So, you’ve upgraded to the cloud…now what?

Any expe­ri­enced sailor knows it’s easy to launch a ves­sel – the hard part is keep­ing it afloat once you’re out at sea. The same can apply to chief infor­ma­tion offi­cers (CIOs) who’ve suc­cess­ful­ly upgrad­ed their busi­ness to the cloud.

Find­ing your sea legs quick­ly as wave after wave of prob­lems hit – includ­ing creak­ing lega­cy tech­nol­o­gy, bel­liger­ent employ­ees and the ever-present threat of cyber­at­tacks – is key to post-cloud sur­vival.

Helen Ash­ton helped pow­er fash­ion giant ASOS through sev­er­al tech­no­log­i­cal shifts, moves which ulti­mate­ly made them the mar­ket leader in online shop­ping, earn­ing £3.26bn last year. Now founder of Shape Beyond, a busi­ness trans­for­ma­tion con­sul­tan­cy, Ash­ton says the key to suc­cess at ASOS was full migra­tion to the cloud.

How­ev­er, new tech­nol­o­gy only brings the expect­ed ben­e­fits when peo­ple are kept on board with the process­es need­ed for suc­cess.

“Busi­ness­es either plan for months in minute detail or they jump straight in to work on the sexy stuff, such as ana­lyt­ics or dig­i­tal CX,” says Ash­ton. “But suc­cess comes from win­ning hearts and align­ing incen­tives. It is amaz­ing how eas­i­ly focus can shift through overzeal­ous project man­age­ment to tick­ing off activ­i­ties on the plan rather than keep­ing sight of deliv­ery of the out­comes iden­ti­fied as indi­ca­tors of suc­cess.”

You can use some of the cloud’s met­rics and data to demon­strate quick wins and progress. How­ev­er, the key to ongo­ing cloud suc­cess is to share data in a way that empow­ers staff to prob­lem solve with­in the busi­ness, cre­at­ing a sense of shared respon­si­bil­i­ty that allows all par­ties to see bot­tle­necks and show who needs help and why, says Ash­ton.

Bucket spills

Before you share all your data inter­nal­ly, make sure a hole in your S3 buck­et isn’t shar­ing it every­where else. 

A sim­ple S3 buck­et expo­sure from an unknown pub­lic source leaked per­son­al details of 120 mil­lion Brazil­ians – includ­ing banks, cred­it details and vot­ing his­to­ry – part­ly because an admin­is­tra­tor had renamed the index.html by acci­dent. In sep­a­rate exam­ples, a mobile app devel­op­er exposed 500,000 doc­u­ments from a finance app and a cannabis retail­er leaked 30,000 of its cus­tomers’ details, which all led to con­sid­er­able fall­out and organ­i­sa­tions falling foul of data pri­va­cy reg­u­la­tions. 

“We’ve seen inci­dents on a fre­quent basis where cloud data­bas­es have been set to be pub­licly acces­si­ble, when they need­ed to be pri­vate,” says Jav­vad Malik, lead secu­ri­ty aware­ness advo­cate at KnowBe4. “Sim­i­lar­ly, hav­ing the appro­pri­ate authen­ti­ca­tion con­trols in place is vital to pre­vent account takeovers which exploit weak cre­den­tials.”

To pre­vent leaks, look for gaps where cloud migra­tion shifts data cen­tre respon­si­bil­i­ty from the tra­di­tion­al sysad­min to site reli­a­bil­i­ty engi­neers and DevOps teams, says Tim Mack­ey, prin­ci­pal secu­ri­ty strate­gist at Syn­op­sys Cyber­se­cu­ri­ty Research Cen­ter. “This shift cre­ates a poten­tial gap between those famil­iar with the appli­ca­tion secu­ri­ty require­ments and those versed in cloud secu­ri­ty top­ics. This can lead to sit­u­a­tions where stor­age mis­con­fig­u­ra­tions in the form of unse­cured S3 buck­ets result in sig­nif­i­cant data leak­age.”

Patch man­age­ment is also an area of risk, par­tic­u­lar­ly when long-run­ning servers are upgrad­ed but con­tainer­ised microser­vices haven’t been rede­ployed, says Mack­ey. “If the pre-exist­ing patch com­pli­ance dash­board was based on log­ging into all sys­tems, it will need to be updat­ed for a con­tainer­ised deploy­ment.”

Training needs

While you’re tak­ing the lead, your team can only fol­low if they’ve been trained cor­rect­ly. In the haste of ini­tial deploy­ment dead­lines, the required lev­el of under­stand­ing is often lack­ing across the team, says Mack­ey. While this should be reme­died with train­ing, secu­ri­ty access should be kept on a need-to-know basis, not just giv­en to those at senior lev­els, even if that requires diplo­ma­cy.

“Train­ing efforts should focus on how to oper­ate a cloud ser­vice using prin­ci­ples of least priv­i­lege. Once train­ing is com­plete, a com­pre­hen­sive review of gaps in imple­men­ta­tion should be per­formed and any issues reme­di­at­ed.”

While not every­one needs access, staff should still be aware of all secu­ri­ty set­tings and why they’re in place, with drill tests to ensure all such set­tings are as they should be. “A cul­ture of secu­ri­ty needs to be built that under­stands the risks of the cloud,” says Malik. “Use inter­nal and exter­nal data sources to deter­mine the root caus­es for most attacks against cloud infra­struc­ture, and invest in the appro­pri­ate human, pro­ce­dur­al and tech­ni­cal con­trols.”

It’s also impor­tant to know when to hand over con­trol to the sys­tem. If you don’t auto­mate quick­ly it can cre­ate slug­gish staff, put off new hires and cre­ate extra labour and there­fore costs. 

“If you don’t auto­mate, organ­i­sa­tions become less agile or adapt­able to change and teams may also demo­ti­vate because of repet­i­tive tasks,” says Ser­gio Loureiro, cloud secu­ri­ty direc­tor at Outpost24, a cyber­se­cu­ri­ty spe­cial­ist. “Today, when it is hard to find a skilled work­force, automa­tion is a com­pet­i­tive advan­tage. Final­ly, cus­tomer per­cep­tion can be impact­ed by longer response times.”

The human factor

Despite all the tech­no­log­i­cal risks, many prob­lems will come from humans. Even at ASOS, human nature states peo­ple always want to keep the sta­tus quo, says Ash­ton. “In more tra­di­tion­al busi­ness­es, there is a strong pos­si­bil­i­ty of ‘adop­tion indi­ges­tion,’ which can derail cloud’s antic­i­pat­ed ben­e­fits if not effec­tive­ly man­aged. There is no sil­ver bul­let solu­tion here. It is a mix of train­ing, com­mu­ni­cat­ing the ben­e­fits, real-time sup­port, and mea­sur­ing process and out­puts to iden­ti­fy issues and suc­cess­es.”

While cloud soft­ware does a lot of the work for you, keep peace of mind by invit­ing occa­sion­al out­side input, says Andrew Wha­ley, senior tech­ni­cal direc­tor at Promon, white hat hack­ers that test large-scale organ­i­sa­tions. “Busi­ness­es still need to check that secu­ri­ty has been applied cor­rect­ly. Peri­od­ic assess­ments by third par­ty pen testers is a good way to check this.”

Test­ing how water­tight your ves­sel is inside and out­side of the water, while ensur­ing all those on deck under­stand the direc­tion of trav­el, is key to chart­ing a clear and pos­i­tive course for your busi­ness on the cloud.