1 1 00:00:00,480 --> 00:00:02,790 Cloud-based infrastructure. 2 2 00:00:02,790 --> 00:00:06,180 Now, most organizations see their future in the cloud, 3 3 00:00:06,180 --> 00:00:08,190 but it's actually a riskier choice 4 4 00:00:08,190 --> 00:00:10,080 than traditional client server applications 5 5 00:00:10,080 --> 00:00:12,570 running on a local network in most cases. 6 6 00:00:12,570 --> 00:00:14,580 If you don't configure the cloud properly 7 7 00:00:14,580 --> 00:00:16,770 you can have a lot of danger. 8 8 00:00:16,770 --> 00:00:18,360 Now, you can configure your cloud 9 9 00:00:18,360 --> 00:00:20,580 to provide just as great security 10 10 00:00:20,580 --> 00:00:22,980 as your traditional client server applications, 11 11 00:00:22,980 --> 00:00:25,020 but it does take some knowledge. 12 12 00:00:25,020 --> 00:00:25,890 This is what we talk about 13 13 00:00:25,890 --> 00:00:27,720 when we talk about cloud infrastructure. 14 14 00:00:27,720 --> 00:00:28,980 We need to make sure that we're doing 15 15 00:00:28,980 --> 00:00:30,570 our infrastructure management properly, 16 16 00:00:30,570 --> 00:00:32,010 and configuring it to the same level 17 17 00:00:32,010 --> 00:00:34,020 of security as a local solution. 18 18 00:00:34,020 --> 00:00:36,210 Now, one of the biggest places that we have to think about 19 19 00:00:36,210 --> 00:00:40,050 when we do this is virtual private clouds, or VPCs. 20 20 00:00:40,050 --> 00:00:42,210 Just like you can use your virtual private networks 21 21 00:00:42,210 --> 00:00:44,670 to connect your home users back to your corporate network 22 22 00:00:44,670 --> 00:00:46,110 and give them those protections 23 23 00:00:46,110 --> 00:00:47,880 underneath that corporate umbrella, 24 24 00:00:47,880 --> 00:00:49,980 virtual private clouds can be configured 25 25 00:00:49,980 --> 00:00:52,560 as a private network segment made available 26 26 00:00:52,560 --> 00:00:55,590 to single cloud consumers within a public cloud. 27 27 00:00:55,590 --> 00:00:57,900 This is a way that we give security. 28 28 00:00:57,900 --> 00:01:01,620 VPC is considered an infrastructure as a service product. 29 29 00:01:01,620 --> 00:01:03,570 So if you're using something like AWS, 30 30 00:01:03,570 --> 00:01:05,850 they have a virtual private cloud service. 31 31 00:01:05,850 --> 00:01:06,720 If you're using Azure, 32 32 00:01:06,720 --> 00:01:09,150 they have their virtual private cloud service. 33 33 00:01:09,150 --> 00:01:11,100 And virtual private cloud services 34 34 00:01:11,100 --> 00:01:13,530 let you provision virtual servers and appliances 35 35 00:01:13,530 --> 00:01:17,100 within a virtual network that's hosted on a public cloud. 36 36 00:01:17,100 --> 00:01:19,080 So we can try to get some of that security 37 37 00:01:19,080 --> 00:01:22,470 of a private cloud without all that extra expense. 38 38 00:01:22,470 --> 00:01:25,320 Now, is this as secure as a private cloud? 39 39 00:01:25,320 --> 00:01:28,290 No, because we're still using shared hardware 40 40 00:01:28,290 --> 00:01:29,220 and there could be issues 41 41 00:01:29,220 --> 00:01:30,750 like data remnants being left behind 42 42 00:01:30,750 --> 00:01:33,090 on a server from being provisioned or deprovisioned, 43 43 00:01:33,090 --> 00:01:36,300 but from a networking perspective and a privacy perspective 44 44 00:01:36,300 --> 00:01:40,440 you can get equivalent levels of protection using VPC. 45 45 00:01:40,440 --> 00:01:43,290 Now, as a consumer, you're responsible for configuring 46 46 00:01:43,290 --> 00:01:46,350 the IP address space and routing within that cloud 47 47 00:01:46,350 --> 00:01:48,360 when you do virtual private clouds. 48 48 00:01:48,360 --> 00:01:50,040 You're going to handle all the administration 49 49 00:01:50,040 --> 00:01:52,500 and all the security aspects of running the network 50 50 00:01:52,500 --> 00:01:54,210 just as if it was your own. 51 51 00:01:54,210 --> 00:01:56,010 You're going to have to do all the software installation, 52 52 00:01:56,010 --> 00:01:57,990 all the patching, all the account management, 53 53 00:01:57,990 --> 00:02:00,450 all the load balancing, all the disaster recovery, 54 54 00:02:00,450 --> 00:02:02,970 all the security monitoring, all the backups. 55 55 00:02:02,970 --> 00:02:04,410 All of that has to be configured, 56 56 00:02:04,410 --> 00:02:06,540 because when you're doing a virtual private cloud, 57 57 00:02:06,540 --> 00:02:09,120 it's essentially like you own these servers. 58 58 00:02:09,120 --> 00:02:11,730 The only difference is you don't actually own the servers 59 59 00:02:11,730 --> 00:02:14,100 and you don't have access to the physical hardware. 60 60 00:02:14,100 --> 00:02:17,190 Instead, you're going to be able to use these different servers 61 61 00:02:17,190 --> 00:02:20,460 and spin them up, and spin them down, whenever you need to, 62 62 00:02:20,460 --> 00:02:23,490 meaning provisioning them or deprovisioning them. 63 63 00:02:23,490 --> 00:02:25,890 Now, when we talk about a virtual private network 64 64 00:02:25,890 --> 00:02:28,950 it's hosted on publicly available cloud services. 65 65 00:02:28,950 --> 00:02:32,130 This is things like Amazon Web Services, Microsoft Azure, 66 66 00:02:32,130 --> 00:02:34,920 Google Cloud, but you're going to be isolated 67 67 00:02:34,920 --> 00:02:37,680 from other customers' instances using technologies 68 68 00:02:37,680 --> 00:02:40,380 such as virtual lans or VLANs. 69 69 00:02:40,380 --> 00:02:42,150 And you can also use other things like this 70 70 00:02:42,150 --> 00:02:44,640 as you're building out your virtual private cloud. 71 71 00:02:44,640 --> 00:02:46,890 Now, like I said, a virtual private cloud 72 72 00:02:46,890 --> 00:02:49,170 doesn't give you the exact same level of security 73 73 00:02:49,170 --> 00:02:50,520 as a private cloud, 74 74 00:02:50,520 --> 00:02:52,950 but it doesn't come with the high cost either. 75 75 00:02:52,950 --> 00:02:54,420 By using a virtual private cloud, 76 76 00:02:54,420 --> 00:02:57,240 it's going to be less expensive than using a private cloud 77 77 00:02:57,240 --> 00:02:58,650 and you're not going to have to own 78 78 00:02:58,650 --> 00:03:00,750 and operate the entire cloud service, 79 79 00:03:00,750 --> 00:03:02,250 or the hardware underneath it. 80 80 00:03:02,250 --> 00:03:04,350 So you're getting some of those security benefits, 81 81 00:03:04,350 --> 00:03:06,660 but not all those security benefits. 82 82 00:03:06,660 --> 00:03:08,700 When we talk about a virtual private cloud 83 83 00:03:08,700 --> 00:03:10,920 a virtual private cloud is typically going to be used 84 84 00:03:10,920 --> 00:03:12,690 to provision internet accessible 85 85 00:03:12,690 --> 00:03:14,250 customer facing applications, 86 86 00:03:14,250 --> 00:03:16,950 or corporate applications that need to be accessed 87 87 00:03:16,950 --> 00:03:19,020 from geographically remote sites. 88 88 00:03:19,020 --> 00:03:21,030 If you're thinking of something that might be a good place 89 89 00:03:21,030 --> 00:03:23,190 inside a DMZ, a virtual private cloud 90 90 00:03:23,190 --> 00:03:25,650 might be a good place to put it as well. 91 91 00:03:25,650 --> 00:03:27,060 Now, the last thing we need to think about 92 92 00:03:27,060 --> 00:03:28,980 when we talk about cloud-based infrastructure 93 93 00:03:28,980 --> 00:03:31,440 is cloud versus on-premise. 94 94 00:03:31,440 --> 00:03:32,910 Now, what is the difference? 95 95 00:03:32,910 --> 00:03:34,230 Well, when you deal with the cloud 96 96 00:03:34,230 --> 00:03:36,570 you're putting it in somebody else's data center. 97 97 00:03:36,570 --> 00:03:38,730 You're putting it someplace where you're just seeing it 98 98 00:03:38,730 --> 00:03:41,280 as a virtual instance some place on the internet, 99 99 00:03:41,280 --> 00:03:42,900 you don't actually get to go touch that thing. 100 100 00:03:42,900 --> 00:03:45,600 You don't know if it's in Virginia, or London, 101 101 00:03:45,600 --> 00:03:48,360 or Washington, or even really care a lot of times, 102 102 00:03:48,360 --> 00:03:51,060 because you just care that you have access to it. 103 103 00:03:51,060 --> 00:03:52,770 That's the benefit of having the cloud, 104 104 00:03:52,770 --> 00:03:54,510 it's everywhere you want to be. 105 105 00:03:54,510 --> 00:03:56,220 Now, when you deal with on-premise, 106 106 00:03:56,220 --> 00:03:58,650 this means it's something in your own data center. 107 107 00:03:58,650 --> 00:04:01,590 You can walk down the hall and you can touch those servers. 108 108 00:04:01,590 --> 00:04:03,270 A lot of the places I've worked over the years 109 109 00:04:03,270 --> 00:04:05,340 we've run our own data centers. 110 110 00:04:05,340 --> 00:04:06,510 Now, these days, we're starting to use 111 111 00:04:06,510 --> 00:04:09,180 more and more cloud resources, but for the last 20 years 112 112 00:04:09,180 --> 00:04:10,590 I have spent a lot of time, 113 113 00:04:10,590 --> 00:04:14,220 and a lot of organizations spending tons and tons of money 114 114 00:04:14,220 --> 00:04:16,560 millions and millions and millions of dollars 115 115 00:04:16,560 --> 00:04:19,590 building out data centers and running our own servers. 116 116 00:04:19,590 --> 00:04:21,570 Now, there is some benefits to having cloud, 117 117 00:04:21,570 --> 00:04:23,580 and there's some benefits of having on-premise. 118 118 00:04:23,580 --> 00:04:25,530 When you deal with on-premise solutions, 119 119 00:04:25,530 --> 00:04:27,330 you're going to maintain your servers locally 120 120 00:04:27,330 --> 00:04:28,410 within your network. 121 121 00:04:28,410 --> 00:04:30,360 That means you're going to be able to touch them. 122 122 00:04:30,360 --> 00:04:32,850 It also means you're responsible for when they break. 123 123 00:04:32,850 --> 00:04:34,230 That means when a server goes down, 124 124 00:04:34,230 --> 00:04:35,220 you're going to be the one waking up 125 125 00:04:35,220 --> 00:04:38,190 at two in the morning to go replace that hard drive. 126 126 00:04:38,190 --> 00:04:39,780 When you're dealing with an on-premise solution 127 127 00:04:39,780 --> 00:04:42,030 you own the entire thing from software, 128 128 00:04:42,030 --> 00:04:44,310 all the way down to nuts and bolts of the hardware. 129 129 00:04:44,310 --> 00:04:45,690 That is a good thing in some cases 130 130 00:04:45,690 --> 00:04:46,830 because you can own the whole thing 131 131 00:04:46,830 --> 00:04:48,330 and configure however you want. 132 132 00:04:48,330 --> 00:04:50,250 It's also bad because it's a major support headache, 133 133 00:04:50,250 --> 00:04:54,330 and a huge capital expense for your organization. 134 134 00:04:54,330 --> 00:04:56,640 Now, a lot of security products that you have out there 135 135 00:04:56,640 --> 00:04:59,370 can be used as either cloud-based or on-premise. 136 136 00:04:59,370 --> 00:05:00,203 And we've already talked about 137 137 00:05:00,203 --> 00:05:01,650 a lot of the benefits of the cloud, right? 138 138 00:05:01,650 --> 00:05:03,000 They're infinitely expandable, 139 139 00:05:03,000 --> 00:05:04,350 there's lots of storage out there, 140 140 00:05:04,350 --> 00:05:05,550 there's ultimate bandwidth, 141 141 00:05:05,550 --> 00:05:07,320 and you only pay for what you use. 142 142 00:05:07,320 --> 00:05:09,300 Well, with a lot of these security products 143 143 00:05:09,300 --> 00:05:12,030 you have a cloud-based version, or an on-premise version. 144 144 00:05:12,030 --> 00:05:14,550 And you have to decide which one you want to use. 145 145 00:05:14,550 --> 00:05:16,200 Now, which one is right? 146 146 00:05:16,200 --> 00:05:18,780 Well, that depends on what you want to do. 147 147 00:05:18,780 --> 00:05:21,960 Some of these have some real benefits by doing cloud-based. 148 148 00:05:21,960 --> 00:05:23,280 They might be more cost effective, 149 149 00:05:23,280 --> 00:05:24,420 they might be cheaper. 150 150 00:05:24,420 --> 00:05:26,100 You don't have to have dedicated hardware, 151 151 00:05:26,100 --> 00:05:28,890 dedicated local processing, dedicated local storage. 152 152 00:05:28,890 --> 00:05:30,270 All of those things add cost, 153 153 00:05:30,270 --> 00:05:32,430 and so you can offload all that to the cloud 154 154 00:05:32,430 --> 00:05:35,490 and just basically point your things to that cloud server 155 155 00:05:35,490 --> 00:05:37,680 and let it do all of the work for you. 156 156 00:05:37,680 --> 00:05:39,990 Now, why might you want to use on-premise? 157 157 00:05:39,990 --> 00:05:42,360 Well, maybe you're worried about the security of that data 158 158 00:05:42,360 --> 00:05:43,350 and you don't want that data 159 159 00:05:43,350 --> 00:05:45,240 being outside your corporate network. 160 160 00:05:45,240 --> 00:05:47,670 That would be a reason for using on-premise. 161 161 00:05:47,670 --> 00:05:48,660 Now, one of the big reason 162 162 00:05:48,660 --> 00:05:50,220 that a lot of these security softwares 163 163 00:05:50,220 --> 00:05:52,410 are starting to move to cloud-based solutions 164 164 00:05:52,410 --> 00:05:56,790 is you can do better use of AI and machine learning, why? 165 165 00:05:56,790 --> 00:05:58,080 Because AI and machine learning 166 166 00:05:58,080 --> 00:05:59,670 takes huge amounts of processing 167 167 00:05:59,670 --> 00:06:01,920 and huge amounts of banks of resources. 168 168 00:06:01,920 --> 00:06:03,480 And most people don't have that 169 169 00:06:03,480 --> 00:06:05,370 as a part of their on-premise solution. 170 170 00:06:05,370 --> 00:06:07,740 So instead, by moving this all to the cloud 171 171 00:06:07,740 --> 00:06:10,530 it makes it easier to integrate with artificial intelligence 172 172 00:06:10,530 --> 00:06:13,140 and machine learning to do deeper data integration 173 173 00:06:13,140 --> 00:06:14,880 and automated analysis. 174 174 00:06:14,880 --> 00:06:16,650 Now, if you're going to move to the cloud, 175 175 00:06:16,650 --> 00:06:18,240 what do you need to consider? 176 176 00:06:18,240 --> 00:06:20,070 Well, you need to consider any compliance 177 177 00:06:20,070 --> 00:06:21,810 and regulatory limitations. 178 178 00:06:21,810 --> 00:06:23,580 Sometimes you're going to have limitations 179 179 00:06:23,580 --> 00:06:26,250 of storing data in a cloud-based security system. 180 180 00:06:26,250 --> 00:06:27,300 Depending on the rules, 181 181 00:06:27,300 --> 00:06:29,970 you may have to have an on-premise solution. 182 182 00:06:29,970 --> 00:06:31,170 Now, in addition to this, 183 183 00:06:31,170 --> 00:06:33,600 there are other issues you have to consider as well. 184 184 00:06:33,600 --> 00:06:35,880 For example, if you move to a cloud-based solution 185 185 00:06:35,880 --> 00:06:37,530 instead of an on-premise solution, 186 186 00:06:37,530 --> 00:06:39,480 you may be subject to vendor lock-in. 187 187 00:06:39,480 --> 00:06:41,040 I've seen this with some companies. 188 188 00:06:41,040 --> 00:06:42,690 They've moved to something where it's based 189 189 00:06:42,690 --> 00:06:44,250 on the amount of terabytes that you store 190 190 00:06:44,250 --> 00:06:45,420 inside their server. 191 191 00:06:45,420 --> 00:06:46,470 And it can start adding up 192 192 00:06:46,470 --> 00:06:49,140 to be really, really expensive really quickly. 193 193 00:06:49,140 --> 00:06:51,360 And so that can now get you locked into that vendor, 194 194 00:06:51,360 --> 00:06:52,590 because they have all your data. 195 195 00:06:52,590 --> 00:06:54,510 And to get out, it's going to cost you 196 196 00:06:54,510 --> 00:06:56,640 hundreds of thousands of dollars in bandwidth 197 197 00:06:56,640 --> 00:06:58,710 and usage fees to move it from this cloud 198 198 00:06:58,710 --> 00:07:01,590 to your on-premise, or this cloud to that cloud. 199 199 00:07:01,590 --> 00:07:03,390 And so you can get this vendor lock-in problem 200 200 00:07:03,390 --> 00:07:05,070 that can happen, and it's very real. 201 201 00:07:05,070 --> 00:07:07,680 So when you're designing your cloud-based infrastructure 202 202 00:07:07,680 --> 00:07:09,990 always think, "What's going to be best for me today? 203 203 00:07:09,990 --> 00:07:12,270 And what's going to happen down the road?" 204 204 00:07:12,270 --> 00:07:14,160 Because a lot of services will give you 205 205 00:07:14,160 --> 00:07:16,290 a very low upfront cost, but then they'll get you 206 206 00:07:16,290 --> 00:07:19,140 on the backside when you try to move to another provider.