Cloud. Connection. Securing the INSIDESSS. March Keeping the Private in Private Cloud. Riding the Connection Carousel Page 3

Transcription

1 INSIDESSS Keeping the Private in Private Cloud Page 2 Riding the Connection Carousel Page 3 On the Inside Page 4????????? 2015 UBM Tech, a division of United Business Media LLC. ALl Rights Reserved. Securing the Cloud Connection SPONSORED BY Knocking on the Outside Door Page 7 The Confusing Future of the Private Cloud Page 10

2 Keeping the Private in Private Cloud If your enterprise has resources in the cloud, the path that workers use for access may be anything but secure. And because there are so many different paths, you may require many solutions to ensure security -- or one solution with many facets. Cloud security considerations include internal ones (e.g., proper design, sufficient monitoring of activity, appropriate security software) and external ones (protecting the pipeline to the cloud resource). Expect security concerns to increase as more enterprises choose private, public, or hybrid cloud strategies. An April 2014 RightScale survey showed that private clouds were in use by up to 65 percent of respondents, counting those who said they use both private and public clouds along with those who said they use private clouds exclusively. Private cloud is clearly a major part of enterprise IT strategy. Yet enterprises take different approaches to private clouds. Some organizations use a private cloud that s completely contained within the enterprise firewall. Others use hosted private clouds that reside in a data center outside of the enterprise firewall. And then there s Amazon Virtual Private Cloud (VPC), which offers a private section of the Amazon Web Services cloud. Assuming the private cloud you choose for your enterprise handles its internal security well, your biggest concern becomes a secure connection. That means looking at how your employees connect within the enterprise and how vendors, customers, and home workers connect outside it. 2 SSS UBM Tech

3 Riding the Connection Carousel When it comes to connecting your enterprise private cloud to those who need access, connection types fall into one of two buckets: internal and external. Internal connections include employees and executives who need to connect to the private cloud, either at the same location as the cloud servers themselves or from a remote campus. External connections include separate categories: Vendors that might be given access to the private cloud for the sake of fulfilling orders Customers linking to the cloud to place those orders Enterprise employees connecting to an external private cloud, either privately hosted or a virtual private cloud at a public cloud provider There are various methods for making the private cloud connection, but they boil down to a single descriptor for each bucket: An internal network connection for the employees and executives The Internet for the customer, vendor, and employees who aren t on the network Within each of those single descriptors lies a range of technologies and protocols with specific security concerns and solutions. One of the most pressing concerns involves the popular Amazon VPC. The most common way to connect to an AWS VPC is using the virtual private network AWS offers. Many organizations are seeking a more secure way to get to a private cloud on a public network like the Internet. 3 SSS UBM Tech

4 On the Inside The majority of connections made within the enterprise to a private cloud involve some form of Ethernet-based area network. Those on the same premises as the private cloud s servers would access via a local-area network (LAN). Those on campuses removed from the server farm would most likely use a wide-area network (WAN). 4 SSS UBM Tech

5 For the LAN, security procedures and solutions have been developed over decades. Improvements continue to happen, but a LAN has been one of the most secure ways to link to a private cloud that is on premises. Most enterprise users of the internal private cloud, however, connect via a WAN, and that means going through some form of longdistance fiber from the campus in which the employee sits to wherever the private cloud s servers reside. This usually means leasing a line from a telecommunications carrier a T1, or a T3, for example, which give speeds of Mbit/s or Mbit/s, respectively. Since these are private lines that no one outside of the enterprise can access, security efforts generally focus on securing the devices used to access them, although one common and highly recommended security addition to a leased line is encryption. A February 2014 report from Thales e-security and the Ponemon Institute showed that an impressive 71 percent of the 4,800 respondents were using an encryption gateway when accessing an external cloud. For endpoint devices, the private leased line eliminates the need for a virtual private network, which is standard for connecting to the private cloud via a shared connection such as the Internet. But data being stored or used on the devices still needs to be handled, and the increasingly common approach is complete enterprise device management (EDM). EDM is an extension of mobile device management that includes all endpoints that connect to the private cloud or data center mobile phones, tablets, and desktops. An encrypted line to the private cloud and a good EDM solution on all devices that use that line combine to make a reliably secure private cloud environment. New Options on the Scene Relatively new to the enterprise connection game are cable companies, most of which have Private leased lines eliminate the need for a virtual private network, which is standard for connecting to the private cloud via a shared connection such as the Internet. 5 SSS UBM Tech

6 been making strong inroads into the enterprise with ways to connect to the private cloud. Comcast cited in a case study how it upgraded the New England furniture store chain Jordan s Furniture from its legacy T1 service to a new, dedicated Ethernet network service (ENS) that connects six locations to each other in Massachusetts, New Hampshire, and Rhode Island. In addition, Comcast provided Jordan s with an Ethernet dedicated Internet line, which provides Internet access to all six locations but keeps the LAN separate for greater security. The new ENS from Comcast allowed Jordan s to pursue some old-fashioned security upgrades it had in mind, according to Peter Clark, the chain s director of information services. Before we had Comcast Business, we didn t have the bandwidth capacity to support realtime surveillance and operations if there was an issue, we d have to locate the incident, burn a DVD and send it around to people. Now that we have more bandwidth, we can look across the network to other locations to see what s going on in real time, or quickly access data that s stored in another location, which helps us to identify and resolve issues much faster, Clark said in the study. The ENS connection also links all Jordan s locations to its remote data center in Rockland, Mass., enabling more efficient remote backups and improving disaster recovery footing. Remote Private Clouds However, ENS doesn t address private clouds that are hosted remotely, for example, an Amazon Web Services Virtual Private Cloud. Normally, you would be expected to connect via the Internet, albeit using a VPN link. One new solution to address connection security concerns is an Ethernet private line (EPL) to the premises, such as the one Comcast offers. As the nation s largest cable broadband company points out, the EPL allows for higher bandwidth and greater flexibility than a timedivision multiplexing (TDM) private line, such as a T1 Internet line. In addition, since it uses standard Ethernet connection equipment at either end, it can be less expensive than the traditional choices, moving it into the realm of affordability for a vendor that needs a very secure, private connection to its client. The EPL connection sidesteps the common cable broadband requirement that an Internet connection has to be shared at least to the point of presence. That EPL link is a direct line to the client s office, essentially no different than if the vendor had an Ethernet cable tens or hundreds of miles long, plugged right into the client s Ethernet switch. Another advantage of an EPL connection: If you use a cloud exchange such as Equinix to connect to the cloud, you don t need to reprovision your EPL. This means that the promise of cloud vendor portability comes closer with an EPL than with any other connection. 6 SSS UBM Tech

7 Knocking on the Outside Door When it comes to allowing customers and partners to access an enterprise s private cloud, opening up the private line of the WAN isn t practical from a security standpoint. And a WAN simply can t reach the hosted private cloud or VPC that some enterprises favor, so the Internet is the most common connection type in these cases. But unregulated Internet connections pose obvious problems as well. The most common solution in this case is the use of the VPN, an established method of providing a secure connection to an enterprise IT resource. A VPN connection creates a secure, private tunnel through the public Internet to a corporate office at the other end. This allows, for example, partners to run server-based applications, such as inventory-aware order 7 SSS UBM Tech

8 fulfillment systems, just as they would if they were in an office at one of the enterprise locations. The VPN also solves the problem of having to share the Internet connection with your closest neighbors, as is the case with most broadband connections. You may share the connection, but you don t share the tunnel, or more importantly, the data that travels back and forth through it. But there are still a few problems with using a VPN, the common one being performance. Using a VPN will increase the latency of the broadband connection, in some cases greatly. Back when connections to the Internet were slow, that latency wasn t very noticeable. But with modern broadband connections in the United States hovering around 30.7 Mbit/s, that latency has become a real concern. Still to be addressed is how to handle a mix of methods that people use to connect to your private cloud those linking from the inside as well as those linking from outside. While it may make sense to provision an EPL for remote campuses within an enterprise, asking each and every vendor to do so isn t practical. In that case, the VPN connection over the Internet is still the most viable option. Like everything in IT, however, the cost of a direct line such as an EPL will continue to drop, and it may become affordable for everyone seeking to connect to your private cloud. No matter how your enterprise is looking to connect to its employees or vendors to the private cloud, there are legitimate security concerns and real solutions as well, with more innovative ones on the horizon. While it may make sense to provision an EPL for remote campuses within an enterprise, asking each and every vendor to do so isn t practical. 8 SSS UBM Tech

9 Enter the SDN The increased reliance on using the cloud, particularly of the private variety, has put an increased burden on the enterprise network. This is particularly true in the area of network security and management. Software-defined networking (SDN) arose to help alleviate that concern. What is SDN? Doug Dooley of venture capital firm Venrock offers one a clear explanation, saying in a blog that SDN separates the network s control (brains) and forwarding (muscle) planes, creating one of the most disruptive technologies to hit networking in decades. With SDN, an enterprise can more easily push through upgrades to network systems as software patches, not by pulling switches and other gear out of the network closet and replacing them whole cloth. That is of particular interest when it comes to network security. Having the ability to add new security features or upgrade existing ones in a way that will affect every virtual switch in one shot is a huge improvement. That flexibility also comes with a cost savings benefit, as network gear replacement gets pushed aside in favor of software patches. This argument was so compelling for the U.S. Department of Agriculture (USDA) that, in the summer of 2014, the agency decided to use SDN in its National Information Technology Center, which provides, among other things, cloud services to customers of the federal agency. Security was one of the drivers, as the USDA requires compliance with the Federal Information Security Management Act (FISMA) and not just the internal guidelines for connecting to outside vendors and customers known as FedRAMP. SDN is increasingly becoming a way to improve security for cloud connections. As more network and broadband providers that offer private and public connections to the private cloud adopt SDN, their ability to rapidly respond to all kinds of network improvements, including security, will grow apace. 9 SSS UBM Tech

10 The Future of the Private Cloud Read any number of the cloud pundits in the blogosphere, and you will conclude that the future of the private cloud is dim. It will either cease to be a practical option, or it will become just another part of a public-private hybrid cloud. Unfortunately, part of that argument is based on a semantic error confusing the term open in any use concerning the cloud as meaning the opposite of private. In short, a private cloud is a cloud that has no means of access through a public network such as the Internet. That is why Amazon Web Services (AWS) calls its VPC a virtual private cloud. You get a private chunk of the shared data center all to yourself, but you still have to access it via the public Internet, often via a VPN service from a carrier that Amazon is happy to connect you with. Of course, the AWS version of a VPN isn t the only way to get to a private cloud on a public network. 10 SSS UBM Tech

11 There are companies that get the difference, and plan to capitalize on it. One is Nebula, a startup founded by a former CTO of NASA, one of the founding organizations of OpenStack. His company, according to an interview in InformationWeek.com, sells a turnkey private cloud appliance based on the OpenStack cloud structure. This would allow any enterprise to establish a private cloud, based right at its own data center or wherever it felt provided the best connectivity to the overall WAN. But it is the future of that WAN that is most exciting. Already gear makers are moving 10 Gbit/s speeds most commonly restricted to LANs into the WAN world. Add to that the security of an optical VPN (O-VPN), and you have a fast and secure connection for tomorrow s WAN. In the summer of 2014, Silver Peak released its Unity WAN fabric, designed to run in the data center or enterprise office and provide the best path to the cloud services those systems offer to both public and private access customers. Essentially, whatever cloud service your public or private cloud offers, Unity will scour all incoming connections and constantly provide the best one for whoever is making the connection. Keep Security in Mind Silver Peak s solution, however, loosens security, as it hops connecting private cloud users from one connection to another. A direct connection over broadband, such as an EPL, may not enable the connection shifting that Unity claims, but avoids the increased security concerns that such a system implies. Whatever technology finds favor, the future for the enterprise private cloud and how to connect to it is one of increasing privacy and greater security. Already gear makers are moving 10 Gbit/s speeds most commonly restricted to LANs into the WAN world. Add to that the security of an optical VPN (O-VPN), and you have a fast and secure connection for tomorrow s WAN. 11 SSS UBM Tech