It's Not About Trust, It's About Proof

Context 

Enterprises are increasingly consuming services from cloud and managed service providers of all shapes and sizes – from global providers offering a broad portfolio of services to regional and local boutique providers focused on serving a specific vertical or offering a unique set of specialized services to a broader audience. Consuming IT as a service offers enterprises an abundance of benefits, including scalability, flexibility, agility, access to a broad range of skills and expertise, cost optimization, and increased efficiencies. These benefits often come at a cost, however.

As cloud and service consumption increase, organizations are steadily surrendering control and visibility of their overall IT ecosystems. But enterprises are losing faith in the traditional 'black box' approach of many service providers. With the rise of high-profile attacks on local and global cloud and service providers, a gap in trust between service providers and enterprises may be growing.

Trust in cloud and service providers is dependent on proof, not promises. Enterprises are now insisting on the ability to inspect and monitor service providers first-hand, rather than relying exclusively on third-party point-in-time attestations. Enterprises are seeking to confirm that their data, applications, systems, and users are protected against loss, outages, threats and breaches. On a more fundamental level, enterprises want to know if the tools, controls, processes, procedures and safeguards a service provider has in place are working as intended, and that service providers are delivering on their promises.

The Quest for Proof

The Russian proverb 'trust, but verify' was made famous by US president Ronald Reagan in the late 1980s. That same phrase is frequently used in information technology and cybersecurity to describe the due diligence organizations should take when leveraging services and cloud-based technologies. However, for many organizations, that approach often fails in today's fast-paced digital world. For a growing number of organizations, it is not about trust at all; it is all about being able to verify. And with breaches becoming so prevalent and devastating, the new proverb for many organizations is quickly becoming 'never trust, always verify… then verify again.'

Enterprises want confidence that cloud and service providers are delivering an ecosystem that has the right controls in place, and that those controls are operating effectively and consistently to safeguard and protect the organization's assets. While service providers are increasingly advertising and boasting about increased transparency in their services, enterprises report that service providers are not delivering the level of transparency they desire. Organizations are increasingly seeking answers to questions like:

• Who has accessed my data and systems, both physically and virtually – why and when? Enterprises are calling for cloud and service providers to prove that access has been permitted according to policy, has been vetted, and is not abused. Service providers need to make certain that they can provide fine-grain proof about access to customer systems and data: Who is accessing the asset, where are they connecting from, is it a safe connection, do they have privileges that are in-line with their normal pattern of access, are they accessing the asset within an expected time window, and what did they do while they had access?
• Where is my data located right now? Having a choice in data residency is common among public IaaS cloud providers to meet a growing number of regulatory and privacy requirements. While many cloud providers do not disclose in which particular datacenter an organization's data may reside, they often attest to the region or country in which the data is located. However, as data may move within a region or country at the service provider's discretion, enterprises are beginning to ask for real-time and historic location-specific information concerning their digital assets. Data-residency options tend to be less common with SaaS providers and managed service providers, but are increasingly requested by enterprises.
• In the event of a security incident, when was the incident detected, who performed the analysis, how long did it take before triage began, and what is the current state of investigation and remediation? While cloud providers are more likely to detect compromises in the cloud infrastructure or platform, managed service providers will – or should – most likely detect incidents in the infrastructure, applications and data under their management. Regardless of the provider, enterprises report that they only see what is escalated to them, typically without any context or explanation, leaving the organization in the dark for hours, days or even weeks after an event. Even after an event, many enterprises are still unsure about what happened and the extent to which they are affected. MSSPs, in particular, are singled out by enterprises in this regard, stating that security investigations are often performed in a black box with little to no visibility into ongoing investigations, the rationale or the methods used.

Enterprises are also seeking to verify operations around areas like data deletion, data collection and sharing, encryption, privacy, and performance. This may be particularly relevant in industry verticals such as healthcare, where compliance with regulations such as the Health Insurance Portability and Accountability Act (HIPAA) may be required.

The ever-evolving IT ecosystem and threat landscape of today's modern enterprises has made the 'trust, but verify' approach to IT obsolete. Many enterprises are shifting strategies to a zero-trust model that explicitly distrusts everything and everyone by default – every user, device and application, including cloud and service providers. Provable cybersecurity controls and IT service delivery are quickly becoming a mandate for enterprises. Cloud and service providers that can provide organizations with expanding abilities to inspect and investigate the promises of the services being delivered should find themselves at a competitive advantage in the marketplace.