The following article was submitted by McAfee to CIO Canada. Although it has been edited to remove all traces of vendor bias, the arguments presented likely favour the vendor's approach.
Across all levels of government in Canada, departments and agencies are trying to combat rising IT costs by consolidating their systems and moving toward a shared services model. In many cases, this requires government IT leaders to not only streamline their government services and networks, but also reduce the number of data centres they operate.
In order to effectively transition from siloed government IT systems to one centralized system, government CIOs have been turning to cloud computing services to help move forward with the new delivery model.
But anyone familiar with the complexity of government IT knows that moving toward cloud services in the data centre comes with new management and IT policy headaches – especially when it comes to security.
McAfee and the Security and Defense Agenda, a Brussels-based think-tank, recently released a report on global cyber-security, titled “Cyber-security: The vexed question of global rules”. The report’s recommendations include the need for government and industry to examine new problems and opportunities created by cloud computing and state that cloud computing needs an appropriate architecture to achieve optimum security.
To ensure a seamless transition to a cloud-based infrastructure on the security front, government CIOs need to re-evaluate their security policy ownership, security control solutions and their relationship with cloud service providers.
Setting new standards
Regardless of whether public sector organizations maintain their own private cloud infrastructure or outsource it to a third-party vendor, CIOs need to adapt their security policy ownership accordingly.
Security policies are typically very overarching, but that trend cannot continue for public sector organizations moving forward in the cloud world.
In the move toward a decentralized, hybrid data centre – which brings together physical, virtual and cloud computing infrastructures – these policies not only have to become more definitive, but the ability to enforce those policies has to be driven back into technology.
Enforcing security policies with better security controls
Multi-layered data centre security solutions, which involve layered defenses that properly segment and zone data depending on its sensitivity and type, can be built directly into the design of any next- generation data centre architecture. This can be achieved with security control technologies that provide IT administrators with a unified management and reporting environment that can help defend against threats across an entire infrastructure.