I’m doing a (guest) webinar for RootSecure on Wednesday Oct 24th @ 11:00 EDT (Toronto) time. You can register if you want to hear a bit about things that might surprise you as you migrate from a safe secure comfy closet to a big airy cloud.
For the last years I have been working on cloud, OpenStack, Google, Azure, Kubernetes. And I’ve learned a lot about things that surprised me.
As an example, you might be feeling very secure about your ‘IP blacklist’ firewall. But did you know in a cloud environment all your connections will come from your own IP space? Huh. Makes your audit simpler right? I mean, I guess there was no breach since the data was sent to 127.0.0.1!
Cloud comes in many flavours. There is SaaS (hosted applications like Dropbox, GSuite, Office365, Salesforce). There is PaaS (e.g. a managed database). There is IaaS (e.g. virtual machines and networks).
Cloud can be public (all instances are part of the public Internet, and run on shared infrastructure). It can be private (an elastic pool of capacity runs on hardware dedicated to you), and there is ‘virtual private cloud’ which emulates the latter on the former.
Traditional IT security architectures have emphasised ‘perimeter security’. A set of VLAN’s, controlled physical access, and firewalls at the door. The outside is evil, the inside is trusted. Suddenly a wild cloud appears and there is no longer an ‘outside’ or ‘inside’ or even ‘door’ to place the firewall. Is this your only concern?
Want to know more? Or challenge my conceptions and wild opinions masquerading as fact? Then join and comment away!
Leave a Reply