Data centers have been rapidly adopting new technologies as they race to increase efficiency and keep up with the pace of business transformation. This shift has only been amplified by the pressures created by the current pandemic. Many security teams were already straining, and this accelerated pace and scale can overwhelm them. To keep from holding their businesses back, security teams have to adapt as quickly as the rest of these environments are changing. The challenge is that traditional information security tools and practices have difficulty scaling to match the velocity that technologies like containers and cloud can achieve. Organizations that can’t keep up risk leaving unintentional gaps in protection or becoming less competitive. Fortunately, there are techniques that organizations can use today to leverage security teams’ existing skills and capabilities and accelerate security operations.
The main challenge that a security team faces is adapting to the push to new environments. This includes the shift to cloud and off-premises resources. As a consequence of these changes, a security team often has to deal with the increasing adoption of workload orchestration tools and the shorter provisioning cycles driven by concepts such as software-defined infrastructure.
The move to virtualization started this cycle, but changing application architectures and application-development techniques are fueling demands to create supporting infrastructure faster and to push it closer to users, many of whom are now suddenly working remotely. Shorter software-development cycle patterns, like agile methods and DevOps, depend on resources that can be put to use quickly and torn down at the same rate. Container-based infrastructure approaches escalate these trends with smaller units of capacity and dramatically shorter lifetimes. The amount of work required to secure these environments using traditional methods means that many security teams simply can’t support either their speed or scale. Far too much of traditional security operations is hampered by manual interventions or hand-offs.
There are additional complexities in trying to extend traditional security approaches to cloud. It’s no wonder that a 451 Research Voice of the Enterprise (VotE) Digital Pulse study in 2019 found that data protection and security concerns led the list of workload-related challenges by a wide margin.
All these changes are taking place while there’s a chronic shortage of information-security professionals. To succeed, organizations have to realize that they can’t hire their way out of this problem. The competition for talent is going to continue – especially in areas that are key to data center transformation. A 451 Research VotE study on information security in 2019 reported cloud platform expertise as the leading security skills gap. Both these trends have been exacerbated by the recent changes in the world due to the pandemic. The combination of these factors mean that organizations have to look to other ways to succeed.
Simplify and Standardize
To keep security from becoming a bottleneck in the production pipeline, teams need to do two main things – simplify and standardize operations. They can take a page from the DevOps playbook without having to radically change their security posture. To start, they should take advantage of the automation capabilities that are often already available in their existing tools. Automation is a force multiplier for security teams and can be integrated into infrastructure provisioning. Integration into the orchestration of infrastructure can come in a number of forms.
For automation to be most effective, policies must be standardized and a consistent set of controls put into place to enforce them. It can be tempting to customize native controls in different environments, but the effort required to maintain them can destroy any efficiency and complicate automation efforts. Much less maintenance work is required when the same controls can extend consistently across virtual machines, containers and clouds. The reduction in complexity has the added benefit of reducing the potential for error.
With automation, security teams can scale their capacity to use the more effective workload isolation techniques that new application architectures require, such as microsegmentation. Automation can ensure that the right protections are in place when a workload is built and can accomplish what would otherwise be a manual approval process.
It takes coordination across teams to build agreement on policy, but that agreement makes greater speed possible. Coordination can be as simple as agreeing on a common definition for workload types and the protections that will be put in place.
To ensure business success, information security teams have to put automation and operational simplification into practice and fully leverage their benefits. These changes will only become more important over time. A 451 Research study on the effects of the pandemic in April reported that 38% of enterprise respondents expect that workforce dislocation will be permanent. If that sentiment is correct, organizations will need to continue to operate infrastructure in more places and at greater pace.
By making improvements to simplify and standardize operations, organizations can enable effective security protections that can scale to meet the pace at which a modern business needs to operate. They can drive the data center transformation process to create infrastructure that can be both fast and secure. This is the sort of infrastructure that can support the expanded and extended workforce of the future.
You can read more about the role of security in data center transformation.
This guest post was contributed by Eric Hanselman, chief analyst, 451 Research.