-: Cloud-based infrastructure.
Now, most organizations see their future in the cloud,
but it's actually a riskier choice
than traditional client/server applications
running on a local network in most cases.
If you don't configure the cloud properly,
you can have a lot of danger.
Now, you can configure your cloud to provide
just as great security
as your traditional client/server applications.
But it does take some knowledge.
This is what we talk about
when we talk about cloud infrastructure.
We need to make sure that we're doing
our infrastructure management properly and configuring it
to the same level of security as a local solution.
Now, one of the biggest places that we have to think about
when we do this is virtual private clouds or VPCs.
Just like you can use your virtual private networks
to connect your home users back to your corporate network
and give them those protections
underneath that corporate umbrella,
virtual private clouds can be configured
as a private network segment made available
to single cloud consumers within a public cloud.
This is a way that we give security.
VPC is considered an infrastructure as a service product,
so if you're using something like AWS,
they have a virtual private cloud service.
If you're using Azure,
they have their virtual private cloud service.
And virtual private cloud services
let you provision virtual servers and appliances
within a virtual network that's hosted on a public cloud.
So, we can try to get some of that security
of a private cloud without all that extra expense.
Now, is this as secure as a private cloud?
No, because we're still using shared hardware
and there could be issues like data remnants
being left behind on a server
from being provisioned or deprovisioned.
But, from a networking perspective and a privacy perspective,
you can get equivalent levels of protection using VPC.
Now, as a consumer, you're responsible
for configuring the IP address space and routing
within that cloud when you do virtual private clouds.
You're going to handle all the administration,
all of the security aspects of running the network,
just as if it was your own.
You're going to have to do all the software installation,
all the patching, all the account management,
all the loan balancing, all the disaster recovery,
all the security monitoring, all the backups.
All of that has to be configured
because when you're doing a virtual private cloud,
it's essentially like you own these servers.
The only difference is you don't actually own the servers
and you don't have access to the physical hardware.
Instead, you're going to be able to use these different servers
and spin them up and spin them down whenever you need to,
meaning, provisioning them or deprovisioning them.
Now, when we talk about a virtual private network,
it's hosted on publicly-available cloud services.
This is things like Amazon Web Services,
Microsoft Azure, Google Cloud.
But you're going to be isolated from other customers' instances
using technologies such as virtual LANs or VLANs
and you can also use other things like this
as you're building out your virtual private cloud.
Now, like I said, a virtual private cloud doesn't give you
the exact same level of security as a private cloud,
but it doesn't come with the high cost either.
By using a virtual private cloud,
it's going to be less expensive than using a private cloud
and you're not going to have to own and operate
the entire cloud service or the hardware underneath it
so you're getting some of those security benefits,
but not all of the security benefits.
When we talk about a virtual private cloud,
a virtual private cloud is typically going to be used
to provision Internet-accessible
customer-facing applications or corporate applications
that need to be accessed from geographically remote sites.
If you're thinking of something
that might be a good place inside a DMZ,
a virtual private cloud
might be a good place to put it, as well.
Now, the last thing we need to think about
when we talk about cloud-based infrastructure
is cloud versus on-premise.
Now, what is the difference?
Well, when you deal with the cloud,
you're putting it in somebody else's data center.
You're putting it someplace where you're just seeing it
as a virtual instance someplace on the Internet.
You don't actually get to go touch that thing.
You don't know if it's in Virginia or London
or Washington or even care a lot of times
because you just care that you have access to it
and that's the benefit of having the cloud.
It's everywhere you want to be.
Now, when you deal with on-premise,
this means it's something in your own data center.
You can walk down the hall and you can touch those servers.
A lot of the places I've worked over the years,
we've run our own data centers.
Now, these days, we're starting to use
more and more cloud resources,
but for the last 20 years, I spent a lot of time
in a lot of organizations spending tons and tons of money,
millions and millions and millions of dollars,
building out data centers and running our own servers.
Now, there is some benefits to having cloud
and there's some benefits of having on-premise.
When you deal with on-premise solutions,
you're going to maintain your servers
locally within your network.
That means you're going to be able to touch them.
It also means you're responsible for when they break.
That means when a server goes down,
you're going to be the one waking up at two in the morning
to go replace their hard drive.
When you're dealing with an on-premise solution,
you own the entire thing from software
all the way down to nuts and bolts of the hardware.
That is a good thing in some cases
because you can own the whole thing
and configure it however you want.
It's also bad because it's a major support headache
and a huge capital expense for your organization.
Now, a lot of security products that you have out there
can be used as either cloud-based or on-premise
and we've already talked about a lot of the benefits
of the cloud, right?
They're infinitely expandable,
there's lots of storage out there,
there's ultimate bandwidth
and you only pay for what you use.
Well, with a lot of these security products,
you have a cloud-based version or an on-premise version
and you have to decide which one you want to use.
Now, which one is right?
Well, that depends on what you want to do.
Some of these have some real benefits by doing cloud-based.
They might be more cost effective, they might be cheaper.
You don't have to have dedicated hardware,
dedicated local processing, dedicated local storage.
All those things add cost
and so you can offload all that to the cloud
and just basically point your things to that cloud server
and let it do all of the work for you.
Now, why might you want to use on-premise?
Well, maybe you're worried about the security of that data
and you don't want that data
being outside your corporate network.
That would be a reason for using on-premise.
Now, one of the big reason
that a lot of these security softwares
are starting to move to cloud-based solutions
is you can do better use of AI and machine learning.
Why? Because AI and machine learning takes huge amounts
of processing and huge amounts of banks of resources
and most people don't have that
as a part of their on-premise solution.
So instead, by moving this all to the cloud,
it makes it easier to integrate
with artificial intelligence and machine learning
to do deeper data integration and automated analysis.
Now, if you're going to move to the cloud,
what do you need to consider?
Well, you need to consider any compliance
and regulatory limitations.
Sometimes, you're going to have limitations
of storing data in a cloud-based security system.
Depending on the rules,
you may have to have an on-premise solution.
Now, in addition to this,
there are other issues you have to consider, as well.
For example, if you move to a cloud-based solution
instead of an on-premise solution,
you may be subject to vendor lock-in.
I've seen this with some companies.
They've moved to something where it's based on the amount
of terabytes that you store inside their server
and it can start adding up
to be really, really expensive really quickly
and so that can now get you locked in to that vendor
because they have all your data
and to get out, it's going to cost you
hundreds of thousands of dollars in bandwidth and usage fees
to move it from this cloud to your on-premise
or this cloud to that cloud.
And so, you can get this vendor lock-in problem
that can happen and it's very real.
So, when you're designing your cloud-based infrastructure,
always think what's going to be best for me today
and what's going to happen down the road
because a lot of services
will give you a very low upfront cost,
but then they'll get you on the backside
when you try to move to another provider.