The risk of data theft increases when that data is kept at multiple locations. It is also important to determine precisely what systems are involved, what data is stored on them and where the vulnerabilities are. As well as knowing which people within the organization actually have access to it. We check all that before migrating data to the cloud and moreover look to see if the information is still relevant for your organization, because data that doesn’t matter anymore can be deleted or archived. That may sound simple, but it isn’t. It demands clear and detailed policies that are actively maintained, policies that are moreover monitored so that the requisite evidence is available in the event of an audit or other inspection. The following solutions can be hugely helpful in restricting the risks to a minimum:

Identity & Access management (IAM)

It is unfortunately far from unusual: a malicious individual posing as an employee and trying to break into the environment, your SaaS application or some other resource. That becomes all the easier when an IT environment’s hybrid nature means it is located in multiple physical locations. A good IAM solution is a help, as it prevents the user database from becoming outdated and contaminated and makes it much easier to manage. Adding multi-factor authentication (MFA) reduces the risks of unauthorized access to your environment even further. This is already mandatory for various SaaS applications. A single sign-on dashboard, so that a user only needs to log in once to get access to all the business applications through a single secure interface, offers added value to your users in terms of both adoption and ease of use and enjoyment.

Data management, risk and compliance

The type of business information that poses the greatest risk is the unstructured dataset. This refers to data that is not stored in an application or database but can still reside on a multitude of platforms and locations: file servers, SharePoint environments, e-mail environments, OneDrive, GSuite or Office 365. Such data is often outdated, uncategorized and without any identifiable owner within the organization. The security risks can be resolved by a targeted audit. Intelligently measuring whether data is still being used can let us determine whether data is still relevant and ought to be retained. Classifying it intelligently lets us determine how important data is for your organization. Rights, roles and user groups are set up on that basis so that policies are supported and compliance requirements are met. Alerting can be introduced so that abnormal data usage is automatically reported and action can be taken in time. Data management can add significant value for complying with legislation and regulations, and for certifications and your own risk awareness.

Firewall and security monitoring

Good security naturally requires a good firewall and close monitoring of the network traffic. The Next Gen Firewall not only acts as a gatekeeper but is also capable of identifying suspicious traffic, backed up by behavioural analysis and artificial intelligence. Mapping the hybrid environment rigorously lets us set up targeted gatekeepers and determine what intelligence is needed at what points in the network. This type of enterprise security monitoring can also be purchased as a service. You will then get a high-quality and up-to-date implementation of your environment at an agreeable price. And yes, you will be completely unburdened.

There are numerous other solutions, of course, such as vulnerability management, which accurately detects vulnerabilities in your technology, software, configuration and policies. The take-home message here is that good security is crucial!
But before you purchase or rent a solution, it is important to have a proper vulnerability analysis of your existing components, processes, software and services. Only then will you know precisely what will help your organization.

This blog entry has covered the second pair of key issues in this series of posts on the pitfalls of hybrid IT management and recommendations for handling it. These blogs give information for everyone who has plans to change to a Hybrid-IT concept, or who already has a Hybrid-IT concept, but wonders if this still fits. The next blog post will be about two more core values, scalability and the systems admin workload.

Let’s assume that you purchase workplace packages as a service. Office 365 has high-quality SLAs, both in continuity and in security and functionality. The service is provided via the internet and linked to your internal systems. This service from Microsoft, the internet connection and the internal link to your systems all form a chain. To fully map out the risks for your primary processes, you will have to analyse the entire chain for continuity risks.

There are a number of questions you have to ask here:

1. 1. If this functionality fails, what is the threat to my primary process?
2. 2. How are the SLAs interrelated? If 100% uptime is guaranteed, but the internet line has an uptime of 99%, the service may have a certain level of downtime. Do I want this and, if not, how can I resolve it?
3. 3. Are the internal systems scaled for the continuity this service should provide? For example: which internal disruptions can prevent the entire organisation from sending emails? Examples are Firewall environments, Active Directory environments, power cuts, back-up and restore environments and procedures, etc.
4. 4. How can I manage these environments, who is responsible for them and who coordinates this? Is this management strategy compatible with the SLAs from the service provider and the most important aspect for you as a business: how do I remain in control?
5. 5. What is my continuity risk if my service provider goes bankrupt?

Responding to emergencies

When setting up their business continuity management, organisations often focus on the operational aspect, e.g. the presence of an alternative location in case of a calamity. However, these kinds of measures will only become effective once the critical business processes are disrupted. Simply responding to calamities is not sufficient. It is also about preventing calamities. Apart from operational measures, this requires forward thinking and a proactive approach. Business continuity is a strategic topic and must be discussed on a managerial level.

In conclusion: a proper risk analysis at all business levels is an absolute must when analysing the continuity of your IT environment. This will reveal all the risks and allows you to assign the right priorities to the various subjects. You can then map out all the mitigating measures. After all, you don’t just want to prevent risks; you also want to know what to do to minimise the consequences of these risks, should they become reality after all.

Outsourcing Hybrid IT environments

A growing number of organisations are currently opting for outsourcing constructions. For the vast majority, it is comforting to place the entire responsibility for IT as a service in the hands of a single party. This is obvious, as a hybrid IT environment has a higher risk in terms of assigning responsibilities if the service is disrupted. Choosing a single supplier generally makes the outsourcing process clearer and improves its quality, as such a party is specialised in this kind of service. Whatever client-specific wishes or processes they may face, it’s basically just more of the same to them. And this in turn benefits the continuity of the client organisation.
And its performance.

In this blog we discussed the first two core values pitfalls and recommendations in Hybrid IT management. This blog is part of a series. These blogs give information for everyone who has plans to change to a Hybrid-IT concept, or who already has a Hybrid-IT concept, but wonders if this still fits. In the next blog the core values safety and complience will be discussed.

The computerisation of processes continues relentlessly: the future is digital. It forces companies to view their own organisation in a different light. Where can I gain efficiency, what are the risks and how can I keep my primary process under control? These issues are nothing new as such, but they have gradually become IT-related issues. The question is: is your business set up for this? Is your IT infrastructure ready for the future?

Six core values

Every company pursues the following six core values: maximum continuit and performance, maximum security and compliance, and last but not least ahoge high level of scalability with minimum management constraints. These core values are as old as the business community itself. But because IT is increasingly becoming a determining factor for business processes, these processes are more and more approached from an IT perspective.

In practice, this has resulted in a greater demand for technology that can share resources. Examples are hard- and software virtualisation, shared back-up resources, shared internet connectivity and shared email environments. Today’s IT environments are built to comply with these six core values.

Cloud technology has accelerated this enormously. The cloud is popular, because it adds value in both the short and the long term. SaaS services are scalable, do not require investment of capital and give you easy access to “enterprise-grade” systems. All of this is at a fraction of the costs (you only pay what you purchase) and without any worries for system management and maintenance. You can adapt to changing business needs and market conditions at lightning speed. The functionalities can be set up and provided in-house or purchased as a service via the internet. “IT ready-made”: easy, effective and affordable.

Despite this, a cloud-based model is not always automatically the best solution for your business. Perhaps one size fits all does not apply to you; you may have application environments that cannot be migrated to the cloud (yet) for whatever reason. You may, for example, want to maintain control over certain data. Data that is unique to your organisation. Data that is essential to your business processes and mission, and that you want to keep in your own IaaS environment. You would like to keep part of it on-premise.

This gives birth to the concept of Hybrid IT: a mix of in-house and cloud-based services that offers the best of both worlds: the ease, the flexibility and the cost and collaboration benefits of a cloud platform, and the control and easy accessibility of having your own server. Choose the most suitable application for each workload and put your data in the best location in terms of security or regulations. Use the cloud for the rapid development and testing of prototypes before storing them in the private environment and using them. For many organisations, Hybrid IT is the best way to keep up with the rapid digital transformation.

This does not change the questions you need to ask yourself. Where can I gain efficiency, what are the risks and how can I keep my primary process under control? What is your Hybrid IT solution’s score for the six core values mentioned: continuity, performance, security, compliance, scalability and management constraints? This will decide your company’s success.

In the coming period I will be writing a blog for each core value with the following approach: pitfalls and recommendations for Hybrid IT management. They are meant for anyone who is planning to switch to a Hybrid IT concept, or who already has a Hybrid IT concept but is wondering whether it is (still) a good match.

I hope you find them enjoyable to read!