Cloud

9/15/2016
10:00 AM
Stan Black
Stan Black
Commentary
Connect Directly
LinkedIn
RSS
E-Mail vvv
100%
0%

Yes, The Cloud Can Be A Security Win

With the right controls in place, the cloud doesn't have to be a scary place. These guidelines can help your company stay safe.

There are so many different kinds of clouds — public, private, hybrid, internal — that many businesses and customers have difficulty deciding which is the right one for them. Furthermore, many businesses may use a few different variations of cloud environments — a private cloud for their own intranet, a hybrid cloud to keep some data on premises and some off premises to meet compliance regulations, and a public cloud for low-risk data.

These different types of environments make it difficult for IT and security teams to monitor every cloud on every device, or to monitor access requests for each different type of cloud environment. If you don’t control the cloud or where your data and apps reside, don’t manage them, or don’t know what you have in the cloud, your risk starts to sprawl and you don’t even know what’s happened when there’s a breach — or where to start to remediate. Follow these guidelines to make sure you avoid the cloud’s possible pitfalls.

1) Decide which kind of cloud is right for you from a security perspective.
Companies must stop treating the cloud as if it were their data center. Once data is in the cloud, it’s in a shared domain. With a public cloud, businesses have to relinquish a perceived level of control and decide if they’re comfortable with that. They need to determine if the third party (or parties) managing their cloud meets their security requirements and compliance regulations, and if there’s a clear path for accountability, threat management, and response. These days, it’s not if an attack will happen, but when.

2) Increase and improve cloud security and control.
Cloud management and security is all about control. The cloud environment you pick should depend on the level of control you want for your business. Former President Ronald Reagan used the Russian proverb “Trust, but verify” in his relations with the country. We’re going to borrow that attitude for security. Some organizations tend to enable product capabilities or features such as the “any/any” firewall rule, which allows “anything” onto the network. But that any/any rule then instructs the network to drop a potentially nasty network packet without logging it so that it can be flagged or investigated, making it impossible to find the cause of a problem if that nasty packet makes its way onto the network.

A general rule of thumb for the cloud is, “Don’t turn on anything you don’t understand.” Malicious actors know that companies allow encrypted traffic in and out every day, so they encrypt their own command and control traffic, making it harder for network security add-on technology to see it and flag it for human attention and remediation. Using the trust-but-verify model creates a good reminder for IT and security operations (SecOps) teams to go back periodically and check on active security features and policies to make sure they have the right access, rights, rules, and trust in place. Such things are easier to enable than to revoke, and SecOps teams have real threats to manage instead of monitoring how many people are sharing credentials.

3) Follow these rules of thumb when selecting or managing your cloud.

  • Ensure the cloud vendor meets and monitors compliance regulations — and checks in with you frequently so that you know your data and app security is up to date. While compliant doesn’t always equal secure, it’s a step in the right direction.
  • Construct a cloud security framework for your business to determine which applications and data are right for the cloud and which should stay on premises.
  • Create a trust-but-verify cloud security model — in other words, make sure your cloud provider does what it says it’s going to do.
  • Enforce a structured release of data. Create cloud security policies for employees, contractors, and customers, and enforce them. Make those policies “aware” of what’s going in and out of your cloud to recognize usual and unusual behavior to flag as necessary.
  • Always use multifactor authentication for employees or contractors trying to access your cloud. Make sure they’re required to provide the right level of authentication before they’re able to access data from a new location or device. For contractors, make sure you set parameters on how long they’re able to access the data and from where.

4) Keep track of what you have to mitigate risk.
Compliance is a huge piece of the cloud security puzzle, but compliance doesn’t always equal secure. Many of today’s attacks happen simply because contractors, partners, and/or service providers aren’t up to speed on company security policies. Make sure you have a plan in place to keep track of the data you have in the cloud, who’s accessing it, and why.

With the right controls in place, the cloud doesn’t need to be as scary as some make it out to be. This digital transformation we’re seeing across the industry has put businesses in a good position to take full advantage of the anywhere, anytime, any-device access on or off premises that’s provided by cloud solutions, but it’s critical to follow industry best practices and tips to ensure you’re picking the right cloud and the right vendor(s) as well as monitoring the security of data and applications, wherever they reside. 

Related Content:

Stan Black, CISSP, is CSIO of Citrix where he is in charge of the secure delivery of applications and data to some of the world's largest organizations in healthcare, financial services, public sector, and manufacturing. Black defines a converged cyber security posture ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
semidot
50%
50%
semidot,
User Rank: Apprentice
6/7/2018 | 7:39:32 AM
Cloud
Cloud is offering good features.
Whoopty
50%
50%
Whoopty,
User Rank: Ninja
9/19/2016 | 8:02:51 AM
I should do this more often
I really should consider more points when picking a cloud provider. I must admit I just get lazy with it though. When we have one that seems to work pretty well, I stick with them because it feels like quite a hassle to change. 

I'll make a point of checking our current provider now though to make sure it's ticking a lot of these boxes. 
Crowdsourced vs. Traditional Pen Testing
Alex Haynes, Chief Information Security Officer, CDL,  3/19/2019
New Mirai Version Targets Business IoT Devices
Dark Reading Staff 3/19/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: Reading Schneier's Friday Squid Blog again?
Current Issue
5 Emerging Cyber Threats to Watch for in 2019
Online attackers are constantly developing new, innovative ways to break into the enterprise. This Dark Reading Tech Digest gives an in-depth look at five emerging attack trends and exploits your security team should look out for, along with helpful recommendations on how you can prevent your organization from falling victim.
Flash Poll
The State of Cyber Security Incident Response
The State of Cyber Security Incident Response
Organizations are responding to new threats with new processes for detecting and mitigating them. Here's a look at how the discipline of incident response is evolving.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-6149
PUBLISHED: 2019-03-18
An unquoted search path vulnerability was identified in Lenovo Dynamic Power Reduction Utility prior to version 2.2.2.0 that could allow a malicious user with local access to execute code with administrative privileges.
CVE-2018-15509
PUBLISHED: 2019-03-18
Five9 Agent Desktop Plus 10.0.70 has Incorrect Access Control (issue 2 of 2).
CVE-2018-20806
PUBLISHED: 2019-03-17
Phamm (aka PHP LDAP Virtual Hosting Manager) 0.6.8 allows XSS via the login page (the /public/main.php action parameter).
CVE-2019-5616
PUBLISHED: 2019-03-15
CircuitWerkes Sicon-8, a hardware device used for managing electrical devices, ships with a web-based front-end controller and implements an authentication mechanism in JavaScript that is run in the context of a user's web browser.
CVE-2018-17882
PUBLISHED: 2019-03-15
An Integer overflow vulnerability exists in the batchTransfer function of a smart contract implementation for CryptoBotsBattle (CBTB), an Ethereum token. This vulnerability could be used by an attacker to create an arbitrary amount of tokens for any user.