So, there we have it. Within a window of a few months, the top two public cloud providers on the planet -- Amazon Web Services Inc. and Microsoft Cloud -- have had bodily seizures that have caused the rest of us (mere cells in their ecosystem) to go into crazy orbits. Enough of the drama, let's get to facts. In this age of information deluge it would not be presumptuous to assume that the reader may have forgotten the specifics, so let's recollect.
The Amazon Simple Storage Service (S3) had an outage on Tuesday, February 28. An authorized S3 team member who was using an established playbook executed a command which was intended to remove a small number of servers for one of the S3 subsystems that is used by the S3 billing process. However, one of the inputs to the command was entered incorrectly and a larger set of servers was removed than intended. And the rest, as they say, is history!
Now let's turn to the Microsoft episode. On Tuesday, March 21, Outlook, Hotmail, OneDrive, Skype and Xbox Live were all significantly impacted, and trouble ranged from being unable to log in to degraded services. True to form, the Microsoft response was to downplay the impact and provide little detail (by contrast, Amazon provided a much more detailed post mortem). A subset of Azure customers may have experienced intermittent login failures while authenticating with their Microsoft accounts. Engineers identified a recent deployment task as the potential root cause. Engineers rolled back the recent deployment task to mitigate the issue.
So, is this the death of public cloud? Nah. Far from it. And anyone who says otherwise should have their head examined. BUT, it should serve as a wake-up call to every IT, security and compliance professional across every industry. Why? Because this kind of "user error" or "deployment task snafu" can happen anywhere -- on-premises, on private cloud and on public cloud. And since every enterprise is deployed on one or more of the above, every enterprise is at risk. So enough of the fear mongering. What does someone do about it? Glad you asked.
There are really three vectors of control: scope, privileges and governance model.
Scope is really the number of "objects," a.k.a. the nuclear radius of what each admin (or script) is authorized to work on at any given time. Using the Microsoft Cloud example (I realize I am extrapolating since they have not provided any details), this may be the number of containers a deployment task can operate on at any given time.
Privileges calls for controlling what an administrator or task can do on the object. For instance, continuing with the container example from above, the privilege restriction could be that the container can be launched but not destroyed.
And finally, you need a governance model. This is really the implementation of best practices and a well-defined policy for enforcing the above two functions -- scope overview and control enforcement -- in a self-driven fashion. In this example, the policy could be to ensure that the number of containers an admin can operate remains under 100 (scope) and that any increase in that number automatically requires a pre-defined approval process (control). Further sophistication can easily be built in, where the human approver could easily be a bot that checks the type of container and the load on the system and approves (or denies) the request. Bottom-line -- checks and balances.
So there you have it. The two large public clouds have suffered embarrassing outages in the past month. They will recover, get stronger and most likely have future outages as well. The question for the rest of us is what we learn from their experience and how to make our environments in our own data centers and on private and public clouds better! If we don't, we may not be lucky enough to fight another day.
— Ashwin Krishnan, SVP, Products & Strategy, HyTrust
New Coalfire assessed architecture provides secure multi-tenancy and data security for government agency data centers requiring FedRAMP readiness
HyTrust partners with Complete Solution Finder (CSF) to bring virtualization and cloud security solutions to Singapore to help address cloud security challenges
IBM together with HyTrust and Intel today announced a new cloud-based solution that provides workload security for data and applications and automates reporting to assist with regulatory requirements.
HyTrust Cloud Survey Finds 25% of Healthcare Organizations Are Putting Patient Data at Risk in the Public Cloud
Survey finds that while security is a top concern regarding cloud migration, 25 percent of healthcare organizations currently using the public cloud are not encrypting patient data.
HyTrust CEO John De Santis will present on the growing demand for cloud infrastructure security at the Americas Growth Capital (AGC) 13th Annual Information Security Conference.
HyTrust Survey Finds Government Agencies Are Lacking in Data Security and Encryption in Public Cloud Deployments
MOUNTAIN VIEW, CA. December 6, 2016 – Today, HyTrust Inc., a leading workload security provider, announced its latest cloud survey, highlighting government specific findings. The survey of 59 government and military organizations found that nearly 20 percent of those respondents do not implement data security or encryption solutions in the public cloud. This survey analyzes […]Read More
HyTrust's Senior Vice President, Product Management and Strategy, Ashwin Krishnan, predicts that 2017 will be the start of where compliance ceases to be a distraction, and rather IT organizations will realize that being in compliance is actually beneficial for them as a whole.Read More
HyTrust DataControl for Azure Bring Your Own License (BYOL) is now available on Microsoft Azure Marketplace. HyTrust offers powerful encryption with easy-to-use, scalable key management to secure the entire workload throughout its lifecycle - from deployment and migration to sanctioned decommission.Read More