Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Cloud

6/19/2018
10:30 AM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail vvv
100%
0%

5 Tips for Integrating Security Best Practices into Your Cloud Strategy

Do 'cloud-first' strategies create a security-second mindset?

Too often, I hear system administrators tell me that their organization's cloud-first strategy is jeopardizing security. With each new software-, infrastructure, and platform-as-a-service adopted by line-of-business users or within enterprise IT, security seems to be an afterthought.

The challenge with most cloud-first strategies is that they incorporate both hybrid cloud (private and public) and multicloud (heterogeneous cloud infrastructures from multiple vendors) environments; in almost all cases, these infrastructures lack consistency in management interfaces, access controls, and third-party tool support. So, not only do cloud-first strategies increase your organization's attack surface, they can be difficult to manage and secure.

Here's a simple list of best practices that organizations can implement to ensure their cloud-first strategy is optimized for security:

1. Automate Everything
Automation is a critical security practice that helps avoid misconfigurations, ensure consistency, and manage turnover and organizational change. Although highly technical experts can develop their own automation scripts, many organizations will need third-party tools and platforms to guide their automation efforts. (Full disclosure: 5nine is among a number of companies that provide such services.) Regardless of your automation approach, there are some best practices that everyone should implement.

  • Build a work culture of templating configurations: virtual machines (VMs), firewall rules, permissions, users ― everything. Continuously clone objects, workloads, and settings to maintain consistency through constant change.  
  • Configure alerts to flag possible security vulnerabilities, such as log-in attempts, traffic anomalies, and system changes.
  • Implement intrusion detection and prevention systems that do the hard work for you. Hacking attempts and distributed denial-of-service exploits are on the rise, and malicious actors understand the vulnerabilities of the cloud; adopt a platform that proactively identifies and prevents attacks.
  • Use scripting or third-party security platforms to create workflows that automatically apply a consistent set of security settings to each new VM added to the network.

2. Adopt Platforms, Tools, and Solutions That Support Hybrid and Multicloud Environments
Agility, resilience, and speed are baked into the development of every cloud implementation; they are why organizations adopt cloud-first strategies. But without the proper tools, sys admins can't effectively manage and protect their evolving cloud landscape, negating these benefits. As you plan your cloud strategy, the right tools and a detailed road map are essential for supporting a successful transition. Start by assuming that at some point, if not already, some of your workload will move to the public cloud, so you'll really be managing a hybrid environment.

Next, it's highly like that the people supporting your data center will also support your cloud, so to avoid misconfigurations and minimize complexity, adopt management and security solutions that support hybrid cloud scenarios. It's also likely your environment will evolve to include more than one cloud service. Whether through a merger or acquisition, adopted in a development lab or acquired elsewhere, you may be faced with a combination of Microsoft Azure, Amazon Web Services, and/or Google cloud environments. Procure technologies that will or plan to support multiple clouds to ensure a sustainable management and security model in this situation.

3. Consistently Apply Access Controls for Roles and Tenants
With each new cloud technology brought into the enterprise, identity and access management becomes increasingly difficult. It's important that enterprises develop an onboarding system to clone and provision administrative rights based on role and tenant access. In the absence of a third-party solution that consistently applies permissions across cloud deployments, cloud technologies should be centrally procured and permissioned according to internal and regulatory compliance mandates. Cross-cloud permissions and roles should also be centrally documented, in case an auditor ever inquires.  

4. Use Dashboards to Monitor Security Issues across Cloud Instances
Dashboards provide an excellent way to quickly review security metrics across disparate VMs, hosts, data centers, and cloud instances. Ideally, you're implementing a platform that unifies these views in a single screen. However, you can always monitor individual VMs by opening separate windows. Dashboard views have the obvious advantages of a consistent look and feel, convenience, and simplicity.

5. Back Up Workloads at Least Twice Daily ― Be Ready to Recover on a Moment's Notice
Backup and recovery are critical for security in hybrid and multicloud environments. They are the only ways to ensure that risks such as ransomware or misconfigurations don't permanently damage your overall cloud infrastructure and impact your ability to serve customers. But because each cloud service has its own native functionality, backing up across multiple environments is extremely challenging. While you can use each cloud's native backup functionality, it's always best to adopt a backup and recovery solution that supports your entire cloud environment.

Does Cloud-First Mean Security Is Second?
No. With the right mindset, best practices, and third-party tools, you can build a sustainable security model for your organization's cloud-first strategy. Administrators must assess the security gaps inherent in hybrid and multicloud environments, then collaborate with executives on implementing the right unified cloud management and security solutions that will evolve with their overall cloud implementation.

Related Content:

Why Cybercriminals Attack: A DARK READING VIRTUAL EVENT Wednesday, June 27. Industry experts will offer a range of information and insight on who the bad guys are – and why they might be targeting your enterprise. Go here for more information on this free event.

Robert Corradini is a two-time Microsoft Azure and Hyper-V MVP with over 20 years of experience managing cloud and data center technologies. He is currently the Director of Product Management at 5nine and focuses on bringing world-class cloud security and management solutions ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Black Hat Q&A: Hacking a '90s Sports Car
Black Hat Staff, ,  11/7/2019
The Cold Truth about Cyber Insurance
Chris Kennedy, CISO & VP Customer Success, AttackIQ,  11/7/2019
6 Small-Business Password Managers
Curtis Franklin Jr., Senior Editor at Dark Reading,  11/8/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
Assessing Cybersecurity Risk in Today's Enterprise
Assessing Cybersecurity Risk in Today's Enterprise
Security leaders are struggling to understand their organizations risk exposure. While many are confident in their security strategies and processes, theyre also more concerned than ever about getting breached. Download this report today and get insights on how today's enterprises assess and perceive the risks they face in 2019!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2011-5271
PUBLISHED: 2019-11-12
Pacemaker before 1.1.6 configure script creates temporary files insecurely
CVE-2014-3599
PUBLISHED: 2019-11-12
HornetQ REST is vulnerable to XML External Entity due to insecure configuration of RestEasy
CVE-2014-7143
PUBLISHED: 2019-11-12
Python Twisted 14.0 trustRoot is not respected in HTTP client
CVE-2018-18819
PUBLISHED: 2019-11-12
A vulnerability in the web conference chat component of MiCollab, versions 7.3 PR6 (7.3.0.601) and earlier, and 8.0 (8.0.0.40) through 8.0 SP2 FP2 (8.0.2.202), and MiVoice Business Express versions 7.3 PR3 (7.3.1.302) and earlier, and 8.0 (8.0.0.40) through 8.0 SP2 FP1 (8.0.2.202), could allow creat...
CVE-2019-18658
PUBLISHED: 2019-11-12
In Helm 2.x before 2.15.2, commands that deal with loading a chart as a directory or packaging a chart provide an opportunity for a maliciously designed chart to include sensitive content such as /etc/passwd, or to execute a denial of service (DoS) via a special file such as /dev/urandom, via symlin...