A Real-World Approach to Improving Security in the Cloud

Everybody knows that the cloud -- in particular, the security of cloud deployments -- is a huge pain point industry-wide. And as is the case with any new endeavor with such broad-sweeping impact, there's no shortage of well-meaning advice about how to secure it.

But I confess to finding much of that advice about cloud security somewhat frustrating. Why? Because much of it fails to account for the realities of what drives cloud adoption: Namely, the economics. Consider, for example, a typical cloud deployment: Executives hear about the promise of cloud in terms of dollars saved through things like datacenter consolidation, reduced technology footprint, etc. But addressing the (quite real) security challenges of the cloud requires investment. Once security SMEs start layering on controls, executives see their proposed returns get smaller ... and smaller ... and smaller.

Not only is this a hard conversation to have (and one that doesn't add to the popularity of the security organization, by the way), but chances are you can guess how it'll end: namely, with many of the most effective (but most expensive) security controls stripped away. This leaves security practitioners in a quandary: We need to do something about security in the cloud, but with relatively little budgetary support for new controls. Add to that the fact that cloud is disruptive to many of the security tools we currently have fielded ... well, it's no wonder folks are nervous.