The elephant in the data centre
A new white paper from the NCSC explains the potential benefits of adopting a cloud-system.
IR_stone via Getty Images
At the NCSC, we often hear concerns about the new risks associated with moving traditional systems to the cloud. Some organisations believe that cloud deployments will result in more overall risk than traditional systems.
The elephant in the data centre is that our assumptions about how the current system actually works (and what it comprises) rarely reflects reality. So it’s important for us to fully understand the true nature of our existing IT system - rather than what we think it is. Otherwise, when we start to consider the pros and cons of moving to a cloud-based system, we won’t be making a useful comparison.
Making a fair comparison
When we can make an accurate comparison between our existing system and a cloud-based alternative, the risks associated with moving to the cloud become much more acceptable. For example, when moving to the cloud, a large amount of infrastructure may need to be replaced. Although this existing infrastructure won't necessarily be considered 'brand new', there's a temptation to forget how old it actually is. It may have met our organisational needs when originally commissioned, but does it meet today’s needs?
Similarly, consider the threat model that was used when the infrastructure was commissioned. Is that model still applicable today? Now consider how your estate is maintained today. For example, do you know if your estate:
- includes legacy or unpatched operating systems, hypervisors, microcode, or firmware
- is maintained using a formal process or automation
- is configured consistently and according to the documentation
- documents the current design or the original design
Using the cloud to address the big security challenges
The security benefits of moving to a cloud-based system are often overlooked. In fact a good cloud service will mitigate some existing risks, and bring new benefits as well. Today we’re releasing a white paper that describes the security benefits to be gained from adopting a good cloud service, many of which have proved difficult to achieve in traditional IT deployments.
The more you take the time to understand the cloud services available, the bigger these benefits will be. Some of these solve the big security challenges that we've struggled to solve in traditional environments (such as having an exhaustive inventory and a single, consistent approach to authentication, authorisation, logging, monitoring, and alerts). Good cloud services make these advanced security accessible to all customers, not just those with big budgets.
Jamie H
Senior Security Researcher
Share and print this article
Written by
