...and how traditional IT must change its behaviour
You already know this, but Cloud Technology has kind of changed the business world—not just the lives of IT professionals.
Cloud-enablement, and the proliferation of SaaS systems, has advanced to a point where start-ups can harness enough capacity from leased technology to challenge industry titans without actually needing a staff of IT support engineers.
Technological components now rarely sit inside an organization’s network nor are they commonly developed in-house. Whereas IT once held the keys to an operation’s many applications and data, the path of least resistance for new enterprises is to rent software and storage from third-party vendors for the sake of convenience and speed over absolute, end-to-end ownership.
Some call it the “consumerization of IT”.
But what are the risks of employees carrying out tasks using methods based entirely outside a network? How must Enterprise Architects and IT managers supervise the personal devices and self-acquired applications that are just as good—if not better—for business dealings than the ones officially prescribed by management?
Problematically, consider also that as organizational data gets sent to the cloud and put within SaaS systems, not even large-scale organizations with longstanding and expansive IT programs fully own the internal analytics tools to measure their digitalized operations. These mature businesses, much like their emerging competitors, are embroiled in a very modern fight to acquire the most accurate analytics software in order to translate flurries of customer data in ways smarter, faster, and more comprehensive than whatever business appears next to them on the front page of Google.
“People aren’t moving to the cloud,” says Larry Biagini, former CTO of General Electric, in a webcast for Zscaler. “The cloud came to them. Whether they like it or not.”
In this same webcast, Biagini summarizes how traditional IT must shift to respond to the sea change brought upon by cloud-based technology. As follows:
So, related to Biagini's thoughts, we've put together this list of six things to consider about IT transformation into the cloud...
The quicker your organization can deliver products, the better. In this sense, money is less a deciding factor than how well you can keep pace with the speed of consumers. Think of it this way: if you can't fundamentally produce goods quickly, no amount of cash will make your company relevant.
This focus point is key. When organizations move to the cloud and (inevitably) adopt a policy-based access model, identification and access management become paramount. Identification and access management technology can be used to initiate, capture, record, and manage user identities and their related access permissions in an automated fashion—all of which is essential for cloud computing.
Truly great identity access management authenticates individuals and services according to a single interpretation of policy. Failing to implement such an overarching cloud access policy can lead to devastating compliance errors during auditing as it is difficult to argue your information is not being misused.
Learn which cloud services are in your organization, and learn where your data is going. Under EU GDPR, companies will be required to perform a Data Protection Impact Assessment (DPIA). During the DPIA, organizations will be required to demonstrate compliance readiness. Being fully compliant with GDPR means that your organization knows exactly where your data is stored, how to access it, and how to manipulate it if necessary. A clear view of your company's cloud services is key to compliance.
Learn how to separate security and risk preparedness from compliance readiness. Security and risk are all under an organization’s control; being forced to accept regulatory compliance is not. Distinguish one from the other.
Similar to the point mentioned earlier, it is impossible for one security prevention system to safeguard all company assets. Spend the time and resources to develop a dependable detection program that can respond to potential risks—and spend the time to educate your workforce on how to be vigilant rather than passively assured.
Don't become an IT department responsible only for security. Become an organization that can show operations the consequences of misaligning with the digital world and the dangers of not innovating nor adopting new technologies. Note: a risk assessment is not a security assessment. Translate the imperatives of IT into a language of business!