Ensure Cloud Security in IaaS and PaaS Environments

Hosted cloud environments, such as infrastructure as a service (IaaS) or platform as a service (PaaS), offer major IT and business benefits that organizations are looking to realize.
Organizations may decide to migrate some part of their IT operations to a hosted cloud environment to realize any number of benefits.

Our Advice

Critical Insight

Security remains a large impediment to realizing cloud benefits. Numerous concerns still exist around the ability for data privacy, confidentiality, and integrity to be maintained in a cloud environment.
Even if adoption is agreed upon, it becomes hard to evaluate vendors that have strong security offerings and even harder to utilize security controls that are internally deployed in the cloud environment.
Security Perception: Cloud can be secure although unique security threats and vulnerabilities create concerns for consumers.
Balancing Act: Securing an IaaS or PaaS environment is a balancing act of determining whether the vendor or the consumer is responsible for meeting specific security requirements.
Structured CSP Selection Process: Most security challenges and concerns can be minimized through our structured process (CAGI) of selecting the trusted CSP partner.

Impact and Result

The business is adopting a hosted cloud environment and it must be secured, which includes:
- Ensuring business data cannot be leaked or stolen.
- Maintaining privacy of data and other information.
- Securing the network connection points.
- Determine a balancing act between yourself and your CSP—through contractual and configuration requirements, determine what security requirements your CSP can meet and cover the rest through internal deployment.
- This blueprint and associated tools are scalable for all types of organizations within various industry sectors.

Ensure Cloud Security in IaaS and PaaS Environments Research & Tools

1. Determine your IaaS/PaaS risk profile

Gain understanding of what the major implications of adopting an IaaS/PaaS program are and what this means for your organization’s security.

2. Determine your IaaS/PaaS security control requirements

Determine a customized list of security controls specific to your organization’s needs.

3. Evaluate IaaS/PaaS vendors from a security perspective

Determine which cloud vendors are most appropriate for your security needs.

4. Implement your hosted IaaS/PaaS security controls

Delegate responsibilities for meeting security requirements to create action-orientated items that can be communicated effectively with stakeholders to ensure proper implementation of security controls for your program.

5. Build an IaaS/PaaS security governance program

Ensure the continued maintenance and security of your IaaS/PaaS programs.

Ensure Cloud Security in IaaS and PaaS Environments visualization

Keep your information security risks manageable when leveraging the benefits of cloud computing.

About Info-Tech

Info-Tech Research Group is the world’s fastest-growing information technology research and advisory company, proudly serving over 30,000 IT professionals.

We produce unbiased and highly relevant research to help CIOs and IT leaders make strategic, timely, and well-informed decisions. We partner closely with IT teams to provide everything they need, from actionable tools to analyst guidance, ensuring they deliver measurable results for their organizations.

What Is a Blueprint?

A blueprint is designed to be a roadmap, containing a methodology and the tools and templates you need to solve your IT problems.

Each blueprint can be accompanied by a Guided Implementation that provides you access to our world-class analysts to help you get through the project.

Table of Contents

Need Extra Help?
Speak With An Analyst

Get the help you need in this 1-phase advisory process. You'll receive 4 touchpoints with our researchers, all included in your membership.

Call 1: Determine your hosted cloud risk profile

Info-Tech will work with you to identify your organization’s specific risk profile of hosted cloud environments. Various factors will be evaluated and the final result will be discussed.
Call 2: Determine your security control requirements

Info-Tech will work with you to determine what security control requirements the organization will need based on its risk profile. Discuss and identify what control requirements should be met by the vendor or by your organization.
Call 3: Implement your hosted security controls

Info-Tech will work with you to implement identified security controls by providing in-depth implementation steps for each security control.
Call 4: Build an IaaS/PaaS security governance program

Info-Tech will work with you to develop processes so your organization can maintain and measure their cloud environment security.

Authors

Wesley McPherson

Alan Tang

Contributors

Eric Chiu,Founder and President, HyTrust
John Lamboy, President and CEO, Cyber Defence Security and Intelligence (CDIS)
Michel Fosse, Consulting Services Manager, IBM
Paul Stillwell, Senior Security Consultant, Intrepita
Robert Hawk, Secure Networking Designed/Risk and Security Assessment SME, BC Hydro
Steven Woodward, CEO, Cloud Perspectives