The recent flurry of cloud platform outages highlights the need for multicloud strategies, even though the process of using multiple providers is rife with complexities, experts said.

Cloud market leader Amazon Web Services Inc. suffered three outages in December 2021 alone, briefly taking down a legion of online services that run on Amazon.com Inc.'s cloud platform. Outages of this scale are rare occurrences that are typically spread farther apart, but the rapid migration to the cloud is increasingly overwhelming even the biggest vendors.

AWS is the world's largest cloud provider, with almost 41% of the worldwide market for infrastructure cloud services, research firm Gartner said in June 2021. An Amazon spokesperson declined to comment on the outages.

Companies that run their businesses on the cloud are at the mercy of their platform providers and thus have no control over outages and other technical difficulties. However, one way they can mitigate a complete collapse of their digital infrastructure is to rely on multicloud environments.

"We're seeing more and more customers adopt a multicloud strategy simply because some workloads run better or more cost-effectively on different clouds," said Clay Magouyrk, executive vice president of Oracle Corp.'s Cloud Infrastructure division.

Previously, IT decision-making tended to center on whether to set up a single layer of cloud services via data centers on company premises or to contract with third-party providers with data centers off-site, known as private or public cloud environments, respectively. Organizations are now increasingly moving toward the multicloud, which blends components from multiple cloud providers to meet specific business or operational requirements.

Resiliency and cost-efficiency

Many companies already use more than one cloud provider, which often involves running one service on one cloud, and a second service on another. For example, a bank could choose to run its mobile banking business on AWS to leverage technologies that can securely manage the movement of data, but at the same time also opt to use the AI and learning capabilities that Alphabet Inc.'s Google Cloud has to detect fraudulent transactions.

"For most organizations, the multicloud has arrived less through planning than just through a simple fact that a combination of different partners, different tools, all of the various parts of moving their environments to some level of cloud mean that realistically, they're going to be involved in multiple cloud providers," said Eric Hanselman, a principal research analyst at 451 Research.

A multicloud approach also offers increased resiliency for data such as bank transactions that need to be available at all times, said Hanselman. Working with multiple cloud providers would allow banks to at least have some part of their infrastructure up and running in the event of a failure of any one individual cloud provider.

Distributing workloads among various computing infrastructures also brings competitive advantages for organizations, which can play cloud vendors off each other to keep costs down.

Regulatory and security

Regulatory challenges are also driving companies toward a multicloud system. Certain laws, regulations and corporate policies require enterprise data to physically reside in certain locations. Multicloud computing can help organizations meet those requirements, since they can select from multiple providers' data center regions or availability zones.

Europe's General Data Protection Regulation, for instance, places restrictions on how firms process data outside of a given location, said Paige Bartley, senior research analyst of data management at 451 Research. "If a multinational in the U.S. has German customers, for example, they may not be able to view that data in the cloud, simply because viewing it outside of Germany is considered processing it."

The flexibility to deploy workloads without being locked to a single vendor is becoming increasingly important for cloud customers, said Nataraj Nagaratnam, chief technology officer of cloud security at International Business Machines Corp.'s IBM Cloud division.

"Cloud customers have realized that hybrid and multicloud environments provide them the flexibility to make the right decisions with their data while keeping compliance in mind," Nagaratnam said. "Regulators are increasingly requiring customers to not lock themselves to one provider and to be able to demonstrate the ability to exit from one and move to another if necessary."

Relying on one vendor for cloud products and services can also create security risks, said Sunil Potti, vice president and general manager of Google Cloud Security.

"Financial services firms should continue to maximize the potential of technology by migrating more core workloads to the cloud, and actively considering multicloud and hybrid-cloud strategies," Potti said. "Such strategies enhance resiliency of existing IT infrastructure and reduce concerns over vendor lock-in."

Google is the fourth-largest infrastructure-as-a-service provider, according to Gartner, behind Amazon, Microsoft Corp. and Alibaba Group Holding Ltd. While Gartner's most recent estimates had Amazon with almost 41% market share, the research firm pegged Google's share around 6%.

READ MORE: To learn how the pandemic and resulting cybersecurity concerns accelerated the migration to the cloud, click here.

Complexities and risks

Although expanding to multiple clouds gives companies more scalability and capability, it also adds complexity to everyday operations and invites security challenges.

"The ability to work with a range of different options for infrastructure is undoubtedly useful, but it adds complexity, and complexity is the enemy of security," said Hanselman. "The more moving parts you have to anything, the more places there are for things to break."

According to cloud security firm Valtix, the multicloud can present problems for IT leaders because its security varies by cloud, requires specific skills, causes crisis-level problems if not properly managed, and is constantly evolving.

A survey of 200 IT leaders commissioned by Valtix found that only 54% of companies considering using a multicloud strategy are confident they have the tools or skills they need to fully execute it. Moreover, 51% of organizations using one cloud platform say they do not want to expand to new clouds because of the added security complexity.

"IT leaders are entering 2022 in a precarious state when it comes to multicloud security," said Valtix CEO Douglas Murray. "The reality is that managing several cloud providers multiplies threats, work and headcount."

A key challenge in multicloud environments is interoperability, said Jeff Wierer, vice president of product management security services at Oracle. To counter these issues, Oracle Cloud joined The Open Networking User Group, a community of IT business leaders who collaborate to identify and solve issues around cybersecurity and data protection.

"Four of the top five cloud service providers now work in unison with the largest cloud consumers to develop a standard multicloud security notification translation and enhancement service for enterprises," Wierer said.