Uncategorized Archives - magic beans https://magicbeans.pt/category/uncategorized/ Taking your business to the future across the cloud Thu, 30 Jan 2025 08:18:39 +0000 en-US hourly 1 https://wordpress.org/?v=7.0.4 https://magicbeans.pt/wp-content/uploads/2019/11/favicon4-66x66.png Uncategorized Archives - magic beans https://magicbeans.pt/category/uncategorized/ 32 32 How to Achieve NIS2 Compliance in the Cloud: A Technical Guide https://magicbeans.pt/nis2-cloud-compliance-guide/?utm_source=rss&utm_medium=rss&utm_campaign=nis2-cloud-compliance-guide https://magicbeans.pt/nis2-cloud-compliance-guide/#respond Wed, 29 Jan 2025 16:40:06 +0000 https://magicbeans.pt/?p=17647 The NIS2 Directive is a reality across the EU, and the impact on cloud environments must not be taken lightly. This blog post dives into the technical aspects of NIS2 compliance in the cloud and explores how cloud technologies align with NIS 2 requirements and the key strategies to ensure compliance. The Cloud Can Help [...]

The post How to Achieve NIS2 Compliance in the Cloud: A Technical Guide appeared first on magic beans.

]]>

The NIS2 Directive is a reality across the EU, and the impact on cloud environments must not be taken lightly.

This blog post dives into the technical aspects of NIS2 compliance in the cloud and explores how cloud technologies align with NIS 2 requirements and the key strategies to ensure compliance.

The Cloud Can Help with Compliance

Cloud service providers offer security and compliance-ready infrastructures that align with the requirements of NIS 2, but understanding how to leverage cloud services to fulfill NIS 2 obligations is essential.

The cloud simplifies NIS2 compliance in several ways.  It offers built-in security features, scalable resources, and automation tools that reduce the burden on organizations.  Cloud platforms provide centralized management and monitoring, making it easier to track compliance.  They also enhance data governance, incident response, and business continuity.  While shared responsibility remains, the cloud offers a cost-effective and efficient path to meeting NIS2 requirements.

Key NIS2 Technical Requirements

Shared responsibility models, complex architectures, and the dynamic nature of cloud environments require a tailored approach to NIS2 compliance.

Here are some of the more relevant implications for cloud environments:

  • Policies on risk analysis and information system security

It is important to have access to specialized expertise, advanced security tools, and proactive monitoring that enhance an organization's security posture beyond what many can achieve independently. It is important to conduct comprehensive risk assessments, including Well Architected Reviews, implement robust security controls, and ensure continuous monitoring, streamlining compliance efforts and reducing the burden on internal IT teams.

  • Incident handling

A robust incident handling service provides organizations with access to specialized expertise, advanced tools, and established processes for effectively managing security incidents. These services offer 24/7 monitoring and response capabilities, ensuring rapid detection and containment of threats, ensuring incidents are managed swiftly and effectively thus minimizing potential damage and downtime.

  • Business continuity and crisis management

Organizations must ensure operational resilience and rapid recovery during disruptions, while adhering to compliance requirements. It’s essential to provide robust disaster recovery solutions, automated failover systems, and real-time data backups across secure, geographically distributed data centers, minimizing downtime and data loss. Do not forget to have expert guidance and predefined crisis management frameworks aligned with NIS 2, ensuring a proactive approach to risk mitigation and continuity planning.

  • Security in network and information systems acquisition, development and maintenance.

Expertise in secure development practices, help organizations build security into applications and systems from the outset (DevSecOps). Furthermore, Cloud providers enable secure system design, automated vulnerability assessments, and patch management, reducing risks from outdated software or unsecure configurations. By outsourcing these responsibilities, organizations benefit from specialized expertise, accelerated development timelines, and continuous protection against emerging threats.

  • Policies and procedures to assess the effectiveness of cybersecurity risk-management measures

Employ continuous monitoring, automated reporting, and advanced analytics to evaluate the performance of risk-management frameworks against industry standards like NIS 2.  Additionally regular Well Architected and Security audits can be performed to facilitate compliance readiness with minimal operational disruption.

  • Policies and procedures regarding the use of cryptography and, where appropriate, encryption

Cloud providers offer advanced encryption technologies, both for data at rest and in transit, along with secure key management systems to safeguard sensitive information. They can assist in selecting appropriate encryption algorithms, managing cryptographic keys securely using key management systems (KMS), and enforcing encryption policies consistently across the organization's IT environment. Managed Services can perform regular audits to confirm compliance with NIS 2, and have expertise in implementing and managing encryption solutions across various data states (at rest, in transit, and in use), ensuring sensitive information is protected.

  • Human resources security, access control policies and asset management

Experts can assist in implementing and managing robust identity and access management (IAM) solutions, enforcing least privilege principles, and automating user provisioning and de-provisioning processes.

  • The use of multi-factor authentication or continuous authentication solutions, secured voice, video and text communications and secured emergency communication systems.

Cloud providers offer integrated MFA solutions, ensuring that only authorized users gain access to sensitive systems and data. Additionally, continuous authentication continuously monitors user behavior and activity, detecting anomalies in real time to prevent unauthorized access or account compromises. Magic Beans possess the expertise to deploy and manage MFA methods, ensuring robust protection against unauthorized access even if credentials are compromised. Using Managed Services, organizations benefit from seamless integration with existing infrastructure, automated updates to stay ahead of emerging threats, and compliance with regulatory standards like NIS 2

Conclusion

NIS2 compliance in the cloud requires a comprehensive and tailored approach. While the cloud offers many advantages for compliance, it's crucial to remember that compliance is a shared responsibility. Organizations are still responsible for implementing and managing their own security controls and ensuring that their use of the cloud complies with relevant regulations. Partnering with a managed security service provider (MSSP) specializing in cloud security can significantly simplify the compliance journey.

The post How to Achieve NIS2 Compliance in the Cloud: A Technical Guide appeared first on magic beans.

]]>
https://magicbeans.pt/nis2-cloud-compliance-guide/feed/ 0
Multicloud… Oops! It was an accident https://magicbeans.pt/why-multicloud/?utm_source=rss&utm_medium=rss&utm_campaign=why-multicloud https://magicbeans.pt/why-multicloud/#respond Thu, 15 Jun 2023 18:40:03 +0000 https://magicbeans.pt/?p=16752 When I see how the #multicloud adoption global figures are raising every year, I wonder if this is happening by design of by accident. Probably the origin of #multicloud in many organizations was combination of both factors, but nowadays many organizations are making their #multicloud choice consciously. In any case, #multicloud is the reality [...]

The post Multicloud… Oops! It was an accident appeared first on magic beans.

]]>

When I see how the #multicloud adoption global figures are raising every year, I wonder if this is happening by design of by accident. Probably the origin of #multicloud in many organizations was combination of both factors, but nowadays many organizations are making their #multicloud choice consciously. In any case, #multicloud is the reality that we see in the market today because offers many benefits and opportunities. But also, it brings challenges that we must understand and manage.

To avoid misunderstandings, let’s begin with some basic definitions. #Multicloud is the usage of Cloud computing services from more than one Public Cloud Service Provider (CSP) for different workloads. While hybrid-cloud is when we are running our different workloads on both Public Cloud Services Providers, Private Clouds, edge computing and on-premises. This is the on-going situation of the organizations that are in a Public Cloud adoption journey. And finally Distributed Cloud is when we can run our workloads on different computing machines hosted on different CSPs, Private Clouds or on-premises data centers. Cloud is centralized by definition, but it’s also distributed among the Edge, different regions and availability zones. We’ll center the focus on #multicloud on this article.

  • Having “multi-IT-suppliers” is not new. We have dealt with that situation for decades. And we reached this situation also from a combination of strategic decisions and some tactical ones.
  • The strategic decisions came from the standardization of preferred supplier, or suppliers, for each category, such: hardware, operating systems, database management systems, development environments, identity management, etc. These strategic suppliers map usually found a balance among capabilities and cost, with the aim of avoiding vendors lock-in.
  • The tactical ones usually came from acquisitions from end-users in the departments. These tactical decisions could be made with the involvement of IT or without them –what we called shadow-IT. This could also happen on the Cloud world.

In any case, we were used to manage a “multi-IT-supplier” reality, keeping a consistent corporate architecture, using different solutions for data and applications integration, having a federated identity management, common security procedures and tools, business continuity, etc.

This is a good experience to start with, but as we know, in the Cloud there are some additional considerations to deal with.

Show me your workloads, and I will tell you… When we analyze the cloud workloads that are supporting our business, we can identify four main types (simplifying…):

1. Cloud native workloads: workloads designed to run in a specific CSP, using their Cloud native services, architected to get all the benefits of the Cloud. Despite these workloads could be migrated to other CSP with relative low effort, the decision of using unique proprietary services of a CSP has pros and cons that we should understand.

2. #multicloud native workloads: they are also cloud-native workloads, but designed to run in any CSP, taking full benefits from a #multicloud deployment. For example, running a single Kubernetes cluster with multiple nodes deployed on different CSPs. If you have these kinds of workloads is probably because you have a #multicloud strategy in your organization. And you want to ensure that every new development follows the necessary standards to guarantee the deployment across CSPs without compromises.

Types 1 and 2 could come either from brand new developments –greenfield innovation taking advantages of Cloud new possibilities–, or from the deep rearchitecture of legacy applications –Brownfield innovation–.

3. Legacy workloads: bespoke or packaged on-premises workloads that we lifted and shifted into a CSP Virtual Machine without big changes. If these workloads are running on any base software, such Database Management Systems, we should make it available on the CSP of choice. This availability could condition the decision of the CSP, and maybe could be against our strategic choices.

Types 1 & 3 could run on a specific CSP by accident as a consequence of a tactical move, or because we were forced by the software dependencies, as we have commented on the Type 3. Or can be by design, based on a conscious decision. For example, of the typology of the workload to take advantage of each CSP’s unique offering. You could have decided, for example, to run all analytics workloads on Google Cloud, Development/DevOps workloads on Azure, Web Content on AWS, or Database workloads on Oracle Cloud Infrastructure. This conscious decision can also be taken for other reasons as: the location of the CSP datacenters and access points, availability of services, how critical is the workload, price/performance considerations, scalability, elasticity, security, certifications of the CSPs, or sustainability.

4. SaaS workloads: third party applications which we usually get by subscription, that are hosted on the CSP of choice of the SaaS supplier. In general, the CSP deployment details are transparent for the end user. Therefore, if we are consuming different SaaS applications, that is the case of most of the organizations today, we are potentially enjoying a #multicloud experience without notice.

For this reason, when it comes to the selection of a new SaaS application, it's highly recommended that the end-user and the IT department work together to consider, not only the functional fit, but also the technical fit with the organization standards. It’s important to analyze together the hidden implications of the decision, taking into consideration factors as: performance, integration, security and cost.

Key benefits of a #multicloud strategy

1. Flexibility and CSP independence:one of the main benefits of #multicloud adoption is flexibility. By distributing workloads among multiple cloud platforms, organizations could gain independence from any single CSP. Reducing the risk of vendor lock-in and empowering organizations to leverage the best-of-breed services from different providers. Additionally, it provides the freedom to switch between providers or negotiate better terms, ensuring competitive pricing and improved service levels. This is not new; it was also the strategy of many organizations in the on-premises era.

2. Optimized performance and scalability: as we have pointed out above, each CSP excels in different aspects. With a #multicloud approach, organizations can select the most suitable provider for each workload, tailoring their choices based on specific performance requirements. This ensures optimal performance, scalability, and responsiveness, as workloads can be allocated to the most suitable CSP based on their unique characteristics.

3. Better resilience and reliability: #multicloud inherently provides enhanced resilience and reliability. By diversifying infrastructure across multiple CSPs, organizations can minimize the risk of downtime due to provider outages or system failures. Workloads can be seamlessly shifted between clouds, if they are designed for that purpose (Type 2), ensuring continuity of operations and minimizing the impact of any single point of failure. This redundancy significantly improves overall system reliability and helps maintain business continuity.

4. Increased security and compliance:#multicloud offers the potential to enhance security and compliance measures. By distributing workloads across multiple cloud providers, organizations can implement defense-in-depth strategies, mitigating the risk of a single point of failure. Additionally, using multiple CSPs allows organizations to choose platforms with different security features and certifications, ensuring adherence to industry-specific compliance requirements. Here is important to remark that choosing the right CSPs, as not all the cloud providers have the same security level or comply with the same certifications.

Considerations of a #multicloud strategy

Having a #multicloud strategy has strong benefits as we have seen, but it also brings some challenges that we need to understand and manage to get a successful implementation. Let’s discuss some challenges and what are the best practices to deal with them.

1. Effective Cloud management: managing multiple cloud platforms requires robust cloud management practices and the availability of specialized talent.

Adopting a centralized management approach with comprehensive monitoring, automation, and orchestration capabilities can streamline operations, optimize resource allocation, reduce costs, and simplify governance across all CSPs. In addition, we should implement centers of excellence for each of the CSPs to support the central management group and give advice to the different project teams.

If we don’t have the necessary talent in-house. We can contract a #multicloud #ManagedServices provider to complement us. Partnering with the right company will get good payback.

2. Interoperability, integration, and portability: ensuring seamless interoperability and integration between different cloud platforms is crucial. Organizations should invest in standardizing APIs, leveraging containerization technologies like Kubernetes, and utilizing integration frameworks to facilitate smooth data flow and application portability across CSPs.

These elements are not new, as we have commented above, they also were key on the on-premises world when we had a multi-IT-suppliers strategy. The difference with Cloud is that we must take into consideration other elements, as the network’s interconnection among CSPs and the latency. There are alliances between some of the main CSPs to interconnect their datacenters. This could simplify our life.

We should consider also the “Data gravity” aspect. Data has a “mass”, and therefore moving a huge amount of data around is not feasible. Especially if we have real time needs. It takes time, what impact performance, and could imply high costs. Maybe it’s easier to approach the applications to the place where most data are located, and not the opposite.

3. Data governance and security: keeping data governance and security in a #multicloud environment is key. Implementing principle of least privilege, consistent data encryption, access controls, and security protocols across all CSPs is essential. Implementing regular audits and risk assessments should be conducted to identify potential vulnerabilities and ensure compliance with relevant regulations.

If we don’t have the right resources in-house, we can always subscribe to a #multicloud posture management service to complement us.

4. Vendor management and cost optimization:: and last but not least, managing relationships with multiple cloud providers requires effective vendor management strategies. We should negotiate favorable contracts, optimize costs through workload placement, and regularly review provider performance to ensure they are meeting service-level agreements.

Something critical to consider are the “exit barriers”. Please carefully look at the data-egress fees of the different CSPs. There are important differences among them. This cost could potentially kill our #multicloud strategy, or at least condition it. Ensure that you discuss that angle when it comes to negotiating with your CSPs of choice.

Additionally put in place a Cloud Financial Management (CFM) practice in your organization – something beyond traditional FinOps. CFM will help you to be in control of your cloud spend, reduce waste, and ensure that you're optimizing your resources and investments in the cloud. The CFM practice involves budgeting, cost optimization, forecasting, and cloud cost management. This will require collaboration across many departments including IT, finance, and operations. CFM is also very important when you have a single-cloud strategy.

Conclusion

#multicloud is the strategy of many organizations today, seeking to optimize their Cloud operations and leverage the strengths of multiple CSPs. They get more flexibility, independency, resilience, and performance. However, a successful implementation requires understanding well the implications, we should put in place a realistic plan, implement strong #multicloud management practices, and a deal with interoperability, latencies, “data gravity”, security, and cost optimization. Ensure that #multicloud is not happening just by accident.
To be successful on #multicloud, probably talent is the key ingredient. Consider partnering with a #multicloud #ManagedServices provider, it will bring peace of mind.

by Félix del Barrio
Technology and Business Senior Advisor
24-5-2023

The post Multicloud… Oops! It was an accident appeared first on magic beans.

]]>
https://magicbeans.pt/why-multicloud/feed/ 0