Solving the BIG problems in cloud computing

Solving the BIG problems in cloud computing

• The benefits of cloud computing are clear, from access to new technology, to flexibility in scaling resources at peak times, and enterprises are reaping the rewards. However, despite the rewards, enterprises we speak to continue to identify two big challenges in deploying or growing their use of the cloud—cost and security. Most IT professionals surveyed by Omdia in 2020 who work in enterprises using cloud services said that they are unable to keep tabs on the number of cloud services in use at the company. The emergence of shadow IT is a well-known problem in the industry, but it is rarely discussed because the concept of using unprocured and unsupported cloud services is strongly discouraged by IT teams. Shadow IT can lead to overspending on cloud services due to underutilization and suboptimal contract negotiation, and more importantly, it can expose the organization to significant security risk, expanding its attack surface unbeknown to the security team.
• Then there is the issue of how to secure cloud infrastructure (workloads, data stores etc.,). Cloud-native start-ups can afford the luxury of choosing the security tools and platforms they like for their cloud estates, but all other companies must struggle with the migration process: do they attempt to extend their on-premises security tooling into the cloud, and if they are adopting more than one cloud provider (the so-called multicloud strategy that is increasingly widespread), can they use a single security armory to address all their requirements? In other words, how do they address both hybrid (on-premises and in the cloud) and multicloud security challenges?
• This research reviews new technologies and approaches that can improve the visibility for IT teams, enable a one-network policy across an organization, and make it possible to gain an enterprise-wide view of a company’s security posture. We will specifically review best practices in cost management and security

Investment in cloud computing continues to grow

At the end of 2021, we surveyed 151 companies in North America across all industries, from manufacturing and retail to Tier 2 cloud services and content providers. While their business lines differed, what they had in common was that they were all using cloud services. Most survey respondents used a combination of infrastructure as a service (IaaS), software as a service (SaaS), and/or platform as a service (PaaS). The survey showed that users of cloud services dedicate 34% of their IT budget to cloud services, with this growing to 39% by the end of 2023. We also found that, on average, respondents used seven cloud service providers already.

Approximately what percent of your IT budget is spent on cloud services now, and what do you expect for 2023?

Multiclouds are real and are here to stay

This is the fifth edition of this focused survey. One consistent finding is that companies continue to increase the number of cloud service providers (cloud SPs) they partner with. On average, respondents to our 2021 survey used seven cloud SPs already, with the number growing to nine in 2023.

Cloud enables quick development and experimentation

Respondents indicated that they intend to use IaaS and PaaS for faster application development and access to prebuilt application building blocks. Today, just over half of the companies surveyed used the cloud for redundancy, with this expected to decrease slightly over the next few years.

In a follow-up question we asked respondents what share of their applications were developed using PaaS. On average, 34% of applications were developed using PaaS in 2021, with this number growing to 47% in 2023.

Today, most companies surveyed use SaaS to experiment with new applications without deploying in-house IT infrastructure. Going forward, SaaS will increasingly be used for application redundancy and to outsource or replace in-house applications.

In a follow-up question, we asked respondents what percent of their applications were SaaS. On average, 37% of applications are SaaS in 2021, with this number growing to 47% in 2023.

Shadow IT is real and can cause billing surprises and security breaches

Do end users in your organization purchase cloud services that are not procured or supported by the central IT organization?

The problems shadow IT creates are:

• Potential for surprise billing due to data egress charges. Placing data into a cloud provider’s storage is often free, but when it comes to data leaving the same cloud provider’s storage there are costs, something that is alien to organizations that operate on-premises.
• Risk of security breaches caused by improper access control, particularly because spinning up a new cloud service has been made so easy. Teams could unintentionally violate security policies or breach regulatory policies.
• Operational issues and interoperability—IT teams need to be equipped with the tools to help.

>85% of companies use at least two cloud SPs

The results of our focused, North American survey are not isolated. Every year we also run a broad, global survey of thousands of companies. This year, we received responses from 4,905 companies across 57 countries and territories. Companies providing various financial and insurance services made up a large chunk of the sample, as did telecommunication and media companies, a visibly different composition from that of our focused, North American survey of 151 companies.

Which of the following cloud SPs account for at least 10% of your workloads?

• Only 39 out of the 4,905 respondents indicated that they use only on-premises computing, showcasing just how widespread the use of cloud services is.
• Over 85% of respondents used at least two cloud SPs. On average, respondents used 2.3 cloud SPs in combination with on-premises IT infrastructure.

Plans are to further distribute workloads to more edge locations

Respondents to our global survey of 4,905 companies indicated that nearly half of their workloads are currently running on Amazon Web Services (AWS), followed by IBM cloud, Google Cloud Platform (GCP), and Microsoft Azure.

Each of these has its own cloud-embedded virtual routers: Amazon has a transit virtual private cloud (VPC) and a private off-internet pathway—AWS PrivateLink; Microsoft has Azure Virtual Network (VNet); and Google has VPC Network Peering. These cloud networking services are easy to use and configure, but it is impossible to connect these without external help. Determining the right networking option starts by tracking your workflows.

What percentage of your total workloads are currently running in the following platforms?

Respondents also intend to distribute their workloads closer to end users and across more locations as latency becomes a core determinant of application performance. Workloads such as motion control for smart devices and retail store operations require extremely low latency. The distribution of compute, not just among cloud SPs but also across edge locations, increases the importance of consistent network and security practices. The more distributed the network, the more important visibility and management become.

What percentage of your workloads operate at the edge now and in 18 months?

Some workloads are more cloudified than others

Despite most companies we heard from having deployed cloud services, we saw caution in terms of which workloads they’ve placed in the cloud.

Customer-relationship management and video collaboration are the most cloudified applications, with respondents indicating they prefer to consume them as SaaS.

Where enterprises were understandably cautious was with business- or mission-critical workloads such as financial management solutions and commercially licensed databases. Today, these workloads run primarily in legacy environments on-premises.

However, it looks like this is all about to change.

Workload distribution based on respondents’ application delivery strategy in 2021

Mission-critical workloads will also move to the cloud

By 2023, companies responding to our large-scale global survey intend to adopt a hybrid multicloud environment, even for mission-critical workloads such as commercially licensed databases and financial management solutions.

In conversations with cloud service providers, we heard that they are actively investing in hardware optimized for these workloads to take advantage of this end-user demand.

Workload distribution based on respondents’ application delivery strategy in 2023

Cloud security considerations

Proactive versus reactive security

• In IaaS and PaaS environments, the customer is responsible for the security of the workload (i.e., their application code and the data it is using). As such, it is essential that they deploy technology to detect and respond to security exploits underway against them. Such technology is often referred to as a cloud workload protection platform (CWPP). Given the increase in so-called east-west traffic between apps, there is also a need for technology that can inspect application programing interface (API) requests to check their validity and block any bogus activity. Therefore, hop-by-hop visibility is a key requirement for teams that are monitoring activity in an organization’s cloud estate(s).
• However, there is increasing interest in more proactive approaches to securing the cloud. This is driven partly by the rate of growth of the threat landscape and the lack of available security professionals, creating a perfect storm of “too much to do, with too few hands to do it.” In this scenario, securing the estate before an attack ever happens makes a lot of sense, with this approach often referred to as a “shift left” for security. Examples of this thinking are technologies such as cloud security posture management (CSPM), cloud permissions management (ICPM), and infrastructure as code (IaC) checking.
• CSPM addresses the common problem of security and/or compliance drift. This is when a cloud asset has undergone changes in its functionality after going into production, due to changing business requirements or other legitimate factors, which has nonetheless led to it (a) falling out of compliance with regulations such as HIPAA or PCI, or, indeed, with internal governance rules, or (b) expanding the organization’s attack surface, for instance by suddenly increasing its exposure to the public internet. In such a scenario, CSPM tools can either alert a security team to the need to take remedial action or, if the customer prefers, perform that action in an automated fashion. In this context, it is important that companies have the ability to run checks that ensure configurations are consistent with corporate security policy.

Built-in versus bolt-on security

• Another important consideration for organizations using cloud services is whether to use the security capabilities offered by the cloud SPs themselves (the “built-in” option) or whether to deploy tools from dedicated third-party security vendors (the “bolt-on” alternative). Each option has its pros and cons:
• Built-in security will enjoy deeper integration with the cloud SP’s infrastructure and potentially will be able to draw on more detailed configuration and performance data “out of the box.”
• It may also be free, or at least offered at low cost, since the cloud SP’s motivation is to promote customer loyalty via the excellence of its security provisions, rather than to monetize its security capabilities.
• However, a major downside to built-in security offerings is that they tend to work only on the infrastructure of the cloud SP in question, so if you are adopting a multicloud strategy for your application infrastructure, you will likely face the challenge of dealing with multiple different dashboards, one for each cloud provider. Bolt-on security vendors, by definition, must be heterogeneous and enable customers to get an accurate picture across multicloud environments, without the need to flip between screens.
• This is the one great advantage of security from third-party vendors in the cloud—that is, that it must be heterogeneous (i.e., the vendor must support all the major clouds in order to maximize its addressable market). Some cloud SPs (in particular AWS) have a vested interest in offering security that works well on their platform, but little to no interest in securing their competitors’ clouds. The situation is slightly more nuanced for Azure and GCP, since they are both in catch-up mode and so need to convince AWS customers to embrace a more multicloud approach in which case security that covers all clouds is a plus.
• Nonetheless, no cloud SP currently has a comprehensive multicloud security offering, and probably never will.

What you need to do