In the Cloud, Evolving Infrastructure Means Evolving Alliances

In the olden days of cybersecurity (you know, before 2015 or so), a company's legal and security departments tended to move in lock step. Better security went hand-in-hand with better compliance, which to a company’s legal team equated to lower risk.

Conversely, the relationship between security operations and line-of-business managers and developers was tenuous. Security was constantly shutting down or hindering efforts to move to the online services the business wanted, and developers couldn’t be trusted to write secure on-prem apps, let alone spin up data instances in the cloud.

But today? The alliances of old are strained, and the new opportunities in the cloud and in containers are making for some unusual bedfellows.

Many times the CISO is better off in the cloud. Maybe some of your on-premises systems are getting long in the tooth, or certain capabilities in the cloud are just better. These days platforms like Office 365 will develop for the cloud first, and then move new features to the datacenter.

Suddenly, you have logs you never had before. You can make policies and deploy them without re-provisioning. Instead of closing a port on a firewall on prem, you can go directly to an actual individual file — not just a port or a router. 

You can see an anomaly and automate the specific response. You can say, "Jimmy can't write .ppts or .pdfs anymore, because it looks like he's trying to export," but he can still do his day-to-day business while you investigate. And the whole time, you can see all the transactions happening where you can't on your on-prem file server.

In the cloud, the CIO is elated because he gets to make customers happy, and the developers are happy, too, because they get to make more apps, more quickly.

And instead of putting in a whopping capital expense request every five years to update systems, you've got a predictable and recurring opex line, which means instead of rolling his eyes, your CFO can plan for your needs. (I mean … maybe he still rolls his eyes, but probably not as much.)

But what about the security team's old friend Legal? Surely they'll be excited that we're offloading risk and updating compliance (based on the cloud vendor's robust certification library), right?

Well, instead of being a security issue or a technology issue, legal approval often amounts to a matter of contracts and customer data. You may be restricted from moving it to the cloud, or at least unable to do so without approval, especially for customers in highly regulated industries.

This is where it becomes crucial to understand the security position of on-premises systems compared to the cloud. Most frequently, the cloud provider is going to be certified and audited to an extent the organization just can’t match.

The CISO's ability to articulate that value and sell it in to the general counsel is critical. More advanced legal departments will realize the reduction in risk because providers are certified in so many ways. But if your counsel is more conservative, it may be a tough argument no matter how articulate you are.

So you lost legal.

But now you have the COO, the CIO, and the CFO on board because you've created a predictable operations expense out of a formerly unpredictable cap-ex hit and reduced headcount requirements both in IT and information security. Business group owners are pleased because of the rich SaaS offerings now available to them. And the company is innovating in the cloud at a rate they never could on premises.

In the end, the benefits of moving to the cloud for many situations are just too great to ignore. Better security, more information, predictable costs, and other factors tend to make the argument for themselves.

But it's also important to understand the corresponding shift in organizational dynamics. Getting everyone on the same page can help smooth the transition and lead to a healthier organization overall.  

Related Content: