Cloud security must be purpose-built, developer-informed and aligned with business use cases to avoid friction, said NHL Chief Information Security Officer David Munroe.
The NHL leverages cloud services primarily for flexible needs like broadcast distribution, where viewer load may spike unpredictably. However, Munroe said certain compute-intensive or sensitive workloads such as AI model training or data-intensive analysis occur in the NHL’s on-premises data centers. Tooling, governance and visibility must be built into the initial design of any cloud deployment, Munroe said (see: Nir Zuk: Google’s Multi-Cloud Security Strategy Won’t Work).
“Cloud is meant to be fast, usable and scalable, and if you’re trying to apply the same kind of security to the cloud that you traditionally impose, people are going to have a bad time,” Munroe said. “You really have to look at it in terms of the needs of the users, the needs of the developers and the needs of the infrastructure.”
In this audio interview with Information Security Media Group during Palo Alto Networks Ignite on Tour New York, Munroe also discussed:
- Unique cybersecurity challenges, threats in the NHL;
- Cost tradeoffs between cloud, physical data centers;
- How public access in the NHL creates unique issues.
Munroe started his technology career in 1994 by founding one of the first commercial internet service providers and participated in the exponential growth of the internet while responding to many of the nascent Internet-based InfoSec threats. Before joining the NHL in 2015, he worked at Sony Music for 10 years and was one of the charter members of their global information security team.