10 things to consider before moving to the cloud

"The cloud, especially, needs to be a two-way street," said Timothy Brown, senior vice president and distinguished engineer of security management for CA, during a recent presentation at Cloud Expo East in New York. To get started in cloud computing, there are three key tenants that must be leveraged: People, processes and technology. Cloud users, and the solution providers who serve them, must identify business processes and solutions that make the most sense to move applications off-premise.

And as cloud computing continues to take hold, Brown offered these 10 things to consider before making the leap into the clouds.

The first thing to consider before making the cloud leap is what solutions make sense. Solution providers and companies should identify solutions that make sense by evaluating the people, processes and technology that will be leveraged in a cloud computing environment.

Moving forward with a cloud computing plan requires a level of scrutiny. Brown said the second key consideration before diving into the cloud is to evaluate vendors on their depth of solutions, security, references and viability.

Vendors should have a solid business model in place and establish a level of maturity despite the immaturity of the cloud computing market. Measures must also be taken to avoid vendor lock-in. Vendor roadmaps and growth plans should also be taken into consideration, while taking a look at previous deployments may be useful.

It's necessary to understand the risks and create complete compliance plans. It's also important to include vendors and their solutions in the creation of those plans, as cloud providers all offer different models, Brown said.

You have to know who to blame (or at least who to call) if something goes wrong. Right? Brown said it's imperative to closely scrutinise contracts, SLAs and high availability/disaster recovery plans before moving ahead with the cloud.

"Know who is responsible when things occur -- SLAs are important," he said.

Cloud success requires users and solution providers to take on the role of cloud auditor. Brown said they must implement an inspection program, test the SLAs and trust their contracts, all while continually verifying and identifying critical systems through audits.

Continually auditing and setting a system of checks and balances and injecting a true test model into the system helps illustrate what happens when something occurs.

"It's your business on the line," Brown said.

It's important to not reinvent the wheel when it comes to moving to the cloud, especially as it pertains to identity and access management. Brown said that before moving to the cloud it's important that companies have a plan for managing identities, roles and relationships.

Users should extend existing identity management systems. The cloud, however, brings together complex systems and opens the door for more collaboration, meaning more control is necessary. Brown said simple role systems don't always work; dynamic ones are required.

Sounds like common sense, but CA's brown suggests that users move security closer to the data. To do so, he said encrypting sensitive data and managing keys appropriately is imperative, as is utilising DLP practices to safeguard data.

Cloud computing is a new paradigm and offers an opportunity to make a fresh start. Brown cautioned users not to recreate the issues of the past.

"Use the move to the cloud to increase security," he said. As opposed to security being an afterthought in previous environments, it should be a foundational component of cloud deployments. Additionally, built-in and transparent security is a must.

No one wants to admit to vulnerability or a security hole, but bringing them to light as they occur could help the industry. Collaborating on threats and issues in the cloud is critical for security and trust, Brown said.

"It's hard to come forward, but if we can collaborate better we would have a more secure environment," he said.

Last but not least, as the cloud computing market matures it's important to pay attention to how the technologies change. Watch for technology advancements because cloud infrastructures and security systems will morph to address issues in the cloud.