Podcast
Root Causes 361: The Premise of on Premise


Hosted by
Tim Callan
Chief Compliance Officer
Jason Soroko
Fellow
Original broadcast date
February 9, 2024
In this episode we examine commonly held belief that on-premise systems give system administrators greater levels of control and that that is better for security or other reasons. We explore the pros and cons of extra control, to what degree it is a benefit, and if it's worth it.
Podcast Transcript
Lightly edited for flow and brevity.
So what really is the premise of on-premise? It is control. And a lot of people might say it's a question of control versus cost, but I want to expand that greatly. It's more than that. In other words, is control worth it? What are you getting for more control, Tim?
So, November last year, November 2023, Gartner actually put out a public report saying that cloud adoption by 2028 will no longer be disruptive but will be essential. That's a big statement.
And let's think about now, like the financial industry being a really good example of hey, you wanted to sell into the financial industry, you had to have an on-prem product, otherwise, they wouldn't even look at you. Those are folks that they're absolutely, you know, control freaks for good reasons and want to be as secure as possible for very good reasons. But let me give you some examples. Nasdaq's GEMX options trading platform is now entirely in the cloud. You're starting to see an inflection point right now, Tim, where even some of the most stalwart industries such as finance are moving operations to the cloud, because I think they're asking the question, is extra control worth it? And are you getting anything other than more control when you keep things on-premise?
You know what they're good at? Giving customer service to their banking customers. I certainly as a Sectigo employee, I can't do what they do but they shouldn't pretend to do what I do either.
Speed to market. I think if you go to cloud, Tim, it's remarkable right now the amount of innovation that is just absolutely being driven by, my goodness, I can stand up systems so quickly and not have to worry about individual servers in my server room. It's just truly incredible.
So I think we could pass that real quickly and move right on to I'm going to combine three important IT topics in one. I'm going to say updates, as well as availability and resiliency.
So you know, is there anybody out there who's enjoyed a patch Tuesday?
Let's talk about now two things. One is, I think when you're dealing with a, not just a general public cloud, but if you're dealing with security, something that's fundamentally important in your infrastructure, such as PKI, CLM, etc., if you go on-prem, you're not gaining a security partner, necessarily. If you're dealing with somebody who is managing that for you in their environment, and is essentially then to you a cloud service, you're not gaining a security partner. And I think that's an opportunity cost of on-prem to some degree.
And some of that, of course, wraps in efficiency and innovation and scalability. Right? That's part of what it is. But security is something really specific.
And I think there's one more I wanted to add other than security itself, which is, you know, for those of you who think that backwards compatibility, those of you who are telling me, Jay, I need to have my on- prem because of backwards compatibility, I'm going to argue to you that you actually don't have to, in the case of PKI specifically, don't have to give up backwards compatibility when you're dealing with a cloud PKI provider. Somebody who can stand up private Certificate Authorities for you.
So in other words, what's the opportunity cost of control? I can tell you one thing, that it's not. You are absolutely not going to lose by backwards compatibility by working in the cloud. And there's ways that I'd like to talk about that, Tim. But that is the list.
So what is the real need for control? Oh my God, I almost hate to almost say it, but I'm gonna say it. I think it's a need that is more connected with human nature, emotion and psychology. In other words, I need to wrap my arms around the server to feel like it's safe and I don't think that's true. But you know, I can see how the psychology of some people think that that is what they're getting out of control.
If you think Patch Tuesday is a good thing. It's not. It's a huge risk every time you go in and do your official patches. And I'll tell you, it's no different than if you're running CLM software or PKI software. There's gonna be updates. If you're not hosted in the cloud, if you don't have the experts doing it for all of you and making it seamless, there is risk that I don't think people are calculating correctly.
And Tim, I gotta tell you, I know you keep up on it. I keep on it. But this whole world about infrastructure as code, we've had podcasts about that. Topics such as continuous improvement, continuous delivery, CICD pipelines. I think you need to rethink how you consider how cloud operations and how cloud applications are actually implemented. And it just blows the doors off of anything that happens on-prem. And that's just the truth.
In other words, I find it interesting, Tim, that the best controls now for how to actually implement software are now the state of the art is pointing to the cloud. Not on-prem.
Let's talk about security partners for a moment, right? Do you really want to roll your own? If you do, my God, you better have a very, very specific reason.
And you and I had a podcast about what happens if the customer asks for things that are just crazy. Is it ethical for us to allow that to happen? It touches on that topic. And I would say that you want to speak to a security partner in order to understand what the same defaults are for your environment. Don't do it yourself. And let's go further, Tim. Do you have staff that can set up and maintain an HSM? That's such a specialist thing.
But keep in mind that when you talk about PKI, you can also subordinate a modern issuing CA that's in the cloud to expand your capabilities. And so therefore, there's lots of ways to augment, monitor your legacy environments, as well as to actually create new issuing environments that are modern, able to integrate into all sorts of use cases and operating systems that legacy on-prem was never able to do.
I don't think you have to give up anything anymore. By going with a modern, cloud-based PKI, I think that you get all that backwards capability and you get all the future and innovative capabilities, and future proofing that you were just talking about Tim. You can get all the benefits. I'm gonna make this statement. Anybody who is architecting something net new right now, even in big finance, for example, I'm not sure that on-premise is your best solution. And I'd argue it comes down to psychology.
So let's arm you then, Tim. Let's arm the audience with the big elephant in the room, the objection you're gonna get, in terms of interpretations with regards to security. Ok. And let me just call this one right now. I have spoken to people who really truly believe and this is - - It's funny how this comes down to emotions and psychology and topics of faith, rather than real, measurable truth. But if you really believe that you can put better controls around a server on your on-premise system compared to a cloud environment, well, yes, in the cloud, it is someone else's server, but the controls that are put around it are typically going to be far better just even due to the way that things are specialized and isolated.
Tim, you and I talk a lot about putting better locks on the door.
Well, if you have a mixed enterprise environment, as well as this, you know, crown jewels of PKI and CLM, what kind of locks can you put on the door? What kind of isolation can you put into place? If you can't isolate it enough, are you able to put the necessary monitoring into place? Do you have the dedicated staff to enable all the security technology? The answer for all that is, look, no, you don't? You don’t.
Look. Human error. You have seen things like storage buckets, right, that have been exposed publicly. Well, that's not something you see in a dedicated cloud PKI or cloud CLM. Right? You're just not seeing that. In terms of configuration errors, yes, you can absolutely have cloud configuration errors that lead to certain kinds of security problems, but you know what, I consider that a scratch because you can just as easily have those mistakes on-premise.
And, you know, I gotta call this out. I think, Tim, one of the biggest bugbears people have about putting stuff from the cloud - in other words, somebody else's server - is how many times have we heard about insider staff at a cloud provider being malicious?
I'm gonna throw one more in. It's gonna get into the weeds a touch, Tim, but we've talked about, you know, because of the fact that a lot of these isolation technologies between a multi customer environment in the cloud have to do with things such as - let's just call it this. Flaws that are taken advantage of by bad guys within the virtual machine isolation.
And I can tell you that I've seen those talks at BlackHat and those are ridiculously difficult types of attacks. Here's the thing. They can be mitigated by patching of the VM systems at the cloud level, you know, all at once. And furthermore, there are other controls. Remember, I talked about better locks on the door? You still have to authenticate it. And so, in other words, this would be a very difficult attack. I'm never going to call it impossible. But if you were to compare it against lateral movements on-prem - give me a break. I saw the BlackHat talks around, you know, red-pilling and blue-pilling VM environments, and those were done by some of the smartest white hats in the world. And the mitigations for those kinds of things are so sophisticated at the big public clouds and at any of the providers that you're dealing with, Tim. So I would say it's a very in the weeds argument, but I wanted to call it out, right. Let’s compare it to on-prem, give me a break. That's a 10 times harder attack than a lot of the attacks that will happen on-prem.
So Tim, I just wanted to now just, you know, get into the security context a little more. I think some of the fundamental flaws on the on-prem argument are your enterprise network is probably nowhere near as isolated as you think it is.
I think that endpoint security controls are really a speed bump to the worst attackers that are going to be going after important targets such as your PKI, or your CLM, for example. I've also seen the argument from some people with the, you know, the premise of on-premise saying, hey, you know, I actually, I don't have a problem with staff monitoring my on-premise platform, because I've shopped that all out to a SecOps provider in the cloud. Well, isn't that hilarious, Tim? It's kind of like, oh my God, you now have staff that have, you now can wrap your arms around your servers. That's nice. But you're now remotely monitored and administrated by the cloud. And so what the heck is the difference?
Tim, I want to call it just a few last things in terms of security. Let’s get really specific with PKI, for example.
You know, there's a reason why we have elaborate key signing ceremonies in our industry. And the reason we do that is because we are better than all y'all. We do audit ourselves. We do all the technicalities.
Tim, physical security. Right? My God. What does it take to be a private – not only a private CA, right? What does it take to be a public CA, Tim Callan?
So if you're a CIO, if you're a CISO, if you’re Risk Officer, if you're a Director of IT, if you don't know whether your developers or ops staff are just simply choosing defaults in whatever private CA software that they're using - you shouldn't be doing it. If you can't answer that question - stop what you're doing right now. Because I can tell you right now, a Sectigo – and again, not an advertisement, just trying to give an example - we have vast, vast experience in all these use cases that you're setting up private CAs for, so helping to set up your certificate profiles and you trust models properly so that - - you know, because these are going to be systems that live on a long time.

