As a system administrator during the early days of the “cloud revolution” I found the “cloud” metaphor an interesting choice to frame the technology stack. Clouds, in my mind, were “woolly” and hard to pin down as opposed to the omnipresent, always-available things that IT marketers were suggesting cloud services would be. But whilst I wasn’t a fan of the metaphor, I could easily see the benefits of cloud-hosted services as more and more businesses started to adopt both public and private cloud solutions.

The debate of public versus private cloud doesn’t get nearly as much press as it once did, with the cost of public cloud aggressively nipping at the heels of private cloud hosting services and vendors rushing to add more and more features to their cloud offerings. This is especially true in the security field, with public cloud suppliers looking to try and further differentiate themselves from private cloud networks which have traditionally offered the greatest level of flexibility and thus potential for tightest security. (This presumes, of course, that you were prepared to build out that security stack yourself!)

In my mind, private cloud remains a powerful way of keeping security controls internal – a key element when security is a priority. When you need to add a new security function to your private cloud, the main challenge in most cases is how quickly you can deploy the toolset. This, in turn, ensures that you can increase your security coverage quickly and easily. But there are costs to this – by keeping your infrastructure in your own private cloud, it is on you to maintain the state of your security “garden,” and you need to make sure you’re pruning the weeds and ensuring ample coverage all year round.

Public cloud, on the other hand, (Read more...)