Words to go: Multi-cloud security strategy

Multi-cloud is the use of more than one cloud service, and it is becoming a popular option for enterprises.

A combination of cloud services can provide greater reliability. If one cloud platform fails, enterprises still have other available cloud services that can minimize downtime and data loss.

From a security perspective, multi-cloud can be either a blessing or a curse. With multiple providers, like AWS, Microsoft Azure or Google Cloud Platform, there are a greater variety of security precautions already in place. However, this also means that the security teams using these platforms have a more complex task in front of them.

Before security professionals get started on the task of securing a multi-cloud deployment, they should familiarize themselves with this list of terms related to multi-cloud security:

Multi-cloud strategy: A multi-cloud strategy is the use of two or more cloud services, and it can be any combination of SaaS, PaaS and IaaS. The more popular option is a mix of public IaaS services, like AWS or Microsoft Azure.

Multi-cloud can be used strategically to prevent downtime, limit data loss, achieve broader business goals, avoid vendor lock-in and help organizations comply with the laws, regulations and policies to which they are subject. One of the drawbacks of a multi-cloud strategy is the need to secure the deployment of multiple services from multiple cloud providers.

Cloud service provider: A cloud service provider is a company that offers some component or components of cloud computing to enterprises. The three major types of cloud providers are SaaS, PaaS and IaaS.

While there are a variety of cloud service providers, the three biggest are the public cloud providers AWS, Microsoft Azure and Google Cloud Platform. A multi-cloud strategy could use a combination of these providers, as well as others in the industry.

Cloud computing security: Securing cloud services is particularly important for enterprises that use any type of cloud deployment. It will not only keep data, applications and networks safe from attackers, but it will also help organizations comply with regulations, laws and policies. In any cloud deployment, it is necessary to protect and control identity and access management within the cloud, as well as in cloud networks and any data stored in the cloud.

It's also prudent for organizations to have cloud incident response plans in place in case of an attack or breach. Cloud computing security is more complex in a multi-cloud environment, as there are more resources to protect and multiple security policies to work with.

Vendor lock-in: Vendor lock-in is considered an early driver of multi-cloud adoption. It's a situation in which it is difficult to transition to a competitor's product or service from the product or service currently in use.

For example, an organization's IT leaders may feel that one cloud service provider didn't meet all their business needs, but that moving completely to a different provider would be too cumbersome. If an organization is dealing with vendor lock-in for cloud services, it may also stem from data being altered in the process of moving from one cloud provider back to the on-premises environment and onto the new cloud provider.

In a multi-cloud environment, enterprises don't have to worry about getting stuck with one cloud provider because they strategically use multiple providers already.

Cloud access security brokers: Cloud access security brokers, or CASBs, can be particularly useful for securing multi-cloud environments. A CASB is a software tool that acts as a gatekeeper between an organization's on-premises environment and its cloud services.

CASBs, which have mostly been acquired by bigger security companies, ensure that security policies are the same across the different cloud services an organization uses. They also help with access controls, including encryption and device profiling.

Hybrid cloud: Hybrid cloud is similar to multi-cloud and is often confused for it, but they have different IT infrastructure models. Hybrid cloud, which primarily takes advantage of only two different platforms, uses a mix of on-premises cloud, private cloud and third-party public cloud services with orchestration between the two platforms.

Hybrid cloud is useful for organizations looking to achieve a particular task on premises but also use the cloud when there is a greater compute demand for that task. Multi-cloud is more of a general approach to structuring, managing and paying for cloud services. Hybrid cloud and multi-cloud environments are not mutually exclusive, though.

Multi-tenant cloud: Multi-tenant cloud is not to be confused with multi-cloud. Multi-tenant cloud is a cloud architecture that enables organizations to share cloud computing resources in a public or private cloud. While multiple organizations -- called tenants -- use the same cloud service, their data will remain isolated and invisible to the other tenants.