Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Cloud

9/15/2016
10:00 AM
Stan Black
Stan Black
Commentary
Connect Directly
LinkedIn
RSS
E-Mail vvv
100%
0%

Yes, The Cloud Can Be A Security Win

With the right controls in place, the cloud doesn't have to be a scary place. These guidelines can help your company stay safe.

There are so many different kinds of clouds — public, private, hybrid, internal — that many businesses and customers have difficulty deciding which is the right one for them. Furthermore, many businesses may use a few different variations of cloud environments — a private cloud for their own intranet, a hybrid cloud to keep some data on premises and some off premises to meet compliance regulations, and a public cloud for low-risk data.

These different types of environments make it difficult for IT and security teams to monitor every cloud on every device, or to monitor access requests for each different type of cloud environment. If you don’t control the cloud or where your data and apps reside, don’t manage them, or don’t know what you have in the cloud, your risk starts to sprawl and you don’t even know what’s happened when there’s a breach — or where to start to remediate. Follow these guidelines to make sure you avoid the cloud’s possible pitfalls.

1) Decide which kind of cloud is right for you from a security perspective.
Companies must stop treating the cloud as if it were their data center. Once data is in the cloud, it’s in a shared domain. With a public cloud, businesses have to relinquish a perceived level of control and decide if they’re comfortable with that. They need to determine if the third party (or parties) managing their cloud meets their security requirements and compliance regulations, and if there’s a clear path for accountability, threat management, and response. These days, it’s not if an attack will happen, but when.

2) Increase and improve cloud security and control.
Cloud management and security is all about control. The cloud environment you pick should depend on the level of control you want for your business. Former President Ronald Reagan used the Russian proverb “Trust, but verify” in his relations with the country. We’re going to borrow that attitude for security. Some organizations tend to enable product capabilities or features such as the “any/any” firewall rule, which allows “anything” onto the network. But that any/any rule then instructs the network to drop a potentially nasty network packet without logging it so that it can be flagged or investigated, making it impossible to find the cause of a problem if that nasty packet makes its way onto the network.

A general rule of thumb for the cloud is, “Don’t turn on anything you don’t understand.” Malicious actors know that companies allow encrypted traffic in and out every day, so they encrypt their own command and control traffic, making it harder for network security add-on technology to see it and flag it for human attention and remediation. Using the trust-but-verify model creates a good reminder for IT and security operations (SecOps) teams to go back periodically and check on active security features and policies to make sure they have the right access, rights, rules, and trust in place. Such things are easier to enable than to revoke, and SecOps teams have real threats to manage instead of monitoring how many people are sharing credentials.

3) Follow these rules of thumb when selecting or managing your cloud.

  • Ensure the cloud vendor meets and monitors compliance regulations — and checks in with you frequently so that you know your data and app security is up to date. While compliant doesn’t always equal secure, it’s a step in the right direction.
  • Construct a cloud security framework for your business to determine which applications and data are right for the cloud and which should stay on premises.
  • Create a trust-but-verify cloud security model — in other words, make sure your cloud provider does what it says it’s going to do.
  • Enforce a structured release of data. Create cloud security policies for employees, contractors, and customers, and enforce them. Make those policies “aware” of what’s going in and out of your cloud to recognize usual and unusual behavior to flag as necessary.
  • Always use multifactor authentication for employees or contractors trying to access your cloud. Make sure they’re required to provide the right level of authentication before they’re able to access data from a new location or device. For contractors, make sure you set parameters on how long they’re able to access the data and from where.

4) Keep track of what you have to mitigate risk.
Compliance is a huge piece of the cloud security puzzle, but compliance doesn’t always equal secure. Many of today’s attacks happen simply because contractors, partners, and/or service providers aren’t up to speed on company security policies. Make sure you have a plan in place to keep track of the data you have in the cloud, who’s accessing it, and why.

With the right controls in place, the cloud doesn’t need to be as scary as some make it out to be. This digital transformation we’re seeing across the industry has put businesses in a good position to take full advantage of the anywhere, anytime, any-device access on or off premises that’s provided by cloud solutions, but it’s critical to follow industry best practices and tips to ensure you’re picking the right cloud and the right vendor(s) as well as monitoring the security of data and applications, wherever they reside. 

Related Content:

Stan Black, CISSP, is CSIO of Citrix where he is in charge of the secure delivery of applications and data to some of the world's largest organizations in healthcare, financial services, public sector, and manufacturing. Black defines a converged cyber security posture ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Threaded  |  Newest First  |  Oldest First
Whoopty
50%
50%
Whoopty,
User Rank: Ninja
9/19/2016 | 8:02:51 AM
I should do this more often
I really should consider more points when picking a cloud provider. I must admit I just get lazy with it though. When we have one that seems to work pretty well, I stick with them because it feels like quite a hassle to change. 

I'll make a point of checking our current provider now though to make sure it's ticking a lot of these boxes. 
semidot
50%
50%
semidot,
User Rank: Apprentice
6/7/2018 | 7:39:32 AM
Cloud
Cloud is offering good features.
Mobile Banking Malware Up 50% in First Half of 2019
Kelly Sheridan, Staff Editor, Dark Reading,  1/17/2020
7 Tips for Infosec Pros Considering A Lateral Career Move
Kelly Sheridan, Staff Editor, Dark Reading,  1/21/2020
For Mismanaged SOCs, The Price Is Not Right
Kelly Sheridan, Staff Editor, Dark Reading,  1/22/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment:   It's a PEN test of our cloud security.
Current Issue
IT 2020: A Look Ahead
Are you ready for the critical changes that will occur in 2020? We've compiled editor insights from the best of our network (Dark Reading, Data Center Knowledge, InformationWeek, ITPro Today and Network Computing) to deliver to you a look at the trends, technologies, and threats that are emerging in the coming year. Download it today!
Flash Poll
How Enterprises are Attacking the Cybersecurity Problem
How Enterprises are Attacking the Cybersecurity Problem
Organizations have invested in a sweeping array of security technologies to address challenges associated with the growing number of cybersecurity attacks. However, the complexity involved in managing these technologies is emerging as a major problem. Read this report to find out what your peers biggest security challenges are and the technologies they are using to address them.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-7245
PUBLISHED: 2020-01-23
Incorrect username validation in the registration processes of CTFd through 2.2.2 allows a remote attacker to take over an arbitrary account after initiating a password reset. This is related to register() and reset_password() in auth.py. To exploit the vulnerability, one must register with a userna...
CVE-2019-14885
PUBLISHED: 2020-01-23
A flaw was found in the JBoss EAP Vault system in all versions before 7.2.6.GA. Confidential information of the system property's security attribute value is revealed in the JBoss EAP log file when executing a JBoss CLI 'reload' command. This flaw can lead to the exposure of confidential information...
CVE-2019-17570
PUBLISHED: 2020-01-23
An untrusted deserialization was found in the org.apache.xmlrpc.parser.XmlRpcResponseParser:addResult method of Apache XML-RPC (aka ws-xmlrpc) library. A malicious XML-RPC server could target a XML-RPC client causing it to execute arbitrary code. Apache XML-RPC is no longer maintained and this issue...
CVE-2020-6007
PUBLISHED: 2020-01-23
Philips Hue Bridge model 2.X prior to and including version 1935144020 contains a Heap-based Buffer Overflow when handling a long ZCL string during the commissioning phase, resulting in a remote code execution.
CVE-2012-4606
PUBLISHED: 2020-01-23
Citrix XenServer 4.1, 6.0, 5.6 SP2, 5.6 Feature Pack 1, 5.6 Common Criteria, 5.6, 5.5, 5.0, and 5.0 Update 3 contains a Local Privilege Escalation Vulnerability which could allow local users with access to a guest operating system to gain elevated privileges.