Over the next few years, the number of organizations navigating to the cloud is expected to grow exponentially. According to Gartner, more than 70% of enterprises will use cloud platforms to accelerate their business initiatives by 2027. (That’s up from fewer than 15% in 2023.) Part of this growth will result from public cloud providers’ increasing access to and adoption of innovative technologies like AI.

It may be time for your organization to initiate its own cloud migration process. Before you start, you need to learn about your options and figure out where to start your journey.

Why you want to migrate to the cloud

Migrating to the cloud means hosting your infrastructure in a secure multi-tenant environment managed by a cloud provider. This allows you to focus on application delivery that provides value to your business.

You can achieve several benefits by migrating to the cloud, among them improved resiliency and higher availability through leveraging the redundancy built into cloud providers’ Infrastructure-as-a-Service (IaaS) offerings. It also helps to remove equipment procurement cycles, enabling IT to experiment with solutions and act on changing business requirements faster than you otherwise could.

Navigating to the cloud also comes with security advantages. For instance, all cloud providers offer security settings that have been tested over time. Another advantage is the ability to use tested solutions from the cloud vendors’ marketplaces to eliminate the need to build and maintain these images and applications yourself.

Understanding where you want to go in the cloud

When it comes to planning your cloud migration, there are three common types of cloud storage from which your organization can choose.

1. Blob or object storage

Accessible by HTTPS, blob or object storage is suitable for mass file transfers/migrations. It is also independent of systems or virtual machines (VMs), and, in many cases, you can use it to deliver content to users. The risk of using this type of storage is that it can be made publicly available.

2. Block storage

Block storage is attached directly to individual VMs. You can typically use direct attached or Storage Area Network (SAN) storage for block storage in an on-premises data center. You can also provision it for performance, but you’re ultimately responsible for configuring redundancy, fault tolerance and high availability along with enabling encryption and data protection.

3. Network attached storage

Network attached storage (NAS) is similar to a “fileserver,” which can be accessed by multiple users/systems simultaneously. NAS effectively shares data amongst systems internally, reducing the need to keep multiple copies on individual systems and maintaining updates on each system. Here, you are also usually responsible for enabling encryption and data protection methods.

Cloud service models: Your responsibility in the cloud

Beyond cloud storage types, every cloud provider offers varying levels of service models from which you can pick based on your organization, staff capabilities and skill sets. You can choose from bare metal platforms, where you’re responsible for everything above the base hardware and networking level (IaaS), all the way up to fully managed services and applications in which the responsibility for configuring and maintaining the servers, applications and environments is taken on by the cloud provider (Software-as-a-Service [SaaS] or Function-as-a-Service [FaaS]).

Source: Cloud Security and the Shared Responsibility Model

Each level of managed services has pros and cons. The pros of managed services are that you don’t have to focus on the details of systems management and maintenance. Even so, you may lose customization options, access to lower-level resources, and cost savings.

How to migrate to the cloud

If you're looking to move to the cloud, there are three common ways to do so.

1. Lift and shift

Lift and shift takes the servers and applications running in the on-premises data center and simply re-hosts them in the cloud. This can be the easiest way to migrate to the cloud, and it is the first step many companies take. However, this method doesn’t help with reducing technical debt and it is often not a means of cost-effective migration, as you are not right-sizing your infrastructure or taking advantage of the elastic nature of the cloud.

2. Refactoring

Refactoring includes modifying on-premises infrastructure, code and deployments to take advantage of the cloud’s elastic nature. This method includes the advantage of having web services behind a load balancer and scaling computing resources up and down based on demand rather than building a web farm to support peak load, thus saving you money. You may also take advantage of managed services or Platform-as-a-Service (PaaS) offerings such as CDN, database and data replication services. The risk with this approach is that you are changing multiple variables during the migration process, which makes troubleshooting more complex.

3. Redesigning to be cloud native

This is a more complex migration strategy in which the applications’ architecture is redesigned during migration to take full advantage of the benefits of the cloud. The benefit of this approach is that it can be a highly resilient, cost-effective solution that scales to meet demand without over-provisioning. However, it adds complexity and risk, as many architecture components are changing at the same time. Additionally, it can be more challenging to ensure resiliency and security.

Your responsibility in moving to the cloud

Migrating to the cloud is a multi-stage program. You will learn a great deal and ultimately save on costs by starting small, building on the experience and working toward designing your applications and infrastructure to scale up and down.

Moving to the cloud does not make you automatically secure, however. You are always responsible for securing your own applications, OS images, networks, access rules and data in the cloud. Cloud vendors provide security of the computing assets, not the data placed on their assets. You will need to establish a relationship with your cloud provider to understand where your security responsibilities lie.

To learn more, explore CIS cloud security guidance.