Cloud security for the 'everywhere enterprise'
As mobility introduces changes in workplace dynamics, Charles Milton looks at how to shift power in favour of the CISO while securing the borderless enterprise.
Cloud applications, social media and mobility have redefined the workplace as we know it. We now operate in an era of the ‘Everywhere Enterprise,' business happens at any time, in any place. Whether it's on mobile devices connecting to 3G/4G networks or in coffee shops and airports on public Wi-Fi networks, there is no longer a set perimeter. Control has been transferred away from IT towards the employee.
While this workplace shift provides increased agility and productivity, it is creating a number of security headaches for business. Threats have evolved from viruses to sophisticated multi-faceted attacks targeting both the user and the device they operate from and mobility has made it even easier to breach corporate security measures – with employees accessing corporate assets over insecure networks. Looking at securing users beyond the company borders means abandoning the traditional focus on perimeter defence.
In a post-PC world, threats require a new approach to security, one that provides consistent policy, protection and visibility, regardless of the user's device or location.
Challenging traditional security
The 1990's idea of using security appliances installed in a data centre to protect employees who are on their laptops sitting in cafes and working via the cloud, no longer makes sense.
Not only are security appliances tied to legacy location concepts, dictating limitations to the business rather than enabling it, they tend to be built for one security function only. This creates an explosion of new appliances in the data centre to keep up with each new threat, all of which must be individually purchased, installed, maintained and updated.
Appliances also lack the pace to counter evolving threats and fail to meet the architectural flexibility to accommodate new enterprise technology. As a result businesses are operating on outdated security models that don't provide enough visibility to enable security executives to maintain control.
As such, the traditional ‘block vs. allow' strategy is no longer fit for purpose in today's ‘Everywhere Enterprise'. As the working environment evolves, organisations require a shift to a ‘manage and monitor' approach. After all, prohibiting access to internet resources will only encourage users to bypass security controls.
Bridging the cloud gap
Looking at new strategies to tackle the threats of the digital age means searching beyond the tools traditionally deployed in the enterprise, towards the benefits of the cloud delivered security.
However, while the return on investment of the cloud solutions has been well documented, the trend towards using them for security purposes has been treated with trepidation. That's due to the perceived risks that have been driven by ill-equipped security appliances featuring in the majority of workplace architectures today.
As cloud applications become more widely accepted and deployed however, CIOs are starting to see the competitive advantages of cloud computing in terms of flexibility, agility and competitive advantage. Why pay for capital investments and the resources to manage them when you could redeploy the money for strategic projects?
New technologies and processes can deliver enormous gains in productivity and efficiency to drive business metrics like revenue generation and customer satisfaction. And that's not the only critical advantage. Cloud solutions are integral to helping businesses realise advanced security capabilities – most importantly, better visibility.
In today's complex IT environments, the ability to see how every user, device and application is accessing the corporate network is no longer a ‘nice to have', it's a business imperative. The next generation of enterprise security is about the Direct-to-Cloud Network approach. This is much more than blocking threats. It will support critical security protection by enabling IT to take back control.
Shifting power to the CISO
The proliferation of mobile and cloud technologies has shifted the centre of gravity toward the user. Moving security to the cloud shifts the balance of power back in favour of the CIO and CISO. It allows companies to embrace innovation securely, while providing the visibility and controls needed to ensure compliance with corporate policies. It also helps executives to regain control of the enterprise's digital assets and user activity, whether located internally or externally on the internet, so they can spot potential threats before they escalate.
Today's CIOs are being challenged to shift their focus from basic infrastructure projects to strategic initiatives that drive business value through transformational practices. Moving security to the cloud is an example of this type of transformational process that can increase business agility and reduce costs. More importantly, it enables CIOs and to think more strategically about using security capabilities as a business enabler. Protection is no longer enough; prevention is key.
Smart CIOs and CISOs will be strategically planning their next move to invest in cloud based security-as-a-service to fuel new initiatives.
Contributed by Charles Milton, director EMEA channels at Zscaler.