Hybrid Cloud Security

Organizations are shifting from exclusively on-premises IT to hybrid delivery that mixes on-premises, hosting, and multiple cloud services to support digital transformation, increase flexibility, and reduce costs. This shift improves options for resilience, demand spikes, and compliance-driven placement of sensitive workloads, but it also increases management, security, and compliance complexity because control is no longer fully centralized within the organization’s data center.

Hybrid service delivery requires governing and securing five distinct planes: physical infrastructure; virtualization/abstraction (IaaS); middleware/tools (PaaS); business applications (SaaS); and the top plane of data governance and access control, including endpoint security. On premises, responsibility across planes is clear; in cloud services it is split between the customer and the cloud service provider (CSP) depending on the service model. This shared-responsibility split becomes especially difficult when a single business system spans delivery modes—for example, an on-premises application using public cloud storage, or a SaaS application accessing regulated data in a private cloud or on premises.

To manage these interdependencies, a consistent security architecture is required that defines components that must exist regardless of delivery model, while clarifying who implements each component. The customer remains accountable for meeting business needs: it must ensure controls it owns meet standards and must assure CSP-implemented components meet requirements. KuppingerCole’s Hybrid Cloud Security Reference Architecture provides a building-block foundation and blueprint organized around six common elements—governance, management processes, risk management, standards, controls, and audit—applied consistently across all service planes. Risk management should use scenarios, assess likelihood and impact against risk tolerance, document decisions and residual risk in a risk register, and drive control selection and assurance activities, including independent certifications and attestations.

• Hybrid IT service delivery mixes on-premises, public cloud, private cloud, and/or hosting in a single integrated environment.
• Five distinct planes exist in the service delivery stack, from physical infrastructure up to governance of data and access.
• Three of the five planes correspond to cloud service models: IaaS, PaaS, and SaaS.
• In cloud services, the physical infrastructure plane is always the responsibility of the CSP.
• In IaaS, the customer is responsible for securing everything above the abstraction layer.
• In PaaS, the CSP is responsible for the tools and middleware used to build and deploy applications.
• In SaaS, the CSP is responsible for the business applications delivered as a service.
• Governance of business data, access to data/applications, and endpoint security are the responsibility of the customer.
• A risk management process includes scenario analysis, assessment of likelihood and impact, comparison to risk tolerance, selection of treatment, and assessment of residual risk.
• Independent certification is presented as the most practical way to assure CSP claims because customer-performed audits are often not feasible.

• “What is needed is a consistent approach with common processes supported by a single platform that provides all the necessary functions across all the various components involved in delivering all the services.”
• “It is vital that common governance approach is adopted that covers all IT services however they are delivered.”
• “There should be a common approach to managing risks across the organization and across the different IT service delivery models.”
• “The results of this risk assessment should be documented in a risk register.”
• “Security management processes and controls should be based on standards and best practices.”
• “Controls are measures that reduce either the probability of a threat succeeding in compromising an asset or reduce the impact if it does succeed.”
• “There is no such thing as perfect security; managing security is always a question of balancing risk against rewards.”
• “Since cloud services are outside the direct control of the customer independent assurance of the service provided is critical.”
• “In most cases it is not practical for CSPs to allow customers to perform their own audits.”
• “The objective of the assurance process is to confirm that the actual cloud service provided conforms to that which was agreed and that the security controls are operating correctly.”