Why security shouldn’t be a barrier to migrating SAP to public cloud

Public cloud is already at the heart of the modern business IT environment – and demand shows no signs of waning. Worldwide, the public cloud services market is forecast to grow 6.3% in 2020, to total $257.9 billion, up from $242.7 billion in 2019, according to Gartner.

This growth is perhaps unsurprising, considering the well-publicised advantages of public cloud technology. An unparalleled platform for innovation, agility and performance, public cloud solutions are widely known to sustainably support growth, offering scalable pricing and capacity to support the evolving workloads on an organisation’s digital journey.

Security: the missing benefit

Ask an IT leader to describe what public cloud can offer, and you might get a description similar to the one above. There’s nothing inherently wrong with this explanation, but there’s often one important item that’s omitted: “security”.

Put simply – many organisations doubt public cloud’s ability to secure data. According to our own research, Barriers to SAP on Public Cloud,43% of organisations see security as an obstacle to migrating their SAP workloads from on-premises.

Commonly cited concerns include intra-server security and the level of protection that the cloud can provide. Some are concerned about location and whether the public cloud provider’s protocols can ensure information is protected and readily accessible. Others are conscious of data backups, restoration and portability, and the processes of the cloud provider in these areas.

Dispelling the myths

Looking at the security protocols that hyperscalers have built into their offerings, these objections don’t hold up to scrutiny. Today’s leading public cloud firms offer a formidable array of cyber security defences for SAP owners and all demonstrate a clear commitment to providing exceptionally secure systems, realising that their business would be at risk without doing so.

Microsoft, for example, can boast of investing $1 billion annually into security research and development, and is using its advanced AI to analyse 6.5 trillion global signals across Microsoft cloud platforms to detect and respond to threats. The company has built enterprise-grade security and privacy into its cloud, backed up by rigorous real-world tests to verify breach detection and response, and general system readiness in case of attack.

Amazon, for its part, also invests heavily in the security of AWS. Encryption and security protocols are built into the infrastructure, and data sent globally is automatically encrypted at the physical layer before it leaves the company’s facilities, with additional encryption layers providing even more security. AWS’ identity and access controls combined with its monitoring capabilities, make it easy for companies to provide appropriate access at all times.

Measures like these from the major public cloud providers mean that there are now relatively few security breaches that take place in the public cloud. Breaches, when they do happen (and they’re comparatively rare compared to other infrastructures), tend to be caused by simple misconfiguration issues.

Of course, none of this is to say that security is guaranteed in the cloud, and businesses must recognise that security is a shared responsibility amongst them and their provider. Assumptions shouldn’t be made either way – that public cloud is inherently secure, or that it’s insecure.

Ultimately, organisations need to assess their actual capabilities and their provider’s capabilities. Just as the provider will promise to maintain certain security standards, customers must maintain standards too. Responsibility will likely lie to some degree with both parties.

When it comes to SAP specifically, like any decision about company data and migrations, the business needs to do thorough due diligence. Pre-migration assessments are vital to making informed decisions about the security protocols already in place by the public cloud provider and what action the business will need to take during the migration, and in the period that follows. It will almost certainly be up to the business or the managed service provider to architect a secure SAP environment – isolating SAP data, authenticating users, protecting data, and so on.

With an understanding of shared responsibility, safety concerns shouldn’t be a barrier to migrating SAP applications. Don’t let security hold you back from a migration that otherwise makes business sense.

To read the whitepaper or for further details on Ensono’s Managed SAP on Azure visit our dedicated Simplify your transition to SAP on Azure page here.