Partner Perspectives  Connecting marketers to our tech communities.
SPONSORED BY
8/16/2017
09:00 AM
Tim Prendergast
Tim Prendergast
Partner Perspectives
Connect Directly
Twitter
LinkedIn
RSS
50%
50%

Cloud Complexity Mandates Security Visibility

The cloud is flexible, but security should be the top priority.

While cloud adoption continues at a fiery pace, the speed to migrate to this new platform sometimes comes at the cost of attention to critical security needs. CIOs certainly recognize and plan for data security, but because the cloud operates as a new paradigm, some IT professionals don’t fully understand the complexity of their new environment and how to be secure within it.

Ironically, the cloud is definitely a more complex environment, but it is also more flexible in serving customer's needs. To build an effective and secure cloud environment, your organization needs visibility across how your data and users are engaging with your environment, and how your various stakeholders are changing your infrastructure.

Let's first think about complexity, and we can start by questioning what that means in the context of a public cloud platform. Complexity doesn't have to mean difficult, however, and this is an important distinction. Among the selling points of the cloud is that it makes the life of IT admins easier; fewer physical assets to manage, a decreased reliance on technology expertise, and an easing of the overall technology coordination burden. While these things are true, ease of use and an elimination of some of the more arduous management duties is only part of the cloud story.

There are two aspects related to security that require attention, and herein is where you can see where things can get a bit complex:

  1. Cloud vendors use a shared responsibility model for how security management is conducted. This requires customers to maintain an always-on awareness of their responsibilities within the cloud. It is ultimately up to you as the cloud customer to ensure a secure and compliant environment for your own operations. Less work perhaps, because you don’t have physical assets to manage, but far from easy.     
  2. The cloud stack is made up of various elements, and each one requires different security and compliance requirements. The storage layer, for example, requires securing data access, having data encryption policies, and other types of rules for things like logging and versioning. With six different layers of the cloud stack, and with dependencies among them, there has to be some level of continuous coordination to ensure these pieces are all secure and compliant.

While I hope I've made the case for recognizing and handling complexity, it's also really important to understand that with the right type of security tools, much of the work of identifying vulnerabilities in the cloud can be handled in a continuous, automated way; this is one of the ways we distinguish between complexity and difficulty. All this complexity can be mitigated, in terms of the amount of work, but to do so requires visibility.

Cloud security is, in large part, about awareness. This includes the need to maintain visibility into your cloud environment at all times, the ability to act upon any issues identified to mitigate risks, and the need for increased automation of security efforts to apply emerging best practices as consistent and enforceable behaviors.

It’s impossible to properly secure dynamic cloud environments without truly knowing every interaction within your environment and in all corners of your cloud. In today's cloud platforms, however, things like elastic infrastructures and API-driven cloud service suites have changed the way security needs to be architected, implemented, and managed throughout the workload lifecycle.

The lack of skilled cloud resources has further compounded the problem. Countless IT and cloud security teams grapple with the ambiguity of what to monitor, when to monitor it, how to identify evidence of compliance, overall reporting requirements, and so on. What is clear is the need for automation in dynamic, cloud-centric environments. Without continuous automation and assessment, organizations lack timely visibility into infrastructure configuration and workload risk and will have a hard time proving any form of compliance in the cloud.

With increased visibility, teams can quickly mitigate the most common vulnerabilities in minutes to drastically reduce the organization’s threat surface, and then focus resources on issues that require more time and attention to fix. 

Tim Prendergast co-founded Evident.io to help others avoid the pain he endured when helping Adobe adopt the cloud at a massive level.  After years of building, operating, and securing services in Amazon Web Services, he set out to make security approachable and ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Election Websites, Back-End Systems Most at Risk of Cyberattack in Midterms
Kelly Jackson Higgins, Executive Editor at Dark Reading,  8/14/2018
Intel Reveals New Spectre-Like Vulnerability
Curtis Franklin Jr., Senior Editor at Dark Reading,  8/15/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-13435
PUBLISHED: 2018-08-16
** DISPUTED ** An issue was discovered in the LINE jp.naver.line application 8.8.0 for iOS. The Passcode feature allows authentication bypass via runtime manipulation that forces a certain method to disable passcode authentication. NOTE: the vendor indicates that this is not an attack of interest w...
CVE-2018-13446
PUBLISHED: 2018-08-16
** DISPUTED ** An issue was discovered in the LINE jp.naver.line application 8.8.1 for Android. The Passcode feature allows authentication bypass via runtime manipulation that forces a certain method's return value to true. In other words, an attacker could authenticate with an arbitrary passcode. ...
CVE-2018-14567
PUBLISHED: 2018-08-16
libxml2 2.9.8, if --with-lzma is used, allows remote attackers to cause a denial of service (infinite loop) via a crafted XML file that triggers LZMA_MEMLIMIT_ERROR, as demonstrated by xmllint, a different vulnerability than CVE-2015-8035 and CVE-2018-9251.
CVE-2018-15122
PUBLISHED: 2018-08-16
An issue found in Progress Telerik JustAssembly through 2018.1.323.2 and JustDecompile through 2018.2.605.0 makes it possible to execute code by decompiling a compiled .NET object (such as DLL or EXE) with an embedded resource file by clicking on the resource.
CVE-2018-11509
PUBLISHED: 2018-08-16
ASUSTOR ADM 3.1.0.RFQ3 uses the same default root:admin username and password as it does for the NAS itself for applications that are installed from the online repository. This may allow an attacker to login and upload a webshell.