Cloud

6/19/2018
10:30 AM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail vvv
100%
0%

5 Tips for Integrating Security Best Practices into Your Cloud Strategy

Do 'cloud-first' strategies create a security-second mindset?

Too often, I hear system administrators tell me that their organization's cloud-first strategy is jeopardizing security. With each new software-, infrastructure, and platform-as-a-service adopted by line-of-business users or within enterprise IT, security seems to be an afterthought.

The challenge with most cloud-first strategies is that they incorporate both hybrid cloud (private and public) and multicloud (heterogeneous cloud infrastructures from multiple vendors) environments; in almost all cases, these infrastructures lack consistency in management interfaces, access controls, and third-party tool support. So, not only do cloud-first strategies increase your organization's attack surface, they can be difficult to manage and secure.

Here's a simple list of best practices that organizations can implement to ensure their cloud-first strategy is optimized for security:

1. Automate Everything
Automation is a critical security practice that helps avoid misconfigurations, ensure consistency, and manage turnover and organizational change. Although highly technical experts can develop their own automation scripts, many organizations will need third-party tools and platforms to guide their automation efforts. (Full disclosure: 5nine is among a number of companies that provide such services.) Regardless of your automation approach, there are some best practices that everyone should implement.

  • Build a work culture of templating configurations: virtual machines (VMs), firewall rules, permissions, users ― everything. Continuously clone objects, workloads, and settings to maintain consistency through constant change.  
  • Configure alerts to flag possible security vulnerabilities, such as log-in attempts, traffic anomalies, and system changes.
  • Implement intrusion detection and prevention systems that do the hard work for you. Hacking attempts and distributed denial-of-service exploits are on the rise, and malicious actors understand the vulnerabilities of the cloud; adopt a platform that proactively identifies and prevents attacks.
  • Use scripting or third-party security platforms to create workflows that automatically apply a consistent set of security settings to each new VM added to the network.

2. Adopt Platforms, Tools, and Solutions That Support Hybrid and Multicloud Environments
Agility, resilience, and speed are baked into the development of every cloud implementation; they are why organizations adopt cloud-first strategies. But without the proper tools, sys admins can't effectively manage and protect their evolving cloud landscape, negating these benefits. As you plan your cloud strategy, the right tools and a detailed road map are essential for supporting a successful transition. Start by assuming that at some point, if not already, some of your workload will move to the public cloud, so you'll really be managing a hybrid environment.

Next, it's highly like that the people supporting your data center will also support your cloud, so to avoid misconfigurations and minimize complexity, adopt management and security solutions that support hybrid cloud scenarios. It's also likely your environment will evolve to include more than one cloud service. Whether through a merger or acquisition, adopted in a development lab or acquired elsewhere, you may be faced with a combination of Microsoft Azure, Amazon Web Services, and/or Google cloud environments. Procure technologies that will or plan to support multiple clouds to ensure a sustainable management and security model in this situation.

3. Consistently Apply Access Controls for Roles and Tenants
With each new cloud technology brought into the enterprise, identity and access management becomes increasingly difficult. It's important that enterprises develop an onboarding system to clone and provision administrative rights based on role and tenant access. In the absence of a third-party solution that consistently applies permissions across cloud deployments, cloud technologies should be centrally procured and permissioned according to internal and regulatory compliance mandates. Cross-cloud permissions and roles should also be centrally documented, in case an auditor ever inquires.  

4. Use Dashboards to Monitor Security Issues across Cloud Instances
Dashboards provide an excellent way to quickly review security metrics across disparate VMs, hosts, data centers, and cloud instances. Ideally, you're implementing a platform that unifies these views in a single screen. However, you can always monitor individual VMs by opening separate windows. Dashboard views have the obvious advantages of a consistent look and feel, convenience, and simplicity.

5. Back Up Workloads at Least Twice Daily ― Be Ready to Recover on a Moment's Notice
Backup and recovery are critical for security in hybrid and multicloud environments. They are the only ways to ensure that risks such as ransomware or misconfigurations don't permanently damage your overall cloud infrastructure and impact your ability to serve customers. But because each cloud service has its own native functionality, backing up across multiple environments is extremely challenging. While you can use each cloud's native backup functionality, it's always best to adopt a backup and recovery solution that supports your entire cloud environment.

Does Cloud-First Mean Security Is Second?
No. With the right mindset, best practices, and third-party tools, you can build a sustainable security model for your organization's cloud-first strategy. Administrators must assess the security gaps inherent in hybrid and multicloud environments, then collaborate with executives on implementing the right unified cloud management and security solutions that will evolve with their overall cloud implementation.

Related Content:

Why Cybercriminals Attack: A DARK READING VIRTUAL EVENT Wednesday, June 27. Industry experts will offer a range of information and insight on who the bad guys are – and why they might be targeting your enterprise. Go here for more information on this free event.

Robert Corradini is a two-time Microsoft Azure and Hyper-V MVP with over 20 years of experience managing cloud and data center technologies. He is currently the Director of Product Management at 5nine and focuses on bringing world-class cloud security and management solutions ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
WebAuthn, FIDO2 Infuse Browsers, Platforms with Strong Authentication
John Fontana, Standards & Identity Analyst, Yubico,  9/19/2018
NSS Labs Files Antitrust Suit Against Symantec, CrowdStrike, ESET, AMTSO
Kelly Jackson Higgins, Executive Editor at Dark Reading,  9/19/2018
Turn the NIST Cybersecurity Framework into Reality: 5 Steps
Mukul Kumar & Anupam Sahai, CISO & VP of Cyber Practice and VP Product Management, Cavirin Systems,  9/20/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: Are you sure this is how we get our data into the cloud?
Current Issue
Flash Poll
The Risk Management Struggle
The Risk Management Struggle
The majority of organizations are struggling to implement a risk-based approach to security even though risk reduction has become the primary metric for measuring the effectiveness of enterprise security strategies. Read the report and get more details today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-14633
PUBLISHED: 2018-09-25
A security flaw was found in the chap_server_compute_md5() function in the ISCSI target code in the Linux kernel in a way an authentication request from an ISCSI initiator is processed. An unauthenticated remote attacker can cause a stack buffer overflow and smash up to 17 bytes of the stack. The at...
CVE-2018-14647
PUBLISHED: 2018-09-25
Python's elementtree C accelerator failed to initialise Expat's hash salt during initialization. This could make it easy to conduct denial of service attacks against Expat by contructing an XML document that would cause pathological hash collisions in Expat's internal data structures, consuming larg...
CVE-2018-10502
PUBLISHED: 2018-09-24
This vulnerability allows local attackers to escalate privileges on vulnerable installations of Samsung Galaxy Apps Fixed in version 4.2.18.2. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exist...
CVE-2018-11614
PUBLISHED: 2018-09-24
This vulnerability allows remote attackers to escalate privileges on vulnerable installations of Samsung Members Fixed in version 2.4.25. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists wit...
CVE-2018-14318
PUBLISHED: 2018-09-24
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Samsung Galaxy S8 G950FXXU1AQL5. User interaction is required to exploit this vulnerability in that the target must have their cellular radios enabled. The specific flaw exists within the handling of ...