Day Two Cloud 124: New Cloud Security Thinking

Today on Day Two Cloud, we talk about new ways of thinking about security for cloud. As organizations adopt  cloud services, they’re applying on-prem security designs to cloud. Our guest is here to argue that this doesn’t work, and that you need a different approach. Our guest is Adeel Ahmad, Implementation Services Lead at Hashicorp. This is not sponsored show, and Adeel is speaking for himself. We discuss: * The mistaken assumption that cloud security operates the same as on-prem * Why identity controls are essential to get right * Focusing on risk * Compliance complications * Hybrid and multi-cloud security challenges * More Takeaways: Aim for architectural simplicity of the platform (allows for scale). Aim to reduce operational complexity (or avoid operational hazards) – (allows for distributed self-service cloud provisioning). Understand the principle (business or compliance) risk and question whether stipulated controls add any value. Sponsor: Aviatrix Check out Aviatrix’s Flight Training to learn about multi-cloud networking and security. It’s worth your time if you’re defining your company’s multi-cloud strategy or want to nail down your Aviatrix Certified Engineer certification. Get details and register at aviatrix.com/flight-training. Show Links: @devops_adeel – Adeel Ahmad on Twitter Adeel Ahmad on LinkedIn Transcript: [00:00:00.190] – Ethan Check out sponsor aviatrix’s Flight Training to learn about multicloud networking and security from the Avaitrix perspective, aviatrix dot com slash flight-training worth your time if you’re defining your company’s multicloud strategy or want to nail down your Aviatrix certified engineer Cert. Aviatrix dot com slash flight-training. [00:00:25.950] – Ethan Welcome to Day Two Club Strap in, everybody. This show is basically getting on the back of a rocket ship and going for a ride. Our guest today is the deal, Adeel Ahmad, and we are talking about new security thinking for Cloud. And the big idea here is a lot of folks are trying to take the security designs that they had built for an on Prem environment and apply them to Cloud and Adeel’s arguing very well I might add, that that doesn’t work, and that’s a dumb idea, and that can actually lead to problems. [00:00:53.630] – Ethan And we need to rethink how we do security in Cloud and the rocket ship part is Adeel’s brain because the man is full throttle all the way. Wouldn’t you agree, Ned? [00:01:02.640] – Ned I would. And I don’t want to belabor the point. I don’t want to ramble on my own because Adeel has got so much to say. All I want to say is he asks two critical questions that everyone should be asking the why and the so what? And if you’re not sure what that means, you will find out in this episode. [00:01:19.550] – Ethan Enjoy this episode with Adeel Ahmad Implementation Services lead at HashiCorp. Adeel Ahmad, Welcome to the Day Two Cloud podcast. It’s fun to talk to you, man. I got to say, because I’ve listened to a couple hours of you on the hashicast where you were talking about a lot of these security ideas. Ned’s listened to them as well. So we’re both pretty keen to dive into some of these concepts some more. But before we do that, you got to tell us, who are you? What do you do? [00:01:49.870] – Adeel Hi, Ethan. My name is Adeel. I’m from the UK. London. I work for HashiCorp.