Andy Kicklighter | Director of Product Marketing
Thinking about what we’re hearing from Enterprises, Government customers, and Cloud Providers (of all types) it seems that there are some trends worth noting and thinking about around Cloud Security. Here are 10 key trends that continue to come up.
1 – Cloud Security – Just like my Enterprise. Customers and governments are going to demand that cloud providers begin to offer the same level of security that organizations see within internal IT environments. We’re already seeing this start, with cloud providers getting ready to offer this level of security either as an add-on to their existing offerings, or as a base feature that distinguishes their offerings from those that do not. This includes every category of security technology that enterprises utilize today and every type of cloud service provider.
2 – Data Centric Security in the Cloud - With the perimeter failing for even internal IT environments today, due to Advanced Persistent Threat (APT) type attacks, security will continue to move closer to where-ever sensitive data is found. Cloud-based solutions that protect data with access control will become increasingly prevalent.
3 - Multi-factor authentication comes of age in the Cloud – Long a trend for the financial industry and secure sectors of government this area will increasingly become a requirement. Cloud solutions will need to be able to integrate both with enterprises’ internal systems and with cloud provided solutions to multi-factor authentication.
4 – Smarter Cloud Security – ‘Big Data’ implementations will increasingly be used to identify anomalous access patterns that can indicate compromised accounts, systems and infrastructure elements by finding unusual operation patterns. Initially there will be problems with high levels of “false positives” until vendors and users find ways to identify what “normal” usage patterns are, but these should decrease over time as the implementations become “smarter”.
5 –Aggregated - Web based threat intelligence for data. We’ve had shared threat intelligence for malware as part of anti-virus for years now, expect to see more of this, and in new areas to identify threats as they evolve and take hold – allowing early identification and mitigation to those belonging to groups sharing threat intelligence data.
6 – More criminal intent and use of cloud-based technologies – For years most hackers were driven by a desire for fame and recognition. Increasingly governments have taken up “hacking” rivals and perceived enemies. As it continues to become more lucrative to hack remotely, rather than physically attack for gain, expect to see criminals both using cloud environments to launch attacks and hacking those cloud environments for financial gain.
7 – Integration of security infrastructure into cloud infrastructure sets – Vmware, OpenStack, Eucalyptus and other cloud-stacks will increasingly include integration points for security technologies to plug into their “stacks” – making it easy for enterprises to customize their cloud security – either public or private – to meet their needs. Why is this important? – It provides for competition and innovation. Vendors will have standard interfaces to write to for standard functions, and will undoubtedly find new and unexpected ways to use those available interfaces to provide even better services. In the longer run, many aspects of security may even end up in the cloud platform – just as with desktops and server OS’s today that incorporate some of the security features once available only from third parties.
8 - Integration of enterprise level security into cloud-based OS instances – Today, when you request an image from Amazon Web Services you get a base OS instance, without the security enhancements to make it truly secure in the environment. Expect cloud providers of IaaS and PaaS to start offering enhanced instances, easily consumed that include the core security services desired by customers. For SaaS, expect more SaaS providers to put security front and center – building it in at the base level as part of their offerings in order to be able to woo increasingly sensitive enterprise customers to use their services.
9 - Cloud-based security for cloud-based businesses – If you visit start ups throughout the San Francisco bay area today, you’ll see a continuation of a trend for new businesses. To wit – No Servers and No Data Centers. As this trend continues, these same newer businesses will continue to want to consume cloud based services, even for security, rather than physical implementations that have to be installed to be consumed. Expect to see increasingly sophisticated cloud-based security services that are managed as SaaS environments available to meet this need as we move forward.
10 – Longer term - The cloud – More secure than your enterprise? – As with outsourcing today, some pieces of IT infrastructure become so powerful and sophisticated that even the talent to properly manage them at a base level is hard to find, and the expertise to really make them “hum” is beyond all but the most sophisticated of IT organizations. IT Security is poised to become another of those areas, where application of real, in depth expertise can make a real difference. APTs have a good chance of driving this trend –These attacks almost always succeed in penetrating traditional perimeter defenses, even today. This opens a real door for cloud providers who are ready with implementations that are as secure, or even more secure than enterprises could implement themselves. They stand to gain greatly as a result of new business, transitioned to environments that are safe beyond the means of a traditional enterprise, and offer organizations the flexibility and advantage associated with cloud-based services.