Making Cloud Work for You

Cloud adoption is increasingly becoming inevitable, as the CIOs realize that implementation of the cloud has benefits of better productivity and lesser spend of IT to name a few. Understanding the benefits, it is safe to say that companies from large to small will move significant parts of their operations to the cloud in the next one to two years.

While every organization wants to embrace cloud in one form or the other, not all of them will get the results they desire. Before you take the cloud plunge, CIOs need to factor in a whole lot of aspects and avoid committing some common mistakes.

Top five Mistakes that Might Spoil Your Cloud Plunge

• Not opting for the right cloud model: Companies moving to the cloud can choose from public to private, or community to hybrid. A public cloud is owned by a cloud provider and made available to the users on a multi-tenant, pay-as-you-use basis; whereas, a private cloud is owned and deployed by an organization for internal use as a single tenant. Meanhwile a community cloud is cooperatively shared by a set of tenants, often from the same industry. And a hybrid cloud spans the cloud deployment models listed above, enabling applications and data to move easily from one cloud to another.

Each type of cloud deployment offers its advantages. The factors to consider before adoption are the business criticality of the applications like regulatory issues, necessary service levels, usage patterns for the workloads and how integrated the application must be with other enterprise functions.

• Not integrating cloud security into your corporate security policy: Your cloud and corporate security policies must be integrated.
  
  Instead of creating a new security policy for the cloud, extend your existing security policies to accommodate this additional platform. To modify policies for cloud, you need to consider factors such as where the data is stored, how the data is protected, who has access to the data, compliance with regulations, and service level agreements. When it is implemented successfully, adoption of cloud computing can be an opportunity to improve your security policies and overall security posture.
• Security of your cloud based service provider: Do not assume that your data is automatically secure just because you use a service provider. You need to do a comprehensive review of the provider's security technology and processes, and check how they secure your data and their infrastructure. Following are some questions to ask yourself before the plunge:

- Application and data transportability: Does your provider allow you to export existing applications, data and processes into the cloud? Can you import these back just as easily?

- Data center physical security: How does the service provider protect its physical data centres? Are they using SAS 70 Type II data centres, and how well trained and skilled are their data centre operators?

- Access and operations security: How does your provider control access to physical machines? Who is able to access these machines, and how are the machines managed?

- Virtual data center security: Cloud architecture is a key to efficiency. Find out how the individual pieces like the compute nodes, network nodes, and storage nodes are architected, and how they are integrated and secured.

- Application and data security: To implement your policies, the cloud solution must enable you to define groups, roles with granular role-based access control, proper password policies and data encryption (in transit and at rest).

• Data ownership is with the provider: Data is still your asset. Assuming that you are no longer responsible for securing data, never think that outsourcing your applications or systems means you can abdicate responsibility for data breach. Some SMBs have this misconception but you must understand that your company is still ultimately accountable to customers and other stakeholders for the sanctity of your data. Simply put, it's your CEO that risks going to jail, not the cloud provider's.

• Not knowing which local laws apply: Data that is secure in one's country may not be secure in another. In many cases, cloud users don't know where their information is held.

In the process of harmonizing the data laws of its member states, the European Union favors very strict protection of privacy, while in America, laws such as the US Patriot Act give government and other agencies virtually unlimited powers to access information belonging to companies.

It is thus important to know where your data is held. If necessary, store your data in more than one location. It is advisable to choose a jurisdiction where you will still have access to your data, should your contract with the cloud provider be unexpectedly terminated. The service provider should also be able to give you flexibility on where you want your data to be held.

The bottom line is that the adoption of cloud must come with risk mitigation steps, and firms are well served to plan for and act on these steps from the outset, so that returns on their cloud investments can be maximized.