Overcoming the Cloud Security Compliance Conundrum

Share this post:

The growing demand for increased business agility and cost reductions in relation to IT infrastructure and applications is not a new agenda item for C-level executives. It has, however, remained a priority topic in 2018 and will continue to do so in 2019 and beyond.

Compliance with various regulations and cloud security requirements has expanded as technology and cloud uptake advance — albeit not at a similar pace, leaving organisations with a challenging conundrum to solve. This is particularly relevant when executives consider cloud security and business transformations.

Balance the Costs and Benefits of Cloud Migration

The partnership between IBM and Red Hat announced earlier this year highlights a strategic vision to deliver transformational change to clients and meet cloud security demand. We’ve also seen record-breaking technological advancements and a growing number of data and application migrations to the cloud.

In general, these migrations follow either a hybrid or multicloud strategy. Hybrid cloud is defined as a combination of cloud services that are deployed both on-premises and in the cloud. Multicloud means using multiple cloud computing service providers across a single heterogeneous environment for applications, software or infrastructure.

Whatever the strategy, cloud migrations involve transitioning and managing extensive processing and workloads outside of traditional IT infrastructure while addressing cloud security and compliance challenges. The main industries that are seeing an increased focus, volume and complexity of regulations are banking and financial services. In these sectors, many are pursuing innovative business strategies that drive requirements for critical infrastructure and applications to the cloud.

The regulatory compliance challenge for such innovation poses both an opportunity and a concern for the C-suite and boardroom. Financial institutions must confront the reality of dramatically increasing costs while also keeping pace with the legislative and regulatory changes arising from numerous regulatory bodies. Global organisations have the added burden of even more international and nation-specific regulations.

The cost of compliance is often high, but any effort to reduce staff without demonstrable and measurable improvements in compliance processes and technology could be viewed negatively by regulatory bodies, investors and shareholders.

Meet Cloud Security Compliance Requirements Head-On

One of the most common misconceptions we hear from clients is that moving to the cloud with data held by multiple third parties on shared systems will be a complex undertaking. Our view is that cloud services can be extremely secure and often a more stable option than utilising existing internal IT infrastructure. However, there are some activities that need to be considered to meet regulatory compliance requirements, such as:

1. Deploying continuous monitoring of both technical and nontechnical cloud compliance requirements. This should also include corporate governance, cybersecurity and regulatory compliance controls;
2. Maintaining a unified source or framework of governance, risk and compliance information for how cloud services are utilised;
3. Developing executive and operational dashboards to provide visibility into cloud compliance statuses;
4. Implementing real-time alerting mechanisms for control failures with defined playbooks on how to respond to compliance failures from third-party providers; and
5. Ensuring that you can continuously synchronise new cloud services and capabilities with regulatory compliance requirements.

These cloud security to-dos can help your organisation take on the seemingly daunting task of cloud migration while remaining secure and compliant. IBM also recently published a white paper addressing the hybrid cloud security conundrum for financial services, which includes ten essential elements for a safe, secure and compliant business operation. If you haven’t already, I strongly urge you to give it a read.