Gartner states through 2020, public IaaS workloads will suffer at least 60 percent fewer security incidents than workloads in traditional data centers. When I pointed this out several years ago, many scoffed at the claim.
Both the hyperscalers and third-party security providers are spending about 70 to 80 percent of their R&D budgets on supporting public clouds. It should be no surprise that the quality and functionality of most cloud security technologies will be superior to traditional on-premises systems.
What do we have coming down the line in terms of cloud security? Here is what I think the landscape will look like in three years, maybe sooner.
Automate everything. Some security systems automate existing processes today, but in five years this will be taken to the next level. We’ll have uber-dynamic interactions with potential threats, backed up by a machine learning system, using intercloud and intracloud orchestration of many different resources to find and stop attacks.
This moves cloud security from a passive state to an active one. We’re no longer waiting to get attacked; we can detect when an attack is imminent and automatically challenge the attacker with automated defenses before the first penetration attempt. In some cases, we’ll have the ability to launch automated counterattacks.
Focus on intercloud security. As we move to a multicloud world, we’re finding that using native security systems for each public cloud is way too laborious and causes complexity and confusion that can lead to breaches.
As I’ve stated before, multicloud is really not about cloud. It’s about the technology that exists between the clouds. Technology that has access to native interfaces, but logically runs above all public clouds. This means that you can orchestrate services to put up a unified defense as well as share knowledgebases as to how to best defend against specific kinds of attacks.
You will also need visibility into all major applications, databases, and storage systems within all public clouds; for instance, being able to see a CPU saturation that should be checked as a possible attack.
Remove the humans. You may think of a Terminator-like scenario where the machines turn on us, but the reality is that humans are the weakest link in the security chain. Gartner states that through 2025, 99 percent of cloud security failures will be the customer’s fault. In my world, it’s more like 99.999 percent.
No matter if it’s misconfigurations that leave doors open or plain mistakes because of lack of training, the more we factor humans out of the cloud security equation, the more secure we’ll be.
This goes back to the “automate everything” approach that most security systems will use to provide cloud security within three years. If you’re worried about your job, don’t be. Somebody has to set up these automations and continuously improve them over time.
The bottom line is that security will improve, and the cloud will become the safest place to be. As long as the R&D dollars pour into cloud-based security, this is a foregone conclusion.