Will cloud architecture change after COVID?

A few things have changed since the start of the COVID-19 lockdowns. The Global 2000, as well as governments, now understand that traditional data centers are more vulnerable to natural disasters (such as pandemics) than once thought.  

Indeed, the use of cloud computing means that there are no physical data centers and servers to protect, and that we don’t rely on humans for physical operations as much as we did in the past.  

Putting the obvious aside for now, let’s look at the future of cloud computing, specifically at the future of cloud computing architecture. I see a few changes happening now that won’t likely go away after the current crisis ends:

Data consolidation. Only a few enterprise IT shops selected data consolidation as an option, cloud or not. The reasons ranged from security risks, to the lack of willingness to go through the painful process of migrating data from complex and distributed databases, to a consolidated database in the cloud, or even on-premises.  

Today, driven by the risks around COVID-19, enterprises are accelerating data consolidation efforts, typically moving to a public cloud provider or providers. This means changing schemas and even databases models, for example, from relational to object.

This also means changing the applications that leverage the databases, which is where the costs and risk come in. Some stuff is just going to break. 

Most enterprises think the risk of not doing this outweighs the risk of data consolidation. You’ll find this will be the preferred approach post-COVID as well.

Use of identity-based security and governance. I’m often taken aback by the number of enterprises that moved to public clouds yet still don’t use identity-based security and governance, such as IAM (identity and access management). 

With the new distributed and remote workforce, IT is finding that traditional security layers, and even role-based security, are way more risky than fined-grained security and governance configurations using identity. This will likely lead to breaches if left alone, not to mention it is more costly to operate.

Of course, much like data consolidation, making the change is hard and expensive. Each device, human, API, server, etc., needs to use an identity in order to configure authorization and deauthorization of access. This means standing up directory services if they don’t exist and investing in IAM technology.   

The common theme is that enterprises are stepping up and doing what’s hard, risky, and costly in order to remove much of the greater risk that has been identified by the impact of the pandemic. This is a silver lining, considering that these two things needed to be done anyway as a major best practice going forward.