Hybrid Clouds - Security Benefits

7th July 2011

An article I read recently argued that hybrid Clouds are used when an organisation runs out of capacity in their public Cloud. And indeed it is true that private Clouds can be adopted when an enterprise reaches its provisioning capacity threshold in its public Cloud to provide continuing access to data, thus resulting in a "hybrid" solution.

Whilst it cannot be argued that capacity gains in peak times are indeed a benefit of the hybrid solution, it seems bizarre that Rajesh Rajan, author of the article, has not mentioned the primary reason why customers are turning to hybrid Clouds in their droves – their concerns over the security of sensitive data being held in public Clouds.

From personal experience, the majority of customers requesting a hybrid Cloud solution are not requesting it because they have run out of capacity in peak times. Instead, on realising the additional security benefits of a hybrid solution, they are asking that their most sensitive data is held in a private Cloud, away from the glare of the public eye, whilst any data that does not require such security remains in their existing public Cloud.

Why hybrid?

Hybrid Clouds are becoming increasingly popular because by their very nature, there is not a single requirement that cannot be met by a hybrid solution. Indeed, they inherently offer the best of both worlds: the usage-based fees and simplicity of a public Cloud, accompanied by the flexibility and security of a private Cloud. To give an example of typical hybrid Cloud customer: Data which, comparatively, does not have to be so stringently secure, such as pre-sales systems, can be held in a public Cloud. At the opposite end of the scale, highly sensitive data, such as an in-house ERP system with customer credit card details can be held in a private Cloud to ensure data security and PCI DSS compliance.

Private Cloud benefits for public Cloud costs...

For the private Cloud element of their hybrid solution, a customer will typically benefit from the security that data is ISO 27001 guaranteed, is stored only in UK locations and is comprehensively supported by full disaster recovery capabilities. He will also know exactly where the data held in his private Cloud is located, allowing him to only place systems in the public Cloud that aren't at risk of breaching privacy issues.

Highly secure data without the hassle of an on-premise solution...

In order to achieve full certification for ISO 27001, organisations must be able to demonstrate that their premises, computer systems and access to sensitive documents are all fully secured. This ensures that the organisation has procedures in place for the protection of information to ensure that risks and vulnerabilities are better understood and safeguarded against.

Hybrid solutions are therefore ideal for those who either want their data to be held in the securest of locations of their own accord, or those that are required to do so by regulations, such as the Government's ruling that all its data is held within UK shores.

Business continuity capabilities for free...

And disasters such as that recently experienced by Amazon's EC2 Cloud customers only highlight how important it is for end-users to have disaster recovery capabilities in place, all of which come as standard with a hybrid Cloud package. Hybrid solutions allow customers to place data in a private Cloud, which is replicated at a mirrored site. This means that should disaster strike, be that in the way of a fire, or loss of power to a certain site, data can still be accessed.

The point must be made however, that any Cloud provider who says that they can guarantee 100% uptime is setting themselves up for a fall. No one, not even the Cloud giants such as Amazon or Google, can make such claims with absolute certainty. Investing in a hybrid Cloud solution however, does reduce the risk of downtime considerably. By its very nature, a hybrid model offers far more business resilience than a traditional on-premise IT solution. Investment in multiple cable runs and multiple transit providers is standard practice, thus delivering a greater chance of more consistent uptime.

Conclusion

Without a doubt, hybrid Cloud solutions do provide additional capacity for customers whose public Cloud has reached its threshold. But the hybrid Cloud provides customers with so much more than just extra capacity: with IS0 27001 guaranteed data, UK-only locations for data storage and disaster recovery capabilities as standard, surely the security benefits are more worthy of shouting about?