Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Cloud

6/19/2018
10:30 AM
Connect Directly
LinkedIn
Twitter
RSS
E-Mail vvv
100%
0%

5 Tips for Integrating Security Best Practices into Your Cloud Strategy

Do 'cloud-first' strategies create a security-second mindset?

Too often, I hear system administrators tell me that their organization's cloud-first strategy is jeopardizing security. With each new software-, infrastructure, and platform-as-a-service adopted by line-of-business users or within enterprise IT, security seems to be an afterthought.

The challenge with most cloud-first strategies is that they incorporate both hybrid cloud (private and public) and multicloud (heterogeneous cloud infrastructures from multiple vendors) environments; in almost all cases, these infrastructures lack consistency in management interfaces, access controls, and third-party tool support. So, not only do cloud-first strategies increase your organization's attack surface, they can be difficult to manage and secure.

Here's a simple list of best practices that organizations can implement to ensure their cloud-first strategy is optimized for security:

1. Automate Everything
Automation is a critical security practice that helps avoid misconfigurations, ensure consistency, and manage turnover and organizational change. Although highly technical experts can develop their own automation scripts, many organizations will need third-party tools and platforms to guide their automation efforts. (Full disclosure: 5nine is among a number of companies that provide such services.) Regardless of your automation approach, there are some best practices that everyone should implement.

  • Build a work culture of templating configurations: virtual machines (VMs), firewall rules, permissions, users ― everything. Continuously clone objects, workloads, and settings to maintain consistency through constant change.  
  • Configure alerts to flag possible security vulnerabilities, such as log-in attempts, traffic anomalies, and system changes.
  • Implement intrusion detection and prevention systems that do the hard work for you. Hacking attempts and distributed denial-of-service exploits are on the rise, and malicious actors understand the vulnerabilities of the cloud; adopt a platform that proactively identifies and prevents attacks.
  • Use scripting or third-party security platforms to create workflows that automatically apply a consistent set of security settings to each new VM added to the network.

2. Adopt Platforms, Tools, and Solutions That Support Hybrid and Multicloud Environments
Agility, resilience, and speed are baked into the development of every cloud implementation; they are why organizations adopt cloud-first strategies. But without the proper tools, sys admins can't effectively manage and protect their evolving cloud landscape, negating these benefits. As you plan your cloud strategy, the right tools and a detailed road map are essential for supporting a successful transition. Start by assuming that at some point, if not already, some of your workload will move to the public cloud, so you'll really be managing a hybrid environment.

Next, it's highly like that the people supporting your data center will also support your cloud, so to avoid misconfigurations and minimize complexity, adopt management and security solutions that support hybrid cloud scenarios. It's also likely your environment will evolve to include more than one cloud service. Whether through a merger or acquisition, adopted in a development lab or acquired elsewhere, you may be faced with a combination of Microsoft Azure, Amazon Web Services, and/or Google cloud environments. Procure technologies that will or plan to support multiple clouds to ensure a sustainable management and security model in this situation.

3. Consistently Apply Access Controls for Roles and Tenants
With each new cloud technology brought into the enterprise, identity and access management becomes increasingly difficult. It's important that enterprises develop an onboarding system to clone and provision administrative rights based on role and tenant access. In the absence of a third-party solution that consistently applies permissions across cloud deployments, cloud technologies should be centrally procured and permissioned according to internal and regulatory compliance mandates. Cross-cloud permissions and roles should also be centrally documented, in case an auditor ever inquires.  

4. Use Dashboards to Monitor Security Issues across Cloud Instances
Dashboards provide an excellent way to quickly review security metrics across disparate VMs, hosts, data centers, and cloud instances. Ideally, you're implementing a platform that unifies these views in a single screen. However, you can always monitor individual VMs by opening separate windows. Dashboard views have the obvious advantages of a consistent look and feel, convenience, and simplicity.

5. Back Up Workloads at Least Twice Daily ― Be Ready to Recover on a Moment's Notice
Backup and recovery are critical for security in hybrid and multicloud environments. They are the only ways to ensure that risks such as ransomware or misconfigurations don't permanently damage your overall cloud infrastructure and impact your ability to serve customers. But because each cloud service has its own native functionality, backing up across multiple environments is extremely challenging. While you can use each cloud's native backup functionality, it's always best to adopt a backup and recovery solution that supports your entire cloud environment.

Does Cloud-First Mean Security Is Second?
No. With the right mindset, best practices, and third-party tools, you can build a sustainable security model for your organization's cloud-first strategy. Administrators must assess the security gaps inherent in hybrid and multicloud environments, then collaborate with executives on implementing the right unified cloud management and security solutions that will evolve with their overall cloud implementation.

Related Content:

Why Cybercriminals Attack: A DARK READING VIRTUAL EVENT Wednesday, June 27. Industry experts will offer a range of information and insight on who the bad guys are – and why they might be targeting your enterprise. Go here for more information on this free event.

Robert Corradini is a two-time Microsoft Azure and Hyper-V MVP with over 20 years of experience managing cloud and data center technologies. He is currently the Director of Product Management at 5nine and focuses on bringing world-class cloud security and management solutions ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 7/9/2020
Omdia Research Launches Page on Dark Reading
Tim Wilson, Editor in Chief, Dark Reading 7/9/2020
4 Security Tips as the July 15 Tax-Day Extension Draws Near
Shane Buckley, President & Chief Operating Officer, Gigamon,  7/10/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal, a Dark Reading Perspective
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
The Threat from the Internetand What Your Organization Can Do About It
The Threat from the Internetand What Your Organization Can Do About It
This report describes some of the latest attacks and threats emanating from the Internet, as well as advice and tips on how your organization can mitigate those threats before they affect your business. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-15105
PUBLISHED: 2020-07-10
Django Two-Factor Authentication before 1.12, stores the user's password in clear text in the user session (base64-encoded). The password is stored in the session when the user submits their username and password, and is removed once they complete authentication by entering a two-factor authenticati...
CVE-2020-11061
PUBLISHED: 2020-07-10
In Bareos Director less than or equal to 16.2.10, 17.2.9, 18.2.8, and 19.2.7, a heap overflow allows a malicious client to corrupt the director's memory via oversized digest strings sent during initialization of a verify job. Disabling verify jobs mitigates the problem. This issue is also patched in...
CVE-2020-4042
PUBLISHED: 2020-07-10
Bareos before version 19.2.8 and earlier allows a malicious client to communicate with the director without knowledge of the shared secret if the director allows client initiated connection and connects to the client itself. The malicious client can replay the Bareos director's cram-md5 challenge to...
CVE-2020-11081
PUBLISHED: 2020-07-10
osquery before version 4.4.0 enables a priviledge escalation vulnerability. If a Window system is configured with a PATH that contains a user-writable directory then a local user may write a zlib1.dll DLL, which osquery will attempt to load. Since osquery runs with elevated privileges this enables l...
CVE-2020-6114
PUBLISHED: 2020-07-10
An exploitable SQL injection vulnerability exists in the Admin Reports functionality of Glacies IceHRM v26.6.0.OS (Commit bb274de1751ffb9d09482fd2538f9950a94c510a) . A specially crafted HTTP request can cause SQL injection. An attacker can make an authenticated HTTP request to trigger this vulnerabi...