Now on Demand Ransomware Resilience & Recovery Summit - All Sessions Available
Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Security Infrastructure

Taking Hybrid IT from Accident to Strategy

Most enterprises have an accidental Hybrid IT reality, rather than a strategy. As various groups and geographies within enterprise organizations procure their own cloud services independently of the IT organization, conflict emerges between the use of traditional computing infrastructure and cloud options. As this situation grows, it exposes inefficiencies and risks that demand a more strategic approach.

Most enterprises have an accidental Hybrid IT reality, rather than a strategy. As various groups and geographies within enterprise organizations procure their own cloud services independently of the IT organization, conflict emerges between the use of traditional computing infrastructure and cloud options. As this situation grows, it exposes inefficiencies and risks that demand a more strategic approach.

How did we get here?

The potential for Hybrid IT was created by two flavors of cloud computing – SaaS and IaaS.

While Concur is often cited as the first SaaS offering, Salesforce deserves credit for normalizing the SaaS model in the minds of enterprise buyers whose initial concerns over security and performance were sidelined by business demands for its capabilities. 

IaaS became mainstream when Amazon Web Services launched on March 14, 2006. It armed developers with direct access to infrastructure and an ability to bypass the IT operations provisioning bottleneck. This, combined with Agile development practices, unlocked the potential for DevOps, which emerged in 2009.

Hybrid IT

Web scale companies took full advantage with a cloud-first (or cloud-only) policy, but around 2014, enterprise developers took notice. When enough stories emerged of companies like Netflix out-innovating Blockbuster (leading to the latter’s demise), it tends to draw attention. 

As cloud has crept into the enterprise, it has displaced some, but not all of the traditional computing environment. In many cases, IT organizations cannot abandon legacy investments without introducing unacceptable risk and cost. Thus, we have this uneasy aggregation of cloud and traditional computing, referred to as Hybrid IT by Gartner in a blog post dating back to 2012.

Why the status quo must change

Advertisement. Scroll to continue reading.

The impact of running cloud and traditional services in parallel in the enterprise is most painfully felt within application development teams and IT operations. As long as cloud and traditional services operate independently, there is a division that increases management complexity and reduces the agility of the organization, impacting the overall competitive posture of the business.

From an application development perspective:

● The deployment pipelines across multiple cloud and legacy services are highly segregated. Where services are redundant, the enterprise misses out on potential volume discounting and efficiency gains.

● Cloud-based services often need access to rigid legacy systems. This dependency creates a flexibility mismatch that reduces the speed and agility benefits of cloud computing.

 

Segregation worked for a while when DevOps initiatives were small-scale experiments using cloud-provided tools. But as DevOps scales out across the enterprise, deployments will slow to a crawl if IT operations cannot abstract the provisioning differences and dependencies between the various computing platforms that make up Hybrid IT.

From the perspective of IT operations and security, there are several challenges:

● Management is divided in silos defined by computing platform, requiring multiple teams and tools. This increases complexity, costs and errors while slowing operations and frustrating users.

● Services delivered on legacy platforms are often unable to elastically respond to peaks or decline in demand, in the same way that cloud services can.

●  IT operations models based on manual management of changes and configurations cannot scale to the pace demanded by the business. As process is bypassed, potential security policy and compliance violations emerge.

IT operations and security teams are experiencing a lack of control introduced by cloud services, which might be fine by the purveyors of “NoOps,” but enterprises have standards for availability and regulations that cannot be ignored without severe consequences. As the use of cloud services accelerates in the enterprise, we can expect these challenges to grow.

Getting to a strategic approach to Hybrid IT

A strategic approach to Hybrid IT means enabling the choice of environment for a worklo
ad to be made entirely based on what is best for the business. This is true both for newly developed applications and those that have run faithfully for decades.

This doesn’t automatically mean that public cloud services will always be selected.

For example, there are some services provided by enterprise IT organizations that run in a mainframe or distributed environment that are practically bulletproof. Re-architecting and deploying those services to the public cloud would mean taking on significant cost and risk to availability that may not be in the best interest of the business. So those workloads need to remain where they are for the foreseeable future.

But there are also workloads running in a data center that is at capacity, or for business reasons needs to be shut down. Migrating those workloads to the cloud, or replacing them with SaaS could support the agility needs of the business.

There are serious challenges to enabling true hybrid choice, covering mainframe, distributed, virtual, private and public cloud environments. Managing the complexity and dynamic nature of these very different platforms that were never meant to work well together requires operational and security management that is nimble enough to keep pace, which was difficult enough when all the computing resources ran under the authority of IT operations. With cloud services, operations and security teams will have to evolve their approach.

The focus of this column is to help organizations approach Hybrid IT in a way that enables it to become a strategic differentiator for their business. Stay tuned for future articles that will provide examples, best practices, and analysis of enterprises that are succeeding in evolving their approach to Hybrid IT management.

Written By

Click to comment

Trending

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join the session as we discuss the challenges and best practices for cybersecurity leaders managing cloud identities.

Register

SecurityWeek’s Ransomware Resilience and Recovery Summit helps businesses to plan, prepare, and recover from a ransomware incident.

Register

People on the Move

MSSP Dataprise has appointed Nima Khamooshi as Vice President of Cybersecurity.

Backup and recovery firm Keepit has hired Kim Larsen as CISO.

Professional services company Slalom has appointed Christopher Burger as its first CISO.

More People On The Move

Expert Insights

Related Content

Malware & Threats

The NSA and FBI warn that a Chinese state-sponsored APT called BlackTech is hacking into network edge devices and using firmware implants to silently...

Management & Strategy

Hundreds of companies are showcasing their products and services this week at the 2023 edition of the RSA Conference in San Francisco.

Security Infrastructure

Security vendor consolidation is picking up steam with good reason. Everyone wants to improve security efficiency and effectiveness while paying for less.

Cloud Security

The term ‘zero trust’ is now used so much and so widely that it has almost lost its meaning.

Security Infrastructure

Instead of deploying new point products, CISOs should consider sourcing technologies from vendors that develop products designed to work together as part of a...

Funding/M&A

Responding to Cyber Threats Against Critical Infrastructures: Wired Business Media Acquires Long Running ICS Cybersecurity Conference Series

Security Infrastructure

Comcast jumps into the enterprise cybersecurity business, betting that its internal security tools and inventions can find traction in an expanding marketplace.

Audits

The PCI Security Standards Council (SSC), the organization that oversees the Payment Card Industry Data Security Standard (PCI DSS), this week announced the release...