Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Cloud

6/19/2018
10:30 AM
Connect Directly
LinkedIn
Twitter
RSS
E-Mail vvv
100%
0%

5 Tips for Integrating Security Best Practices into Your Cloud Strategy

Do 'cloud-first' strategies create a security-second mindset?

Too often, I hear system administrators tell me that their organization's cloud-first strategy is jeopardizing security. With each new software-, infrastructure, and platform-as-a-service adopted by line-of-business users or within enterprise IT, security seems to be an afterthought.

The challenge with most cloud-first strategies is that they incorporate both hybrid cloud (private and public) and multicloud (heterogeneous cloud infrastructures from multiple vendors) environments; in almost all cases, these infrastructures lack consistency in management interfaces, access controls, and third-party tool support. So, not only do cloud-first strategies increase your organization's attack surface, they can be difficult to manage and secure.

Here's a simple list of best practices that organizations can implement to ensure their cloud-first strategy is optimized for security:

1. Automate Everything
Automation is a critical security practice that helps avoid misconfigurations, ensure consistency, and manage turnover and organizational change. Although highly technical experts can develop their own automation scripts, many organizations will need third-party tools and platforms to guide their automation efforts. (Full disclosure: 5nine is among a number of companies that provide such services.) Regardless of your automation approach, there are some best practices that everyone should implement.

  • Build a work culture of templating configurations: virtual machines (VMs), firewall rules, permissions, users ― everything. Continuously clone objects, workloads, and settings to maintain consistency through constant change.  
  • Configure alerts to flag possible security vulnerabilities, such as log-in attempts, traffic anomalies, and system changes.
  • Implement intrusion detection and prevention systems that do the hard work for you. Hacking attempts and distributed denial-of-service exploits are on the rise, and malicious actors understand the vulnerabilities of the cloud; adopt a platform that proactively identifies and prevents attacks.
  • Use scripting or third-party security platforms to create workflows that automatically apply a consistent set of security settings to each new VM added to the network.

2. Adopt Platforms, Tools, and Solutions That Support Hybrid and Multicloud Environments
Agility, resilience, and speed are baked into the development of every cloud implementation; they are why organizations adopt cloud-first strategies. But without the proper tools, sys admins can't effectively manage and protect their evolving cloud landscape, negating these benefits. As you plan your cloud strategy, the right tools and a detailed road map are essential for supporting a successful transition. Start by assuming that at some point, if not already, some of your workload will move to the public cloud, so you'll really be managing a hybrid environment.

Next, it's highly like that the people supporting your data center will also support your cloud, so to avoid misconfigurations and minimize complexity, adopt management and security solutions that support hybrid cloud scenarios. It's also likely your environment will evolve to include more than one cloud service. Whether through a merger or acquisition, adopted in a development lab or acquired elsewhere, you may be faced with a combination of Microsoft Azure, Amazon Web Services, and/or Google cloud environments. Procure technologies that will or plan to support multiple clouds to ensure a sustainable management and security model in this situation.

3. Consistently Apply Access Controls for Roles and Tenants
With each new cloud technology brought into the enterprise, identity and access management becomes increasingly difficult. It's important that enterprises develop an onboarding system to clone and provision administrative rights based on role and tenant access. In the absence of a third-party solution that consistently applies permissions across cloud deployments, cloud technologies should be centrally procured and permissioned according to internal and regulatory compliance mandates. Cross-cloud permissions and roles should also be centrally documented, in case an auditor ever inquires.  

4. Use Dashboards to Monitor Security Issues across Cloud Instances
Dashboards provide an excellent way to quickly review security metrics across disparate VMs, hosts, data centers, and cloud instances. Ideally, you're implementing a platform that unifies these views in a single screen. However, you can always monitor individual VMs by opening separate windows. Dashboard views have the obvious advantages of a consistent look and feel, convenience, and simplicity.

5. Back Up Workloads at Least Twice Daily ― Be Ready to Recover on a Moment's Notice
Backup and recovery are critical for security in hybrid and multicloud environments. They are the only ways to ensure that risks such as ransomware or misconfigurations don't permanently damage your overall cloud infrastructure and impact your ability to serve customers. But because each cloud service has its own native functionality, backing up across multiple environments is extremely challenging. While you can use each cloud's native backup functionality, it's always best to adopt a backup and recovery solution that supports your entire cloud environment.

Does Cloud-First Mean Security Is Second?
No. With the right mindset, best practices, and third-party tools, you can build a sustainable security model for your organization's cloud-first strategy. Administrators must assess the security gaps inherent in hybrid and multicloud environments, then collaborate with executives on implementing the right unified cloud management and security solutions that will evolve with their overall cloud implementation.

Related Content:

Why Cybercriminals Attack: A DARK READING VIRTUAL EVENT Wednesday, June 27. Industry experts will offer a range of information and insight on who the bad guys are – and why they might be targeting your enterprise. Go here for more information on this free event.

Robert Corradini is a two-time Microsoft Azure and Hyper-V MVP with over 20 years of experience managing cloud and data center technologies. He is currently the Director of Product Management at 5nine and focuses on bringing world-class cloud security and management solutions ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Threaded  |  Newest First  |  Oldest First
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: Our Endpoint Protection system is a little outdated... 
Current Issue
The Year in Security: 2019
This Tech Digest provides a wrap up and overview of the year's top cybersecurity news stories. It was a year of new twists on old threats, with fears of another WannaCry-type worm and of a possible botnet army of Wi-Fi routers. But 2019 also underscored the risk of firmware and trusted security tools harboring dangerous holes that cybercriminals and nation-state hackers could readily abuse. Read more.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-0404
PUBLISHED: 2019-12-11
SAP Enable Now, before version 1911, leaks information about network configuration in the server error messages, leading to Information Disclosure.
CVE-2019-0405
PUBLISHED: 2019-12-11
SAP Enable Now, before version 1911, leaks information about the existence of a particular user which can be used to construct a list of users, leading to a user enumeration vulnerability and Information Disclosure.
CVE-2019-0395
PUBLISHED: 2019-12-11
SAP BusinessObjects Business Intelligence Platform (Fiori BI Launchpad), before version 4.2, allows execution of JavaScript in a text module in Fiori BI Launchpad, leading to Stored Cross Site Scripting vulnerability.
CVE-2019-0398
PUBLISHED: 2019-12-11
Due to insufficient CSRF protection, SAP BusinessObjects Business Intelligence Platform (Monitoring Application), before versions 4.1, 4.2 and 4.3, may lead to an authenticated user to send unintended request to the web server, leading to Cross Site Request Forgery.
CVE-2019-0399
PUBLISHED: 2019-12-11
SAP Portfolio and Project Management, before versions S4CORE 102, 103, EPPM 100 and CPRXRPM 500_702, 600_740, 610_740; unintentionally allows a user to discover accounting information of the Projects in Project dashboard, leading to Information Disclosure.