4 key considerations for a secure cloud migration

Solution

The first step of an engagement with a third-party advisor is understanding both what it is you need and where you want to go. This kind of holistic approach to cloud security means your digital architecture is more likely to deliver real value, whether that means slimming your tech stack, refining your processes or adjusting your security protocols.

When it comes to the technology, tools and platforms at the heart of your move, you’ll want to choose from the widest possible selection rather than trying to shoehorn your architecture into a one-size-fits-all plan. A flexible, vendor- and platform-neutral technology strategy can be a very effective way to maximize the value and flexibility of your cloud technology investments. Finally, for firms that may be considering cloud security improvements at various points in a cloud journey, it’s important to ask whether a third-party advisor has experience working with clients in the middle or later stages of a cloud migration initiative.

Solution

In these cases, experience matters for midsized firms seeking expert cloud security guidance. A veteran team of cloud security experts should have a track record that includes hundreds of similar projects completed for other midsize companies—giving them the ability to find and address unfamiliar and unconventional threats. A world-class cloud security team will also have hands-on experience with a wide range of cloud infrastructure providers, virtualization options, application types and other variables, all of which contribute to their ability to troubleshoot a client’s migration efforts and introduce processes for mitigating risk.

Solution

If your organization is focused on SOC2, PCI, Sarbanes-Oxley and other compliance regimes, you’ll want an advisor that can assess current compliance performance and recommend targeted improvements. This includes specific, hands-on expertise with key cloud security industry standards, including:

• ISO27001 (Information security management system guidelines)&
• OWASP Top 10 (web application security risks)
• NIST 800 Series (secure cloud migrations; secure cloud services)
• CIS Benchmarks (cloud infrastructure hardening
• PCI-DSS (credit card data and payment processing)

An experienced cloud security team can work with your firm to design custom assessments that integrate best practices, reference designs, benchmarking tools and other elements from these and other sources. The resulting process can be a highly effective way to align a standards-driven assessment with a customer’s specific priorities and pain points. It can also uncover gaps or performance improvements that a cookie-cutter assessment process is likely to overlook.

Solution

Cost optimization is another area where it’s essential to work with an advisor that has direct and extensive experience with your firm’s specific industry sector. Armed with this, an advisor can recommend a customized approach that allows your firm to optimize costs without exposing your data to additional risk. This approach to right-sizing your cloud architecture typically includes:

• Keeping cost optimization front and center. Your budget matters, and the right team of advisors should work to ensure that your cloud capabilities can scale up and down as needed to keep resources aligned with requirements. In many cases, this will involve finding savings by identifying things like duplicative technology or adjusting storage utilization.
• Balancing flexibility and functionality. A third-party advisor should also give you an exceptional degree of freedom to choose the platforms, tools and capabilities for your cloud migration. This is yet another area where a qualified advisor will have experience working with different cloud technology combinations—ensuring that customers know what works and what doesn’t so they can choose accordingly.
• Putting customer choice ahead of vendor focus. Part of the value of working with a third party is getting honest advice and opinions. An advisor with strict product and vendor neutrality policies will be free to support customers with the right solutions and unbiased guidance.
• Saying “yes” to customer requests. Even advisors with extensive experience helping midsized firms succeed in the cloud can expect to see requests for capabilities, customizations, toolsets and other elements they’ve never built or implemented before. Many consultants routinely turn down these requests or make them prohibitively expensive, but it’s imperative to work with an advisor that looks for ways to say “yes” to these requests whenever they can.