Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Cloud

6/19/2018
10:30 AM
Connect Directly
LinkedIn
Twitter
RSS
E-Mail vvv
100%
0%

5 Tips for Integrating Security Best Practices into Your Cloud Strategy

Do 'cloud-first' strategies create a security-second mindset?

Too often, I hear system administrators tell me that their organization's cloud-first strategy is jeopardizing security. With each new software-, infrastructure, and platform-as-a-service adopted by line-of-business users or within enterprise IT, security seems to be an afterthought.

The challenge with most cloud-first strategies is that they incorporate both hybrid cloud (private and public) and multicloud (heterogeneous cloud infrastructures from multiple vendors) environments; in almost all cases, these infrastructures lack consistency in management interfaces, access controls, and third-party tool support. So, not only do cloud-first strategies increase your organization's attack surface, they can be difficult to manage and secure.

Here's a simple list of best practices that organizations can implement to ensure their cloud-first strategy is optimized for security:

1. Automate Everything
Automation is a critical security practice that helps avoid misconfigurations, ensure consistency, and manage turnover and organizational change. Although highly technical experts can develop their own automation scripts, many organizations will need third-party tools and platforms to guide their automation efforts. (Full disclosure: 5nine is among a number of companies that provide such services.) Regardless of your automation approach, there are some best practices that everyone should implement.

  • Build a work culture of templating configurations: virtual machines (VMs), firewall rules, permissions, users ― everything. Continuously clone objects, workloads, and settings to maintain consistency through constant change.  
  • Configure alerts to flag possible security vulnerabilities, such as log-in attempts, traffic anomalies, and system changes.
  • Implement intrusion detection and prevention systems that do the hard work for you. Hacking attempts and distributed denial-of-service exploits are on the rise, and malicious actors understand the vulnerabilities of the cloud; adopt a platform that proactively identifies and prevents attacks.
  • Use scripting or third-party security platforms to create workflows that automatically apply a consistent set of security settings to each new VM added to the network.

2. Adopt Platforms, Tools, and Solutions That Support Hybrid and Multicloud Environments
Agility, resilience, and speed are baked into the development of every cloud implementation; they are why organizations adopt cloud-first strategies. But without the proper tools, sys admins can't effectively manage and protect their evolving cloud landscape, negating these benefits. As you plan your cloud strategy, the right tools and a detailed road map are essential for supporting a successful transition. Start by assuming that at some point, if not already, some of your workload will move to the public cloud, so you'll really be managing a hybrid environment.

Next, it's highly like that the people supporting your data center will also support your cloud, so to avoid misconfigurations and minimize complexity, adopt management and security solutions that support hybrid cloud scenarios. It's also likely your environment will evolve to include more than one cloud service. Whether through a merger or acquisition, adopted in a development lab or acquired elsewhere, you may be faced with a combination of Microsoft Azure, Amazon Web Services, and/or Google cloud environments. Procure technologies that will or plan to support multiple clouds to ensure a sustainable management and security model in this situation.

3. Consistently Apply Access Controls for Roles and Tenants
With each new cloud technology brought into the enterprise, identity and access management becomes increasingly difficult. It's important that enterprises develop an onboarding system to clone and provision administrative rights based on role and tenant access. In the absence of a third-party solution that consistently applies permissions across cloud deployments, cloud technologies should be centrally procured and permissioned according to internal and regulatory compliance mandates. Cross-cloud permissions and roles should also be centrally documented, in case an auditor ever inquires.  

4. Use Dashboards to Monitor Security Issues across Cloud Instances
Dashboards provide an excellent way to quickly review security metrics across disparate VMs, hosts, data centers, and cloud instances. Ideally, you're implementing a platform that unifies these views in a single screen. However, you can always monitor individual VMs by opening separate windows. Dashboard views have the obvious advantages of a consistent look and feel, convenience, and simplicity.

5. Back Up Workloads at Least Twice Daily ― Be Ready to Recover on a Moment's Notice
Backup and recovery are critical for security in hybrid and multicloud environments. They are the only ways to ensure that risks such as ransomware or misconfigurations don't permanently damage your overall cloud infrastructure and impact your ability to serve customers. But because each cloud service has its own native functionality, backing up across multiple environments is extremely challenging. While you can use each cloud's native backup functionality, it's always best to adopt a backup and recovery solution that supports your entire cloud environment.

Does Cloud-First Mean Security Is Second?
No. With the right mindset, best practices, and third-party tools, you can build a sustainable security model for your organization's cloud-first strategy. Administrators must assess the security gaps inherent in hybrid and multicloud environments, then collaborate with executives on implementing the right unified cloud management and security solutions that will evolve with their overall cloud implementation.

Related Content:

Why Cybercriminals Attack: A DARK READING VIRTUAL EVENT Wednesday, June 27. Industry experts will offer a range of information and insight on who the bad guys are – and why they might be targeting your enterprise. Go here for more information on this free event.

Robert Corradini is a two-time Microsoft Azure and Hyper-V MVP with over 20 years of experience managing cloud and data center technologies. He is currently the Director of Product Management at 5nine and focuses on bringing world-class cloud security and management solutions ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 8/3/2020
Pen Testers Who Got Arrested Doing Their Jobs Tell All
Kelly Jackson Higgins, Executive Editor at Dark Reading,  8/5/2020
Browsers to Enforce Shorter Certificate Life Spans: What Businesses Should Know
Kelly Sheridan, Staff Editor, Dark Reading,  7/30/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Special Report: Computing's New Normal, a Dark Reading Perspective
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
The Changing Face of Threat Intelligence
The Changing Face of Threat Intelligence
This special report takes a look at how enterprises are using threat intelligence, as well as emerging best practices for integrating threat intel into security operations and incident response. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-17366
PUBLISHED: 2020-08-05
An issue was discovered in NLnet Labs Routinator 0.1.0 through 0.7.1. It allows remote attackers to bypass intended access restrictions or to cause a denial of service on dependent routing systems by strategically withholding RPKI Route Origin Authorisation ".roa" files or X509 Certificate...
CVE-2020-9036
PUBLISHED: 2020-08-05
Jeedom through 4.0.38 allows XSS.
CVE-2020-15127
PUBLISHED: 2020-08-05
In Contour ( Ingress controller for Kubernetes) before version 1.7.0, a bad actor can shut down all instances of Envoy, essentially killing the entire ingress data plane. GET requests to /shutdown on port 8090 of the Envoy pod initiate Envoy's shutdown procedure. The shutdown procedure includes flip...
CVE-2020-15132
PUBLISHED: 2020-08-05
In Sulu before versions 1.6.35, 2.0.10, and 2.1.1, when the "Forget password" feature on the login screen is used, Sulu asks the user for a username or email address. If the given string is not found, a response with a `400` error code is returned, along with a error message saying that th...
CVE-2020-7298
PUBLISHED: 2020-08-05
Unexpected behavior violation in McAfee Total Protection (MTP) prior to 16.0.R26 allows local users to turn off real time scanning via a specially crafted object making a specific function call.