Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Partner Perspectives  Connecting marketers to our tech communities.
SPONSORED BY
8/16/2017
09:00 AM
Tim Prendergast
Tim Prendergast
Partner Perspectives
Connect Directly
Twitter
LinkedIn
RSS
50%
50%

Cloud Complexity Mandates Security Visibility

The cloud is flexible, but security should be the top priority.

While cloud adoption continues at a fiery pace, the speed to migrate to this new platform sometimes comes at the cost of attention to critical security needs. CIOs certainly recognize and plan for data security, but because the cloud operates as a new paradigm, some IT professionals don’t fully understand the complexity of their new environment and how to be secure within it.

Ironically, the cloud is definitely a more complex environment, but it is also more flexible in serving customer's needs. To build an effective and secure cloud environment, your organization needs visibility across how your data and users are engaging with your environment, and how your various stakeholders are changing your infrastructure.

Let's first think about complexity, and we can start by questioning what that means in the context of a public cloud platform. Complexity doesn't have to mean difficult, however, and this is an important distinction. Among the selling points of the cloud is that it makes the life of IT admins easier; fewer physical assets to manage, a decreased reliance on technology expertise, and an easing of the overall technology coordination burden. While these things are true, ease of use and an elimination of some of the more arduous management duties is only part of the cloud story.

There are two aspects related to security that require attention, and herein is where you can see where things can get a bit complex:

  1. Cloud vendors use a shared responsibility model for how security management is conducted. This requires customers to maintain an always-on awareness of their responsibilities within the cloud. It is ultimately up to you as the cloud customer to ensure a secure and compliant environment for your own operations. Less work perhaps, because you don’t have physical assets to manage, but far from easy.     
  2. The cloud stack is made up of various elements, and each one requires different security and compliance requirements. The storage layer, for example, requires securing data access, having data encryption policies, and other types of rules for things like logging and versioning. With six different layers of the cloud stack, and with dependencies among them, there has to be some level of continuous coordination to ensure these pieces are all secure and compliant.

While I hope I've made the case for recognizing and handling complexity, it's also really important to understand that with the right type of security tools, much of the work of identifying vulnerabilities in the cloud can be handled in a continuous, automated way; this is one of the ways we distinguish between complexity and difficulty. All this complexity can be mitigated, in terms of the amount of work, but to do so requires visibility.

Cloud security is, in large part, about awareness. This includes the need to maintain visibility into your cloud environment at all times, the ability to act upon any issues identified to mitigate risks, and the need for increased automation of security efforts to apply emerging best practices as consistent and enforceable behaviors.

It’s impossible to properly secure dynamic cloud environments without truly knowing every interaction within your environment and in all corners of your cloud. In today's cloud platforms, however, things like elastic infrastructures and API-driven cloud service suites have changed the way security needs to be architected, implemented, and managed throughout the workload lifecycle.

The lack of skilled cloud resources has further compounded the problem. Countless IT and cloud security teams grapple with the ambiguity of what to monitor, when to monitor it, how to identify evidence of compliance, overall reporting requirements, and so on. What is clear is the need for automation in dynamic, cloud-centric environments. Without continuous automation and assessment, organizations lack timely visibility into infrastructure configuration and workload risk and will have a hard time proving any form of compliance in the cloud.

With increased visibility, teams can quickly mitigate the most common vulnerabilities in minutes to drastically reduce the organization’s threat surface, and then focus resources on issues that require more time and attention to fix. 

Tim Prendergast co-founded Evident.io to help others avoid the pain he endured when helping Adobe adopt the cloud at a massive level.  After years of building, operating, and securing services in Amazon Web Services, he set out to make security approachable and ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 7/9/2020
Russian Cyber Gang 'Cosmic Lynx' Focuses on Email Fraud
Kelly Sheridan, Staff Editor, Dark Reading,  7/7/2020
Why Cybersecurity's Silence Matters to Black Lives
Tiffany Ricks, CEO, HacWare,  7/8/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal, a Dark Reading Perspective
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-15105
PUBLISHED: 2020-07-10
Django Two-Factor Authentication before 1.12, stores the user's password in clear text in the user session (base64-encoded). The password is stored in the session when the user submits their username and password, and is removed once they complete authentication by entering a two-factor authenticati...
CVE-2020-11061
PUBLISHED: 2020-07-10
In Bareos Director less than or equal to 16.2.10, 17.2.9, 18.2.8, and 19.2.7, a heap overflow allows a malicious client to corrupt the director's memory via oversized digest strings sent during initialization of a verify job. Disabling verify jobs mitigates the problem. This issue is also patched in...
CVE-2020-4042
PUBLISHED: 2020-07-10
Bareos before version 19.2.8 and earlier allows a malicious client to communicate with the director without knowledge of the shared secret if the director allows client initiated connection and connects to the client itself. The malicious client can replay the Bareos director's cram-md5 challenge to...
CVE-2020-11081
PUBLISHED: 2020-07-10
osquery before version 4.4.0 enables a priviledge escalation vulnerability. If a Window system is configured with a PATH that contains a user-writable directory then a local user may write a zlib1.dll DLL, which osquery will attempt to load. Since osquery runs with elevated privileges this enables l...
CVE-2020-6114
PUBLISHED: 2020-07-10
An exploitable SQL injection vulnerability exists in the Admin Reports functionality of Glacies IceHRM v26.6.0.OS (Commit bb274de1751ffb9d09482fd2538f9950a94c510a) . A specially crafted HTTP request can cause SQL injection. An attacker can make an authenticated HTTP request to trigger this vulnerabi...