Tactical Advice

Surveying the Cloud Security Landscape

What should companies keep in mind when moving IT security services to the cloud?
Surveying the Cloud Security Landscape
Credit: frankpeters/iStock/ThinkStockPhotos

For the past few years, security professionals have struggled to assess the risks and benefits of moving various IT services to the cloud. Now, the attention has turned to security services themselves, and many organizations are considering the use of cloud-based technology.

Cloud technology might play a number of roles in an organization's security program. There are several factors that should be kept in mind as a company considers these services.

Cloud-Based Security Services

The use of cloud-based security services, often referred to as managed security service providers (MSSPs), has grown significantly over the past few years, with Forrester Research estimating the total market size at $8.5 billion in 2012. Included in this marketplace are vendors providing a wide range of security services to firms of many different sizes. Organizations considering a move to the cloud may wish to evaluate MSSPs providing vulnerability scanning, network security, log analysis and/or content filtering — four commonly outsourced services.

Vulnerability scanning vendors offer very mature services in the cloud that provide scheduled scanning for both network and application vulnerabilities. Vendors offer scans through a combination of scanners located in their data centers and managed appliances that you may place on your own network to provide an internal perspective to your scans.

Network security offerings also abound in the MSSP market. A multitude of vendors are available to help you manage your firewalls, virtual private networks (VPNs) and intrusion detection systems. These vendors will handle the configuration, maintenance and monitoring of your network security services on your behalf, even making configuration changes necessary to support new business needs upon your request.

Log analysis is a burdensome chore facing security professionals around the world and requires significant hands-on time, even when automated. MSSPs focused on this space leverage powerful automation tools and economies of scale to bring 24/7 professional monitoring to businesses that would otherwise not be able to dedicate resources to this task.

Content filtering providers screen both inbound and outbound traffic for mundane threats, such as spam and phishing messages, at the same time monitoring for advanced threats, such as attempts by employees to access websites known to host malicious software installers. MSSPs provide content filtering for both email and web traffic.

The range of services offered by different MSSPs vary from vendor to vendor. Some choose to focus on providing a single niche service with a high degree of sophistication, while others offer a breadth of security services in a one-stop-shopping approach to cloud-based security.

Should Your Business Make the Move?

Organizations trying to decide upon the appropriate role of MSSPs in their security infrastructure should consider a number of factors when weighing the costs and benefits that these services offer.

First, consider the organization’s appetite for cloud services in general. Have you already moved any services to the cloud? If you’re relying upon outsourced firms to provide your email, web hosting, server infrastructure or similar critical components, your organization might be ready to adopt cloud-based security services. Given the sensitivity of security services, they are probably not a good candidate for an organization’s first attempt at cloudsourcing.

Next, examine your current capability for providing the service that you’re planning to outsource. Is it a new service that you’re not currently able to provide? If not, what is the compelling advantage for moving to the cloud? Can the provider offer the service more affordably? Does the expertise of the provider’s staff exceed that of your own? As with any IT expenditure, you need to be able to build a persuasive business case for any move to the cloud.

Cloud-based security services may provide a firm with the ability to reduce costs by leveraging economies of scale across a wide number of MSSP customers. They also often provide access to security expertise that would otherwise be unavailable to smaller organizations. You should carefully consider the role that MSSPs might play in your security infrastructure.

Sign up for our e-newsletter

About the Author

Mike Chapple

Mike Chapple is an IT professional and assistant professor of computer applications at the University of Notre Dame. He is a frequent contributor to BizTech magazine, SearchSecurity and About.com as well as the author of over a dozen books including the CISSP Study Guide, Information Security Illuminated and SQL Server 2008 for Dummies.

Security

Three Ways to Integrate Fire... |
Follow these tips to align the devices with log management and incident tracking systems.
Why Cloud Security Is More E... |
Cloud protection services enable companies to keep up with security threats while...
Securing the Internet of Thi... |
As excitement around the connected-device future grows, technology vendors seek ways to...

Storage

The New Backup Utility Proce... |
Just getting used to the Windows 8 workflow? Prepare for a change.
How to Perform Traditional W... |
With previous versions going unused, Microsoft radically reimagined the backup utility in...
5 Easy Ways to Build a Bette... |
While large enterprises have the resources of an entire IT department behind them, these...

Infrastructure Optimization

Why Cloud Security Is More E... |
Cloud protection services enable companies to keep up with security threats while...
Ensure Uptime Is in Your Dat... |
Power and cooling solutions support disaster recovery and create cost savings and...
The Value of Converged Infra... |
Improvements in security, management and efficiency are just a few of the benefits CI can...

Networking

Securing the Internet of Thi... |
As excitement around the connected-device future grows, technology vendors seek ways to...
How to Maximize WAN Bandwidt... |
Understand six common problems that plague wide area networks — and how to address them.
Linksys Makes a Comeback in... |
The networking vendor introduced several new Smart Switch products at Interop this week.

Mobile & Wireless

Now that Office for iPad Is... |
After waiting awhile for Microsoft’s productivity suite to arrive, professionals who use...
Visualization Can Help Busin... |
Companies need to put their data in formats that make it consumable anytime, anywhere.
Linksys Makes a Comeback in... |
The networking vendor introduced several new Smart Switch products at Interop this week.

Hardware & Software

New Challenges in Software M... |
IT trends such as cloud, virtualization and BYOD pose serious hurdles for software...
Visualization Can Help Busin... |
Companies need to put their data in formats that make it consumable anytime, anywhere.
The Tools That Power Busines... |
Ever-evolving analytic software can greatly improve financial institutions’ decision-...