Multicloud deployments are all the rage these days, and for good reason. They provide the ultimate in enterprises flexibility, letting you mix and match cloud services to meet your exact needs. As a result, they increase business agility and operational cost-efficiency.
But the trade-offs are clear. Using multicloud means having more complexity. simply because there are more moving cloud parts. Moreover, you’re mixing the cloud services with existing legacy on-premises systems, not to mention systems outside of enterprise such as exchanges.
While complexity brings many challenges, such as management and governance, the greatest risk it brings involves security. IT organizations traditionally dealt with security at the application and system levels, so enterprises are managing hundreds of security systems localized for a single system and purpose. That approach worked when things where simple, but now that they are complex we’re finding that traditional approaches just won’t scale.
Therefore, the risk of breaches increases with complexity, both cloud-driven and traditional.
So, what’s an enterprise to do? It’s really a matter of backing up a bit, looking at the common security needs, and finding common security solutions that can be implemented across systems and applications, both cloud and noncloud. Doing so typically means using technologies such as identity and access management (IAM) that can move security to a higher level of abstraction that works across systems.
The trick is to deal with hundreds of systems, cloud and noncloud, as a single system with common patterns and components, such as storage, compute, databases, and networks. This is the only way that you should think about security: as holistic and strategic, not siloed and tactical.
Although this is easier said than done, I urge enterprises that are moving to complex architectures to deal with this issue now, rather than try to retrofit security solutions after the breach that kills the business.