Now, when you think about security in the cloud, it's tempting to say that it's way different than it is normally, but it's really not.
Organisational Role in Cloud Security
Security is a shared responsibility model. There's now someone else in the response chain or the analysis chain for your security, because you've effectively outsourced some of your physical data centre space and your compute and your storage to somebody else. And you need to make sure that those people are plugged in when you're thinking about security.
Secure Valuable Data
One of the things that some people say is, "But my cloud security provider has really awesome security." And they do. The cloud service providers have excellent security, but it protects them, not you. If you put an unpatched Windows operating system on a publicly-facing IP address on Amazon, it will be owned in ninety seconds, and all of Amazon's vaunted security is not there to protect you. So don't do that.
Even though they may have great security, you still have responsibility for everything above, say, the hypervisor or above the operating system, depending on what you're buying from the provider. And you need to have a security strategy to go in there and address it. So it's really important that you understand that just because you're going to a third-party cloud service provider, you still have a security obligation going forward.
Comprehensive Cloud Security Solutions
SecureWorks has actually been in the cloud security business for a while. We've actually had a full portfolio for VMware environments, which is great. VMware environments are good for clients who are virtualising their data centres or building out private clouds. But what we've done recently is introduce a full suite of solutions for Amazon Web Services environments, starting from professional services:
We can help you design your entry into the cloud if you're in the early part of the cloud adoption model. We can help design a solution for you. We can help you move into the cloud more quickly, more maturely and more securely.
If you're already there, perhaps in a departmental model, we can help test your environment from a compliance perspective or a security perspective.
And if you've already got solutions in the cloud, we can of course help you manage and monitor those as well. We can monitor everything that's going on in your environment.
It's worth noting here as well that we've made specific efforts to use Amazon APIs, including CloudTrail and CloudWatch, which are great ways to get data from your infrastructure, find out who's doing what, what's going on, protect yourself a little bit from changes to IP addresses and elasticity.... So we've designed all that in, and it's a great portfolio for Amazon Web Services clients.
And finally, if something should happen, we have an Incident Response service that can come in and very quickly help you figure out what happened, who was involved, what were they after, and how you can protect yourself in the future.