Rackspace CSO: Work Together To Overcome Cloud Security Uncertainty

Do we have the capabilities to fight back against sophisticated threats like that?

Unfortunately, a lot of the technology that exists today are not up to the task. I think that's what really hits me. I truly believe that today security is inhibiting cloud adoption. It is the uncertainty for sure, but I think when you really look at it the cloud market grew so rapidly that we had to take the security technology that existed today and apply it. But, we're applying yesterday's technology to tomorrow's transformational technology. It's not going to work.

The third big initiative for me is to really take a fresh look at how do you deliver security in the cloud. We have to move away from appliances... That's an unsustainable model. I look forward to the day to when all these appliances go away. I'm very much interested in virtual security technologies that can be deployed quickly, that are more context aware and behavior based. I look forward to the day where we take that security features and functionalities and build it right into the operating system... I also see some of the security function and feature built onto the chip... There's no reason why we couldn't build key management and malware detonation and encryption and different things and put that right on silicon and right on the on metal platform and start to get rid of these appliances and make security technologies more in line and in real time. That, to me, is the game changer... I think that's where we need to go.

What else has to change?

I really want to see the major cloud providers in a more public way work together to share tactics and techniques and indicators of compromise. If the market sees that the cloud providers aren't just duking it out at their expense, but rather truly understand the transformational nature of cloud and are working together as industry peers to make sure that we make cloud as trustworthy as possible. I have confidence in my peers at the other major cloud providers that they think the same way. We're having conversations... I think we can get there. We're just in the early stages of the concept of [information sharing] but the technology platform has been built and we've had the first couple of conversations around how this would work. We're probably a couple of months away from having a fully functional information sharing model for the cloud providers, but that's not too far away. I'm kind of excited about it.

I think if we do a better of a job of these things that we're talking about: evening out the handshake with customers, making sure that we truly have advanced detection and response capabilities on behalf of our customers, we don't look back and try to throw security boxes at things and really try to think anew about how you deliver security in the cloud, and in the interim we better be sharing information quickly with one another. I think if we can do those things over the next few years, that 10 percent cloud adoption should change pretty radically.

There's been some tension between the security industry and the government about information sharing. Is this something that there's a role for government in, or should they be hands off?

I don't think it's ever worked – it's unfortunate. Obviously, with the Snowden matter and the NSA, there's just a negative stigma. It's unfair. Having been a guy that was there on that side, they're all good people with good intentions that do the right thing. But, I think the negative perceptions are just so great and too difficult to overcome. I don’t know that the government is really going to help the information sharing. This is a case where they're best to just get out of the way and allow the private sector to do it... I think the private sector can do it on their own. There's enough understanding at this point.

Are people realizing the value of that? Are people starting to change their perceptions of the cloud as insecure?

Not in a big way. I'm talking about it a lot and I've had the good fortune spending time with some customers sharing some of the views and their eyes open up wide. It really gets their attention...We have a number of customers that want to get involved. I think they're still struggling with do we move to the cloud? Is it secure? Is it not secure? I don't know that they completely understand that the cloud industry has really moved pretty rapidly in this space and there is a lot more available to them...I truly think that cloud is more secure than probably most enterprises...It comes back to the uncertainty: they don't really know, they haven't had the experience, they're hesitant and it may be that their data, their equipment is still a pet. They just don't want to let it go...It will get there, it's just the uncertainty that causes it to move slowly. I think it's got a long way to go.