Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Perimeter

7/9/2019
02:00 PM
Derrick Johnson
Derrick Johnson
Commentary
Connect Directly
Twitter
LinkedIn
RSS
E-Mail vvv
50%
50%

Cloud Security and Risk Mitigation

Just because your data isn't on-premises doesn't mean you're not responsible for security.

The cloud certainly offers advantages, but as with any large-scale deployment, the cloud can also offer unforeseen challenges. The concept of the cloud just being "someone else's data center" makes me cringe because it assumes you're relinquishing security responsibility because "someone else will take care of it."

Yes, cloud systems, networks, and applications are not physically located within your control, but security responsibility and risk mitigation are. Cloud infrastructure providers allow a great deal of control in terms of how you set up that environment, what you put there, how you protect your data, and how you monitor that environment. Managing risk throughout that environment and providing alignment with your existing security framework is what's most important. 

Privacy and Risk
With the EU's General Data Protection Regulation and similar policies in some US states (Arizona, Colorado, California, and others), organizations face increased requirements when protecting data in the cloud. And the solution isn't as simple as deploying data loss prevention software in a data center because the data center has become fragmented. You now have a bunch of services, systems, and infrastructures that aren't owned by you but still require visibility and control.

Cloud services and infrastructures that share or exchange information also become difficult to manage: Who owns the service-level agreements? Is there a single pane of glass that monitors everything? DevOps has forced corporations to go as far as implementing microsegmentation and adjusting processes around firewall rule change management. Furthermore, serverless computing has provided organizations with a way to cut costs and speed productivity by allowing developers to run code without having to worry about infrastructures and platforms. Without a handle on virtual private clouds and workload deployments, however, things can spin out of control and you start to see data leaking from one environment just as you've achieved a comfortable level of security in another.

Mitigation
Several steps can be taken to help mitigate risk to an organization's data in the cloud.

1. Design to align. First, align your cloud environment with cybersecurity frameworks. Often, organizations move to the cloud so rapidly that the security controls historically applied to their on-premises data centers don't migrate effectively to the cloud. Furthermore, an organization may relax the security microscope on software-as-a-service (SaaS) applications such as Salesforce or Office 365. But even with these legitimate business applications, data may end up being leaked if you don't have the right visibility and control. Aligning cloud provider technology with cybersecurity frameworks and business operating procedures provides for a highly secure, more productive implementation of a cloud platform, giving better results and a successful deployment.

2. Make yourself at home. Cloud systems and networks should be treated the way you treat your LAN and data center. Amazon's Shared Responsibility Model, for example, outlines where Amazon's security responsibility ends and your security responsibility begins. While threats at the compute layer exist — as we've seen with Meltdown, Foreshadow, and Spectre — recent cloud data breaches have shown a breakdown in an organization's security responsibility area, namely operating system security, data encryption, and access control. If your organization has standards that govern the configuration of servers, vulnerability management, patching, identity and access management, encryption, segmentation, firewall rules, application development, and monitoring, see to it that those standards are applied to cloud services and are audited regularly.

3. Stop the "sneaking out at night." Not too long ago, you would see organizations struggle with employees who set up unsecured wireless access points in an attempt to gain flexibility and efficiency. Fast forward to today — wireless controllers providing rogue detection and intrusion prevention system capabilities have helped rein in that activity. With the cloud, employees are setting up cloud storage accounts, serverless computing environments, and virtual private networks as needed to circumvent cumbersome change control procedures, cut costs, and gain similar flexibility and efficiency. By rearchitecting legacy networks, readjusting decades-old processes and procedures, implementing cloud proxy or cloud access security broker (CASB) technology, and coupling that with strong endpoint security controls and an effective awareness campaign, an organization can provide that level of flexibility and efficiency but still provide for data protection.

4. Keep a close watch. The cybersecurity operations center (CSOC) should no longer be concerned with just the local network and data centers. The operational monitoring procedures, threat hunting, intelligence, and incident response that the SOC uses also apply to cloud environments where the organization's data resides. Monitoring SaaS applications where corporate data may reside is challenging but can be done using effective endpoint security coupled with the monitoring of cloud access solutions (CASB, proxy, and others). For a serverless environment, depending on your CSOC requirements, this may mean the application of third-party monitoring platforms or solutions beyond what cloud providers offer. In all cases, event logging and triggers need to feed back to the CSOC to be correlated with local event data, analytics, and threat intelligence.

With all the cloud services available, it's no wonder companies struggle to manage risk. Shifting from a culture of "do whatever it takes to get the job done" to "do what is right for the business" takes a lot of coordinated effort and time but is rooted in security becoming a business enabler rather than continuing to be in the business of "no."

Organizations must include security in technology decisions if security is to continue to protect the business, and security must understand the needs of the business and changes in technology in order to be that enabler. To help to prevent people from seeking their own solutions to technology problems, IT and security teams must evolve their assets and functions to accommodate that speed and convenience or find themselves constantly trying to keep up. 

Related Content:

 

Black Hat USA returns to Las Vegas with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions and service providers in the Business Hall. Click for information on the conference and to register.

 

Derrick Johnson is the National Practice Director for Secure Infrastructure Services within AT&T Cybersecurity Consulting, responsible for its direction and overall business performance. Derrick's practice provides strategic and tactical cybersecurity consulting services ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
REISEN1955
50%
50%
REISEN1955,
User Rank: Ninja
7/9/2019 | 2:24:03 PM
What I have been saying for years
There is nothing real called a CLOUD ---- it is an extremely long RJ-45 or fibre-optic cable from your endpoint in your building TO something else - server, datacenter - in another location FAR FAR away under somebody else's hand control.  God knows who THEY are and what they can do with the data.  Woz - the great one from Apple - said years ago that there is NO security in the cloud.  Fools think it is more secure than other choices - it is perhaps less secure because of somebody else's hands on a keyboard.  Warning posted
Mobile Banking Malware Up 50% in First Half of 2019
Kelly Sheridan, Staff Editor, Dark Reading,  1/17/2020
Active Directory Needs an Update: Here's Why
Raz Rafaeli, CEO and Co-Founder at Secret Double Octopus,  1/16/2020
Google Lets iPhone Users Turn Device into Security Key
Kelly Sheridan, Staff Editor, Dark Reading,  1/15/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
The Year in Security: 2019
This Tech Digest provides a wrap up and overview of the year's top cybersecurity news stories. It was a year of new twists on old threats, with fears of another WannaCry-type worm and of a possible botnet army of Wi-Fi routers. But 2019 also underscored the risk of firmware and trusted security tools harboring dangerous holes that cybercriminals and nation-state hackers could readily abuse. Read more.
Flash Poll
How Enterprises are Attacking the Cybersecurity Problem
How Enterprises are Attacking the Cybersecurity Problem
Organizations have invested in a sweeping array of security technologies to address challenges associated with the growing number of cybersecurity attacks. However, the complexity involved in managing these technologies is emerging as a major problem. Read this report to find out what your peers biggest security challenges are and the technologies they are using to address them.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-16270
PUBLISHED: 2020-01-22
Samsung Galaxy Gear series before build RE2 includes the hcidump utility with no privilege or permission restriction. This allows an unprivileged process to dump Bluetooth HCI packets to an arbitrary file path.
CVE-2018-16271
PUBLISHED: 2020-01-22
The wemail_consumer_service (from the built-in application wemail) in Samsung Galaxy Gear series allows an unprivileged process to manipulate a user's mailbox, due to improper D-Bus security policy configurations. An arbitrary email can also be sent from the mailbox via the paired smartphone. This a...
CVE-2018-16272
PUBLISHED: 2020-01-22
The wpa_supplicant system service in Samsung Galaxy Gear series allows an unprivileged process to fully control the Wi-Fi interface, due to the lack of its D-Bus security policy configurations. This affects Tizen-based firmwares including Samsung Galaxy Gear series before build RE2.
CVE-2019-10780
PUBLISHED: 2020-01-22
BibTeX-ruby before 5.1.0 allows shell command injection due to unsanitized user input being passed directly to the built-in Ruby Kernel.open method through BibTeX.open.
CVE-2019-10781
PUBLISHED: 2020-01-22
In schema-inspector before 1.6.9, a maliciously crafted JavaScript object can bypass the `sanitize()` and the `validate()` function used within schema-inspector.