Sunshine, sandwiches, scenic views, and not a care in the world besides the occasional wasp. Everyone loves a picnic.

Unfortunately, the same cannot be said for PICNIC, an enduring acronym in IT circles standing for Problem In Chair, Not In Computer. The term, dating back to the 1980s, was first employed by frustrated IT professionals weary of dealing with computer problems arising from user error rather than any actual issues with the technology.

Such challenges still exist today although, increasingly, they are migrating to the cloud. Data breaches resulting from cloud misconfigurations can have dramatic consequences. For example, the Capital One breach earlier this year affected more than 100 million records.

In most cases, these breaches are not the result of a particularly skilled threat actor or any advanced exploits or malware. Instead the door is left wide open through human error. Unfortunately, such cloud security issues are the result of poor data protection practices. For instance, sensitive information may be stored in unencrypted form or access permissions not locked down properly.

The Capital One data breach, first reported in July, is a particularly powerful example of how poor practices can trigger a major security crisis. The incident saw customer data including more than 140,000 social security numbers, one million Canadian social insurance numbers, 80,000 bank account numbers, and an unknown quantity of customer names and addresses accessed by Paige Thompson, a former software engineer at Amazon Web Services. It has been estimated that the breach could cost the company upwards of $150m.

The breach was made possible by a misconfiguration of the web application developed by Capital One, and not the underlying Amazon cloud-based infrastructure. Amazon also stated that the perpetrator’s specialist insider knowledge was not a factor, but rather the breach could have been carried out by anyone who stumbled on the misconfiguration.

Similar breaches have occurred at Fedex and Californian car dealership services provider Dealer Leads. Indeed, cloud-based data breaches caused by user errors are becoming so frequent that the PICNIC acronym might arguably be updated to stand for Problem In Company, Not In Cloud.

How can firms reduce the threat?

Because cloud-related mistakes can potentially expose businesses to huge and costly data breaches, organisations must do much more to mitigate the risks. It’s very difficult to remove the risk of human error entirely. Organisations need to ensure they implement robust policies to protect sensitive data in the cloud, as well as the right tool to manage them.

An audit is a good place to start. It is impossible to keep sensitive data safe if a company isn’t aware of what information it owns or where it is kept. Many organisations have spent years hoarding as much data as possible, and it’s all too easy for them to lose track as they expand and change their infrastructure.

Audits can help the enterprise get its house in order.  Their disciplined approach lets organisations locate and classify any and all sensitive information spread across on-premises and cloud servers. Audits are especially good for identifying data that is governed by regulations such as the GDPR and PCI-DSS.

The challenge with built-in classification capabilities present in many cloud-based solutions is that rule creation and tagging is often a labour-intensive, manual process. For this reason enterprises should look to automate this process as much as possible. – Read more

In our modern age, it is natural to want to modernize your business in order to keep up with the times and keep customers interested, so investing in the cloud can often seem like a natural pathway for changing businesses, but it does come with some risks.

Not paying attention to the very real risks of compromising cloud security – which can seem like a faraway, non-important issue – can cost you greatly, and, at worst, could ruin your business. Customers put their trust in you to keep them and their data safe, so compromising that can be the absolute faux par, which will destroy your business’ reputation and ensure that no future success can be enjoyed. But enough with the fear-mongering: how can you stop these security slips ever happening in the first place? Knowledge is your best tool, so knowing about the dangers often prevents them from becoming issues.

Access Control

One of the cloud’s biggest selling points is that it can be accessed from anywhere, by anyone. This is great, but it also leads to one common mistake, which can end up costing your company a lot of business and, most probably, money: don’t let everyone access your cloud networks. Once you open the floodgates, everyone has a chance to rush in and take whatever data they want. Genuine customers could utilize your cloud network, but hackers who want to steal sensitive information such as passwords and bank details will also make use of it, which you definitely don’t want. Limit access to your cloud network as much as possible, without limiting yourself; make sure that the people who need to access it can and that it’s at least password protected, so that no one else is sneaking in and potentially ruining your business.

Maintenance

“Not keeping your cloud software up-to-date is probably one of the worst mistakes that you can make, but it’s a worryingly common one,” says Joni Martin, a tech writer at Writing Services and Revieweal, “and it often comes from a place of ‘maintenance and patches will cost time, money and resources that we don’t need to waste, it’ll be fine’, which is the complete wrong attitude to have. Every single time your software isn’t updated, vulnerabilities appear, which hackers will have knowledge of (due to patch notes and bug fixes lists and so on, all available to everyone on the internet), so you put yourself needlessly at a higher and higher risk of getting a security breach, which will cost you more than maintenance ever would. So, do yourself a favour and don’t be afraid to spend a little to save a lot, by keeping software up-to-date at all times.”

Back-Ups

However, even seemingly airtight, fully updated systems can have breaches, so you do need to be prepared for the worst case scenario, no matter how much you’ve worked to prevent it. In the case of a security breach, you won’t be able to keep using the cloud data which was compromised, so it is recommended to have a back-up set of data ready in order to keep business as usual without ruining users’ experience with your company, possibly causing even more damage to your reputation. Back-ups are a safe way to ensure that breaches can be handled without the added pressure of customer complaints piling up, because a website or online service has been down for an extended period of time, which gives you more time and space to sort out the real issue. – Read more

Enhanced security measures are encouraging use of cloud computing

Consuming cloud services can create a host of new problems.

As it has emerged over the past few years, the cloud has really revolutionized business and allowed us to do amazing things with web-delivered technologies.

However, one of the biggest issues around the cloud has always been, and still is, cybersecurity.

The cloud brings with it a host of cybersecurity issues. Some of them relate to the inherent nature of cloud computing, and others are exploited by hackers through very specific design processes.

Lack of Transparency

Because the cloud vendor model requires client businesses to trust outside third parties, transparency is a big issue. That starts with knowing what your vendor’s data setup is like – whether it’s truly a private cloud, or a multi-tenant design that should rightly be called public – and how many barriers there are between the data holdings of multiple customers.

Then other questions center around the security standards and algorithms that the vendors are running. Even things like uptime have to be hashed out in a service level agreement, or there’s really not full transparency in play. That issue of trusting the cloud vendor is one that’s always been central to the relationship between a cloud provider and a consumer of cloud services.

A company is giving up a lot of control – and with that comes a burden of due diligence and the desire to create transparent relationships with vendors.

“If someone is going to operate a service like a public cloud that people are supposed to be able to count on, while changing it under the hood on a continuous basis, and constantly releasing improvements to it, they have taken a management burden upon themselves that no one else in the computing industry has ever shouldered,” wrote Bernd Harzog at Network World in 2017.

“This gives rise to some very tough questions, which none of the public cloud vendors has been forthcoming to answer.”

There are ways to hedge against vendor risks, for example, creating redundant multi-cloud systems and making in-house systems more versatile, but the threat is still there. – Read more

VMs, or virtualization cloud may sound fancy but there’s a newer and better way to use the cloud.

Cloud services for businesses are essential components, but you might be wasting money by not migrating to a bare-metal configuration.

Saves You Time and are Low Latency

Bare metal servers are supported by hardware architecture that deliver optimum performance all the time.

Bare metal cloud are becoming more and more popular among enterprises as they deliver some of the lowest latency cloud services, a factor that can make or break your company’s performance. You get access to the speed that not only saves you and your employees time but money as well.

More than that, pre-configured instance environments make short work of automation tasks that will normally take half an hour or so. In just a few minutes and several mouse clicks, your cloud is ready to go.

Enhanced Security

In a VM setup, scores of cloud servers are grouped together, which make them more vulnerable to hacking and attacks from external sources. Bare-metal servers on the other hand occupy a single space in an operating system, which makes it more stable, nimble and still enjoy a stronger resistance to hacking and malicious interference. – Read more

The integration between on-premises datacenters and one or more public clouds is what we now call a hybrid cloud setup.

As opposed to multicloud, which involves multiple public clouds without any on-premises datacenters infrastructure in the mix, hybrid clouds offer its users the ability to keep sensitive or “high-priority” data on-premises. Hybrid cloud setups are becoming increasingly popular in both the finance and health-care sectors as both these sectors have quite specific regulations around security and privacy, as well as zero tolerance for latency issues. Imagine a lagging computer on a stock market floor or in an emergency room of a hospital. Sounds scary, but it’s never going to happen because there are regulations in place that keep important stuff like that on-premises. That doesn’t mean that banks and hospitals don’t want all that other good stuff that comes from the cloud though, like GPU instances or AI and deep-learning-powered services that recognize speech and images.

Bridging the gap

Cost is also a major factor that drives organizations toward a hybrid setup, especially when variable workloads are involved. A hybrid setup lets you use your regular on-premises datacenters infrastructure to handle normal workloads and switch to public clouds for “cloud bursts.” This is no easy feat, however, and is certainly more complicated than running a multicloud setup. This is because the different cloud and on-premises resources not only use different APIs and management interfaces but are often based on completely different technologies that were never meant to integrate with each other. In fact, according to a research study by DataCenterKnowledge, one of the most common problems with hybrid cloud adoption is getting legacy applications to work alongside modern cloud-native ones. Patching the two together always comes at a performance cost and when we’re talking about business-critical applications, that isn’t really an option for organizations that have thousands of customers depending on them.

While there are a number of advantages to this hybrid model such as flexible usage-based pricing models, almost zero setup cost, and on-demand access to virtually unlimited resources, getting it all to work together is still a work in progress. This means that even though a large number of organizations have adopted this setup and are using it efficiently, there isn’t really a one-size-fits-all or “foolproof” solution to the problem yet. Several platforms help you get there, however, and even some new ones that are quite promising with regards to supporting a truly hybrid infrastructure. This means supporting as many integration scenarios as possible since hybrid clouds typically encompass quite an assortment of hardware, operating systems, and APIs. This is where the platforms come in and try to make it all easier to manage, preferably with a single control pane for both your on-premises datacenters and your public clouds.

AWS Outposts

Here, UKCloud explains how businesses can take advantage of Data Centre Modernisation, whilst still focusing on their core business and avoiding key pitfalls of digital transformation

So, you’ve decided you’d like to reap the benefits of Data Centre Modernisation; reducing costs, increasing your operational agility and spending more time focusing on your core business. But you may be left wondering what you need to do, what approaches you can take and some of the key pitfalls to avoid.

You have realised that your organisation needs to adopt multiple cloud services – but that’s a long way from where you are today. You are facing a myriad of existing systems, technologies and contracts that you need to disentangle. But you don’t have the capacity or expertise to properly focus on turning your vision into an executable plan.

Without a coherent plan, your use of cloud is tactical and piecemeal. It’s difficult to keep control of these new cloud services whilst also keeping your existing IT afloat. In effect, things are getting worse – and you need them to get better.

4 Key Steps to Cloud: High-level

Recognising these challenges, we have identified four keys steps that can simplify, de-risk and accelerate your journey to cloud as outlined below in Figure 1:

4 Key Steps to Cloud: Detailed

UKCloud provides a range of services at each step, that supports organisations as they progress their journey to the cloud. Figure 2. shows some examples of the type of work we recommend and progress with our customers.

How can we help?

Our team of multi-cloud experts are at hand to help you with a clear path to cloud, no matter where you are on that journey. UKCloud provide expert, agnostic, multi-cloud advisory through a structured, modular approach. Each stage is supported by a defined, outcome focused workflow that delivers tailored, high value output enabling organisations to adopt cloud with confidence.

Our services are designed to support the specific procurement, assurance, security and connectivity needs of public sector organisations. Our portfolio of products and services are available via G-Cloud and other popular public sector frameworks and support cloud-based transformation programmes end-to-end or via discrete phases dependent on your requirements.

Why UKCloud for Professional Services?

Our methodology is informed by the 220+ digital transformation projects we have successfully completed within public Sector.

Our agnostic, multi-cloud approach and experience ensures appropriate and efficient solutions for business needs: the right workloads, on the right clouds.

Our team of experts provide pragmatic leadership and support that caters for the end-to-end cloud journey, spanning vision, strategy, migration and optimisation.

Our approach supports transformation programmes of varying scale & complexity using flexible tools, templates, reference architectures and methods tailored to individual organisation needs. – Read more