Month: November 2019

The General Data Protection Regulation of the European Union, which emphasized increasing protection of its citizen’s personal & confidential data, turned enforceable in May 2018. Since then, organizations across the globe have been working hard and consistently on GDPR readiness. According to the 2019 Data Privacy Benchmark Study of Cisco, nearly 60% of organizations have reported complying to most or all requirements, approximately 30% of organizations are pegged to do so by 2020-end, and the rest of them would need more time to comply with these requirements.

India ranks 6^th globally in GDPR readiness owing to its rapidly evolving data privacy ecosystem, built by the collaborative approach of the private and government organizations. The scope is huge for Indian organizations to invest in technology to meet the requirements of customer privacy faster. Organizations in the country are presenting greater preparedness in meeting all or most GDPR requirements.

A lower number of data breach incidents, fewer records in security compromisations, and shorter system downtimes have been cited by GDPR-ready organizations. Also, financial losses from a data breach are reduced significantly and more organizations are witnessing multiple-border benefits in their data privacy investments. This includes greater innovation and agility resulting from appropriate data controls, improved operational efficiency, and a competitive edge.

Expanding Data Protection in the Public Cloud

The cloud journey has been a common sight in the IT industry in recent years, pointing at major changes for organizations in terms of both opportunities and risks. Several SaaS applications lack SLAs and inherent protection features that are otherwise accustomed to on-prem. Thus, providing data protection for SaaS applications has become a key priority for CSPs. 

Another key area that is being emphasized is greater offerings for cloud-native workloads, especially virtual workloads in the public cloud. Several SLAs involve minimal protection for such workloads and protecting them in their native formats has become key to helping organizations pave a smooth pathway for the cloud transition. 

For organizations eyeing enhancement of their disaster recovery (DR) strategies, the cloud offers excellent capabilities. The rise in awareness among organizations about the role of their DR strategies in different levels of applications has been growing, along with the importance of managing different recovery SLAs for every application. CSPs continue to innovate their solutions as cloud offerings mature, enabling organizations to cope up with the latest in cloud adoption.

Benefits Brought by Data Protection in the Public Cloud

Data protection in the public cloud entails an opportunity for eliminating the efforts required to run the backup infrastructure. Choosing the public cloud for data protection brings significant benefits that include

Added Value: Data protection in the public cloud can leverage native services, provided with access to several cloud services. This will either improve service delivery or deliver added value in terms of disaster recovery, ransomware detection, and analytics.

Inferred Geo-capability: Public cloud deployment has gained a pervasive prevalence and irrespective of business locations there are cloud endpoints at their service. CSPs are networking their data centers to deliver a mesh that encompasses the world, making backup data and services available universally.

Demand-based Model: Cloud services are delivered on-demand, meaning they can be put to a halt if not required. The pay-as-you-go nature further complements their flexibility, eliminating the requirements as confronted with on-prem infrastructure.

Infinite Scalability: The public cloud can be scaled infinitely to all purposes and intents. Zero efforts are involved on the side of customers and continuous availability of services is ensured.

The emphasis on data protection and privacy increased manifold this year, as data became the new currency alongside the market shifts. Organizations are now realizing true business benefits from their data protection investments. The belief of organizations inclines toward driving business success and protecting customers by maximizing the data value and mitigating risks.

Risk management, a cyclically executed process, contains a range of coordinated tasks and actions dedicated to controlling risks. The cloud adoption is now widespread, as it is secure and resilient for organizations to run workloads. According to Gartner, public cloud workloads will suffer 60% lesser security threats compared to on-premises in 2020, which is good news. However, the bad news is that these security breaches will occur owing to the fault of customers.

Benchmarking configurations against flag violations and best practices are currently the state of the art approach to cloud security assessment. Management of individual configurations is imperative, as several security breaches are tracked down to the most simple configuration errors. The downside of benchmarking the configurations is that the cloud compliance model easily gets lost among security policies.

Compliance – A Massive Roadblock to Cloud Migration

It has been observed that IT decision-makers (ITDMs) are hesitant to move their compliant workloads to the cloud. Compliance remains a massive roadblock to the public cloud adoption moving forward. There is a consensus among approximately 90% of ITDMs that meeting compliance standards in the cloud impedes further public cloud adoption. Nearly 80% of these believe they would not clear all of the compliance audits and 70% believe that regulations on cloud compliance are bound to change continuously in the years to come.

Key roadblocks holding ITDMs from moving their workloads to the cloud:

1) Cloud Compliance Cost

It is highly unlikely that cloud platforms are themselves the reason for inhibiting adoption. The more likely deterrent is the unawareness of the available resources. Public cloud providers continue to make significant investments in audits, documentation, and tools to ensure good compliance posture of their platforms. However, an additional cost is entailed by duplicating compliance tools, audits, and efforts on an additional platform, such as a PCI-DSS audit. This involves thousands of dollars for every platform being audited along with the overhead of maintenance and staff.

2) Changing Compliance Regulations

Lack of IT engineers with expertise in compliance has led to major financial firms spending a huge premium on compliance talent. The belief among nearly half of the ITDMs that CSPs hold greater responsibility for cloud compliance highlights this lack of expertise. CSPs, such as AWS, are clear on their point that customers remain responsible for security and compliance in the cloud. Understanding of compliance responsibility is the need of the hour for executives for successful operations on the cloud. Training programs are imperative to educate IT engineers and decision-makers, which will mitigate resistance to cloud migration in the future.

3) Lack of Expert Professionals in Cloud Compliance

The belief among ITDMs that significant changes in the compliance regulations are imminent is having a dramatic impact on the migration of compliant workloads to the public cloud. These changes are also bid to enhance the compliance cost to a certain extent while creating additional complexities. While running compliant workloads in the cloud, organizations will have to interpret newer regulations and recruit more experts for maintaining compliance. The additional complexities will create another roadblock to the adoption of the public cloud for overburdened compliance teams.

In the space as adaptive and dynamic as cloud computing, maintaining compliance with regulations is a moving target. Cloudlytics is one of the increasingly popular compliance monitoring tools that evaluate your environment to remain compliant with regulatory policies. It will also help you auto-remediate the most common issues and build a robust compliance posture. 

As cloud technology matures, best practices to maintain cloud compliance will evolve in parallel. Additional resources are required to be prepared by companies for migrating regulated data to the public cloud while maintaining compliance with changing regulations.