its location,
and have to deal with all three aspects;
policy, industry regulations and country regulations.
So keep in mind that cloud security is systemic.
You know, ultimately, this is about something
that is going to touch pretty much every part
of the cloud solution that you're deploying.
So we're going to have to understand
that we're going to have a dedicated and experienced team.
We need to understand or assess
what the current security state is.
We need to figure out what the issues are
and how to solve these problems.
We need to understand what software and tools
are available to us to leverage.
We need to understand that we have to align
to particular industry standards.
We need to figure out a roadmap or the way
in which we're going to manage security going forward.
Need to have a global approach
in terms of how data is going to exist,
not only within the country where the business is located,
but throughout the world.
And then we need to deal with multi-cloud
or the ability to leverage new or existing cloud providers
in such a way where security is going to be similar
between cloud providers.
(upbeat music)