What you should know about the risks of migrating to the cloud

Pub­lic cloud com­put­ing was poised on the edge of the main­stream for sev­er­al years before the world was locked down in ear­ly 2020. Since then, firms’ pan­dem­ic-dri­ven dig­i­tal trans­for­ma­tion efforts have accel­er­at­ed the uptake of these cloud ser­vices, mak­ing them wide­ly pop­u­lar.

Glob­al expen­di­ture on pub­lic cloud providers is esti­mat­ed to have risen from $270bn (£200bn) in the first year of the pan­dem­ic to more than $330bn in 2021, accord­ing to Gart­ner. It notes that the Covid cri­sis has helped many chief infor­ma­tion offi­cers to over­come resis­tance in their organ­i­sa­tions to remov­ing mis­sion-crit­i­cal IT resources from their premis­es and entrust­ing a third-par­ty provider to host and man­age them instead. 

Part­ly because of this shift, there has been a marked increase in the amount of data that’s being col­lect­ed and stored. Although using a pub­lic cloud offers sev­er­al ben­e­fits, there are also some poten­tial pit­falls to avoid. Par­tic­u­lar­ly when mov­ing their data to the cloud, organ­i­sa­tions need to take these risks into account. 

Before they even start down this road, a firm needs to work out whether a pub­lic cloud will be a suit­able repos­i­to­ry for all work­loads – it’s not a one-size-fits-all option.

When assess­ing poten­tial providers, a busi­ness must under­stand how data will be gen­er­at­ed, used and, some­times, trans­ferred back to its own sys­tems from the cloud. This is because the process of repa­tri­at­ing mate­r­i­al can be expen­sive for clients. So-called data-egress fees are arguably some of the most unex­pect­ed (and there­fore unbud­get­ed) costs of cloud usage. The exis­tence of these well-hid­den charges means that mov­ing to the cloud won’t nec­es­sar­i­ly be cheap­er than keep­ing every­thing in house. Organ­i­sa­tions should there­fore ensure that they ful­ly under­stand the poten­tial costs and com­plex­i­ties asso­ci­at­ed with putting their data back on the premis­es if they should choose to do so in the future.

Once a provider has been cho­sen and the migra­tion is under way, “the biggest risk is not hav­ing an accu­rate pic­ture of what data is held, where it is held and what access and secu­ri­ty mea­sures the data needs to have”. So says Tony Lock, direc­tor of engage­ment and dis­tin­guished ana­lyst at IT research firm Freeform Dynam­ics.

Giv­en the rapid growth in the vol­ume of mate­r­i­al being gen­er­at­ed and stored in the cloud, organ­i­sa­tions need the abil­i­ty to effi­cient­ly dis­cov­er and clas­si­fy all their data. This means that they should seek to auto­mate as many process­es as pos­si­ble, Lock advis­es. At the same time, they need to estab­lish poli­cies designed to ensure that this data is ade­quate­ly pro­tect­ed with mea­sures that con­form to reg­u­la­to­ry require­ments.

When it comes to entrust­ing the stor­age of busi­ness-crit­i­cal data to a third par­ty, how should com­pa­nies bal­ance the con­ve­nience of pub­lic cloud com­put­ing with the need to main­tain the integri­ty and secu­ri­ty of high­ly sen­si­tive mate­r­i­al?

“This is a mat­ter for each organ­i­sa­tion to decide inde­pen­dent­ly, based on its risk pro­file and the extent to which it wants to feel in con­trol,” says Jaco Ver­meulen, chief tech­nol­o­gy offi­cer at IT con­sul­tan­cy BML Dig­i­tal.

Ver­meulen, who has over­seen cloud migra­tions for com­pa­nies includ­ing the Post Office and Park Hol­i­days UK, advis­es busi­ness­es deal­ing with such ques­tions to “define secu­ri­ty poli­cies and struc­tures, and mon­i­tor and auto­mate scal­a­bil­i­ty rules. They should also select the appro­pri­ate pub­lic cloud ser­vice provider, rel­e­vant com­po­nents and ser­vice lev­els.” 

Nick Heudeck­er, senior direc­tor of mar­ket strat­e­gy and com­pet­i­tive intel­li­gence at data spe­cial­ist Cribl, stress­es that organ­i­sa­tions should not treat cloud migra­tions as a pure­ly tech­ni­cal task to tack­le.

“Mov­ing appli­ca­tions, or reli­ably deploy­ing new ones, in a pub­lic cloud envi­ron­ment will cer­tain­ly present such chal­lenges – there are many tech­ni­cal hur­dles to over­come,” he acknowl­edges. “But, for an organ­i­sa­tion to gain the full advan­tage of on-demand, abun­dant scale and flex­i­bil­i­ty, it will have to rethink how it works. The chal­lenges it faces are there­fore just as much social and organ­i­sa­tion­al ones.”

Heudeck­er adds that, while busi­ness lead­ers may be eager to switch off their firms’ on-site data cen­tres in their eager­ness to get into the cloud, the migra­tion process can poten­tial­ly take years.

“For the things you can move, think about how you’ll mon­i­tor and observe these sys­tems as they migrate between envi­ron­ments,” he advis­es, observ­ing that many of Cribl’s clients use a tech­nol­o­gy that it calls an “observ­abil­i­ty pipeline” to aid their migra­tions.

Lock advis­es organ­i­sa­tions to iden­ti­fy all their data, clas­si­fy it and deter­mine their options from there. “You may even find that some of your on-site data requires dif­fer­ent secu­ri­ty and access require­ments from those actu­al­ly in place, espe­cial­ly if these haven’t been reviewed and/or updat­ed in a long time,” he says. “This is real­ly all about data gov­er­nance – an issue that can be over­looked, espe­cial­ly as there may be requests to bring data togeth­er from var­i­ous sources for a giv­en project. Com­bin­ing data from dif­fer­ent sources, in the cloud or on your premis­es, can cre­ate dif­fer­ent pro­tec­tion and usage require­ments, espe­cial­ly with regard to pri­va­cy.”

Bruce Edwards is direc­tor of tech­nol­o­gy at Stage11, a vir­tu­al enter­tain­ment plat­form. As an engi­neer who’s helped com­pa­nies such as the Walt Dis­ney Stu­dios, Sony Pic­tures Enter­tain­ment and Dine Brands Glob­al to migrate to pub­lic clouds, he is well placed to advise firms seek­ing to make sim­i­lar moves.

“Don’t rush into the cloud because it’s the hot thing to do,” he stress­es. “Approach it with a plan in mind and con­sid­er what you’re look­ing to accom­plish. This is a huge under­tak­ing. If you do it right, it can trans­form a com­pa­ny of any size for the bet­ter. If you rush it, you’ll end up with a cost-inef­fec­tive mess on your hands. My strongest advice is to first ask your­self one sim­ple ques­tion: what’s best for the busi­ness? Then do your research and plan for the road far ahead.” 

Edwards con­tin­ues: “Explore the numer­ous types of cloud providers at your dis­pos­al to find the one that best suits your needs. Weigh the ben­e­fits of each for both your com­pa­ny as it is today and the busi­ness you want it to become. Work with cloud experts that spe­cialise in your company’s area of exper­tise, prefer­ably with direct expe­ri­ence in your indus­try. Togeth­er, you can map out your jour­ney to the cloud. Keep in mind that not every­thing has to be moved at once. Give your­self the free­dom to be patient – and learn as you go.”