CLOUD SECURITY INNOVATORS – Q+A WITH GEORGE DO, CISO, EQUINIX

April 30, 2014

By Brandon Cook, director of product marketing (@BCookshow) Skyhigh Networks

We are incredibly excited to feature a Q+A session with George Do, CISO of Equinix, as the first in our new monthly Skyhigh Networks Cloud Security Innovators blog series. Every month we will interview a new maverick in the cloud security space who is taking an innovative approach to securing data and systems as business increasingly moves to the cloud.

Q: How do you view the cloud? Friend? Foe? Necessary Evil?

A: Friend – embrace the cloud or get left behind.

Q: What is the top security challenges surrounding cloud services?

A: The security posture of vendors, specifically the protection of customer data and reputation.

Q: Are there any advantages to using cloud apps as it relates to security?

A: A big benefit we see is availability – we have access from anywhere from almost any device at any time.

Q: For your industry, are there any specific privacy, regulatory or compliance requirement that make it more challenging to embrace the cloud?

A: Yes absolutely. Various (foreign) government regulations have strict requirements on the protection of data that are not friendly to cloud services. Separately, high-security environments are nervous about going to cloud based on their own risk profile. Cloud companies need to improve and attest to their security posture before nervous customers can come around.

Q: There is lot of press around “encryption” as the silver bullet to address security issues relating to the cloud? Do you see “encryption” as the panacea?

A: Encryption is one big piece of the solution only – certainly not a panacea. There are many other pieces that need focus and attention as well such as access control, reputation/brand protection, and security infrastructure.

Q: As you look into your crystal ball, how will cloud security evolve over the next 2-3 years?

A: This will be very interesting. I think companies will be slow to improve security unless there are significant headlines on data compromises / hacks. We’re seeing some of this now (think Heartbleed). In the end I think the cloud industry will get there, but it will take some time.

Q: It is said that every journey begins with a single step. What practical advice would you give to your peers as it relates to cloud security?

A: Step 1 is to get visibility as most companies don’t even have that right now. Then you need a program to manage the enforcement of policy that’s customized to the business.

Q: Where do you go for information regarding cloud security? Any particular websites, blogs, visionaries and publications you find particularly useful?

A: Skyhigh, SANS, US-CERT, and various security blogs.

Q: Moving beyond cloud, what’s the big concern for CISOs today – i.e., what kept you up last night?

A: The shift of data and users to cloud. Overall, I’m concerned with the speed of technology and lack of security architecture at various layers.

Q: What drives the compliance requirements for your business and how to ensure compliance in the cloud?

A: It’s really the business that drives compliance at Equinix such as SOX and ISO27001. Ensuring compliance in the cloud is a new challenge for us as it is with most other organizations. We recognize that and are beginning to put focus on it.

Q: What’s is your favorite book you have read recently?

A: Multiplies by Liz Wiseman. See more at: http://bit.ly/1lWqZaQ