Partner Perspectives  Connecting marketers to our tech communities.
SPONSORED BY
8/16/2017
09:00 AM
Tim Prendergast
Tim Prendergast
Partner Perspectives
Connect Directly
Twitter
LinkedIn
RSS
50%
50%

Cloud Complexity Mandates Security Visibility

The cloud is flexible, but security should be the top priority.

While cloud adoption continues at a fiery pace, the speed to migrate to this new platform sometimes comes at the cost of attention to critical security needs. CIOs certainly recognize and plan for data security, but because the cloud operates as a new paradigm, some IT professionals don’t fully understand the complexity of their new environment and how to be secure within it.

Ironically, the cloud is definitely a more complex environment, but it is also more flexible in serving customer's needs. To build an effective and secure cloud environment, your organization needs visibility across how your data and users are engaging with your environment, and how your various stakeholders are changing your infrastructure.

Let's first think about complexity, and we can start by questioning what that means in the context of a public cloud platform. Complexity doesn't have to mean difficult, however, and this is an important distinction. Among the selling points of the cloud is that it makes the life of IT admins easier; fewer physical assets to manage, a decreased reliance on technology expertise, and an easing of the overall technology coordination burden. While these things are true, ease of use and an elimination of some of the more arduous management duties is only part of the cloud story.

There are two aspects related to security that require attention, and herein is where you can see where things can get a bit complex:

  1. Cloud vendors use a shared responsibility model for how security management is conducted. This requires customers to maintain an always-on awareness of their responsibilities within the cloud. It is ultimately up to you as the cloud customer to ensure a secure and compliant environment for your own operations. Less work perhaps, because you don’t have physical assets to manage, but far from easy.     
  2. The cloud stack is made up of various elements, and each one requires different security and compliance requirements. The storage layer, for example, requires securing data access, having data encryption policies, and other types of rules for things like logging and versioning. With six different layers of the cloud stack, and with dependencies among them, there has to be some level of continuous coordination to ensure these pieces are all secure and compliant.

While I hope I've made the case for recognizing and handling complexity, it's also really important to understand that with the right type of security tools, much of the work of identifying vulnerabilities in the cloud can be handled in a continuous, automated way; this is one of the ways we distinguish between complexity and difficulty. All this complexity can be mitigated, in terms of the amount of work, but to do so requires visibility.

Cloud security is, in large part, about awareness. This includes the need to maintain visibility into your cloud environment at all times, the ability to act upon any issues identified to mitigate risks, and the need for increased automation of security efforts to apply emerging best practices as consistent and enforceable behaviors.

It’s impossible to properly secure dynamic cloud environments without truly knowing every interaction within your environment and in all corners of your cloud. In today's cloud platforms, however, things like elastic infrastructures and API-driven cloud service suites have changed the way security needs to be architected, implemented, and managed throughout the workload lifecycle.

The lack of skilled cloud resources has further compounded the problem. Countless IT and cloud security teams grapple with the ambiguity of what to monitor, when to monitor it, how to identify evidence of compliance, overall reporting requirements, and so on. What is clear is the need for automation in dynamic, cloud-centric environments. Without continuous automation and assessment, organizations lack timely visibility into infrastructure configuration and workload risk and will have a hard time proving any form of compliance in the cloud.

With increased visibility, teams can quickly mitigate the most common vulnerabilities in minutes to drastically reduce the organization’s threat surface, and then focus resources on issues that require more time and attention to fix. 

Tim Prendergast co-founded Evident.io to help others avoid the pain he endured when helping Adobe adopt the cloud at a massive level.  After years of building, operating, and securing services in Amazon Web Services, he set out to make security approachable and ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Threaded  |  Newest First  |  Oldest First
Valentine's Emails Laced with Gandcrab Ransomware
Kelly Sheridan, Staff Editor, Dark Reading,  2/14/2019
High Stress Levels Impacting CISOs Physically, Mentally
Jai Vijayan, Freelance writer,  2/14/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
5 Emerging Cyber Threats to Watch for in 2019
Online attackers are constantly developing new, innovative ways to break into the enterprise. This Dark Reading Tech Digest gives an in-depth look at five emerging attack trends and exploits your security team should look out for, along with helpful recommendations on how you can prevent your organization from falling victim.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-8396
PUBLISHED: 2019-02-17
A buffer overflow in H5O__layout_encode in H5Olayout.c in the HDF HDF5 through 1.10.4 library allows attackers to cause a denial of service via a crafted HDF5 file. This issue was triggered while repacking an HDF5 file, aka "Invalid write of size 2."
CVE-2019-8397
PUBLISHED: 2019-02-17
An issue was discovered in the HDF HDF5 1.10.4 library. There is an out of bounds read in the function H5T_close_real in H5T.c.
CVE-2019-8398
PUBLISHED: 2019-02-17
An issue was discovered in the HDF HDF5 1.10.4 library. There is an out of bounds read in the function H5T_get_size in H5T.c.
CVE-2019-8400
PUBLISHED: 2019-02-17
ORY Hydra before v1.0.0-rc.3+oryOS.9 has Reflected XSS via the oauth2/fallbacks/error error_hint parameter.
CVE-2019-7399
PUBLISHED: 2019-02-17
Amazon Fire OS before 5.3.6.4 allows a man-in-the-middle attack against HTTP requests for "Terms of Use" and Privacy pages.