Cloud

9/15/2016
10:00 AM
Stan Black
Stan Black
Commentary
Connect Directly
LinkedIn
RSS
E-Mail vvv
100%
0%

Yes, The Cloud Can Be A Security Win

With the right controls in place, the cloud doesn't have to be a scary place. These guidelines can help your company stay safe.

There are so many different kinds of clouds — public, private, hybrid, internal — that many businesses and customers have difficulty deciding which is the right one for them. Furthermore, many businesses may use a few different variations of cloud environments — a private cloud for their own intranet, a hybrid cloud to keep some data on premises and some off premises to meet compliance regulations, and a public cloud for low-risk data.

These different types of environments make it difficult for IT and security teams to monitor every cloud on every device, or to monitor access requests for each different type of cloud environment. If you don’t control the cloud or where your data and apps reside, don’t manage them, or don’t know what you have in the cloud, your risk starts to sprawl and you don’t even know what’s happened when there’s a breach — or where to start to remediate. Follow these guidelines to make sure you avoid the cloud’s possible pitfalls.

1) Decide which kind of cloud is right for you from a security perspective.
Companies must stop treating the cloud as if it were their data center. Once data is in the cloud, it’s in a shared domain. With a public cloud, businesses have to relinquish a perceived level of control and decide if they’re comfortable with that. They need to determine if the third party (or parties) managing their cloud meets their security requirements and compliance regulations, and if there’s a clear path for accountability, threat management, and response. These days, it’s not if an attack will happen, but when.

2) Increase and improve cloud security and control.
Cloud management and security is all about control. The cloud environment you pick should depend on the level of control you want for your business. Former President Ronald Reagan used the Russian proverb “Trust, but verify” in his relations with the country. We’re going to borrow that attitude for security. Some organizations tend to enable product capabilities or features such as the “any/any” firewall rule, which allows “anything” onto the network. But that any/any rule then instructs the network to drop a potentially nasty network packet without logging it so that it can be flagged or investigated, making it impossible to find the cause of a problem if that nasty packet makes its way onto the network.

A general rule of thumb for the cloud is, “Don’t turn on anything you don’t understand.” Malicious actors know that companies allow encrypted traffic in and out every day, so they encrypt their own command and control traffic, making it harder for network security add-on technology to see it and flag it for human attention and remediation. Using the trust-but-verify model creates a good reminder for IT and security operations (SecOps) teams to go back periodically and check on active security features and policies to make sure they have the right access, rights, rules, and trust in place. Such things are easier to enable than to revoke, and SecOps teams have real threats to manage instead of monitoring how many people are sharing credentials.

3) Follow these rules of thumb when selecting or managing your cloud.

  • Ensure the cloud vendor meets and monitors compliance regulations — and checks in with you frequently so that you know your data and app security is up to date. While compliant doesn’t always equal secure, it’s a step in the right direction.
  • Construct a cloud security framework for your business to determine which applications and data are right for the cloud and which should stay on premises.
  • Create a trust-but-verify cloud security model — in other words, make sure your cloud provider does what it says it’s going to do.
  • Enforce a structured release of data. Create cloud security policies for employees, contractors, and customers, and enforce them. Make those policies “aware” of what’s going in and out of your cloud to recognize usual and unusual behavior to flag as necessary.
  • Always use multifactor authentication for employees or contractors trying to access your cloud. Make sure they’re required to provide the right level of authentication before they’re able to access data from a new location or device. For contractors, make sure you set parameters on how long they’re able to access the data and from where.

4) Keep track of what you have to mitigate risk.
Compliance is a huge piece of the cloud security puzzle, but compliance doesn’t always equal secure. Many of today’s attacks happen simply because contractors, partners, and/or service providers aren’t up to speed on company security policies. Make sure you have a plan in place to keep track of the data you have in the cloud, who’s accessing it, and why.

With the right controls in place, the cloud doesn’t need to be as scary as some make it out to be. This digital transformation we’re seeing across the industry has put businesses in a good position to take full advantage of the anywhere, anytime, any-device access on or off premises that’s provided by cloud solutions, but it’s critical to follow industry best practices and tips to ensure you’re picking the right cloud and the right vendor(s) as well as monitoring the security of data and applications, wherever they reside. 

Related Content:

Stan Black, CISSP, is CSIO of Citrix where he is in charge of the secure delivery of applications and data to some of the world's largest organizations in healthcare, financial services, public sector, and manufacturing. Black defines a converged cyber security posture ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
semidot
50%
50%
semidot,
User Rank: Apprentice
6/7/2018 | 7:39:32 AM
Cloud
Cloud is offering good features.
Whoopty
50%
50%
Whoopty,
User Rank: Ninja
9/19/2016 | 8:02:51 AM
I should do this more often
I really should consider more points when picking a cloud provider. I must admit I just get lazy with it though. When we have one that seems to work pretty well, I stick with them because it feels like quite a hassle to change. 

I'll make a point of checking our current provider now though to make sure it's ticking a lot of these boxes. 
Government Shutdown Brings Certificate Lapse Woes
Curtis Franklin Jr., Senior Editor at Dark Reading,  1/11/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: On the SS7 network, nobody knows you're a dog.
Current Issue
The Year in Security 2018
This Dark Reading Tech Digest explores the biggest news stories of 2018 that shaped the cybersecurity landscape.
Flash Poll
How Enterprises Are Attacking the Cybersecurity Problem
How Enterprises Are Attacking the Cybersecurity Problem
Data breach fears and the need to comply with regulations such as GDPR are two major drivers increased spending on security products and technologies. But other factors are contributing to the trend as well. Find out more about how enterprises are attacking the cybersecurity problem by reading our report today.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-18812
PUBLISHED: 2019-01-16
The Spotfire Library component of TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace, and TIBCO Spotfire Server contains a vulnerability that might theoretically fail to restrict users with read-only access from modifying files stored in the Spotfire Library, only when the S...
CVE-2018-18813
PUBLISHED: 2019-01-16
The Spotfire web server component of TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace, and TIBCO Spotfire Server contains multiple vulnerabilities that may allow persistent and reflected cross-site scripting attacks. Affected releases are TIBCO Software Inc. TIBCO Spotfire...
CVE-2018-18814
PUBLISHED: 2019-01-16
The TIBCO Spotfire authentication component of TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace, and TIBCO Spotfire Server contains a vulnerability in the handling of the authentication that theoretically may allow an attacker to gain full access to a target account, indep...
CVE-2018-5740
PUBLISHED: 2019-01-16
"deny-answer-aliases" is a little-used feature intended to help recursive server operators protect end users against DNS rebinding attacks, a potential method of circumventing the security model used by client browsers. However, a defect in this feature makes it easy, when the feature is i...
CVE-2018-5741
PUBLISHED: 2019-01-16
To provide fine-grained controls over the ability to use Dynamic DNS (DDNS) to update records in a zone, BIND 9 provides a feature called update-policy. Various rules can be configured to limit the types of updates that can be performed by a client, depending on the key used when sending the update ...