I had a few emails, and a comment on the site that indicate that people are still not entirely on board with cloud-based services. Security, security, security. Security is the issue that most people bring up as the reason for being cautious. It could be access to their information, it could be becoming a target for hacking, or it could be controls over their environment.
Is there any difference in your decision making when you consider a Virtual Machine environment (infrastructure as a service) vs. database services (and others)? When we first made the move, we considered the VM approach to be the most controlled, but it was all because of our own history and our own comfort-level with the technology.
It was based in control. Since we’re responsible for the instances, we can lock it down as only we know how to… right?
Is the type of implementation in the cloud important to your consideration? Have you worked through options to determine the differences?
I ask because I suspect the commenter on the site (thanks Dennis) wouldn’t care WHAT manner of implementation is done in the cloud, it’s just not ready for their systems yet.
From what I’ve seen, if you take a step back and implement best practices from the vendor and work through really understanding what’s happening and where the remaining issues may be, it can be incredibly secure and controlled. But the process, especially with that first implementation, can be surprisingly complex. There can be many moving parts to work with and consider, and best practices around each.
For example, if you’re setting up a system on AWS, data on S3 can be encrypted at rest, but you need to think about all of the moving parts – from where and how you host the site, to data collection, to data transmission to the database… The same issues we’ve talked about (data in transit, data at rest, data access) – and the answers will likely be different in the cloud.
I suspect this may be an area that bites some of us. Understanding that each of these needs to be re-considered and thought through. How is it done, what’s the best way, what are the downsides of the choice…
We made choices based on our own on-premises environment first. That was a huge mistake, we made assumptions that what we had been doing on-premise and co-located would be best as a VM, best in a SaaS environment. We ended up with gaping issues for access (some too much control, some needed to be tightened).
I say all of this because I’m curious if the type of cloud environment impacts your choices and opinions about moving an application to the cloud… does it help or hurt? Virtual machines, PaaS, SaaS, etc. What’s your weapon of choice?