Story image

Five recommendations for effective cloud security

23 May 2018

Businesses are embracing cloud technology as a means to increase their agility and work with enhanced flexibility.

Security should be a topic of conversation organisations have before they transition to data storage in the cloud; rather than something that gets discussed once the project is complete.

If proactive security steps are not considered, the risk of data breaches will continue to linger. Hackers will target organisations with more sophisticated attacks as further vulnerabilities in modern microprocessors are discovered.

Steps to make cloud security more effective have become paramount. With these five recommendations for effective cloud security, organisations can reduce the inherent risks associated with cloud environments.

1. Begin with the end in mind

Flawless security is nearly impossible to achieve, but that does not mean enterprises should be paralysed by fear. First, assess and document the accepted level of risk tolerance for the areas in the cloud such as data, applications, the platform and the network.

Then highlight the most critical areas to be addressed first. Worst case scenarios should be brainstormed to anticipate what happens if a security control fails.

Wargame security infrastructures with regular red team/blue team exercises to test the effectiveness of security measures. The learnings gathered from these exercises should ensure response plans are made a bigger part of the security strategy.

Remember that you can't boil the ocean, but you can address risk with optimism and practicality.

2. Assess and leverage native security services

Security measures for cloud services should be an extremely important consideration.

Cloud service providers offer native security services that can be programmatically applied or implemented into standards and processes. Firewalls, intrusion detection, virus protection and data encryption are among the wide variety of security services available to cloud clients which help to identify and eliminate potential threats to the cloud.

This flexibility allows organisations to decide which services would best meet their needs for added instant protection.

3. Get identity management right

Identity management ensures the right individuals are able to access the right resources at the right time, for the right reasons. One of the tricks for identity management in the cloud is to integrate and apply it everywhere possible—across users, groups, roles, system, service accounts, and SSH key management.

In cloud environments, identity management can be a versatile and reliable security control. Done properly, identity management creates a win/win for both users and security. Users benefit from quicker access to the resources they need, ultimately boosting productivity.

Overall security is enhanced because identity management ensures information can only be accessed by people with permission.

4. Address configuration hygiene

As organisations adopt infrastructure-as-a-service (IaaS) and migrate workloads to the cloud, getting all the configuration details right from the start is fundamental to effective security.

If clouds are not configured correctly, they will not be lacking security. The cloud control plane is the best place to mind security hygiene. It's an ideal location to enforce and monitor policy while also enabling businesses to deploy tools to assess and repair issues. Software as a Service (SaaS) can identify cloud security gaps in the cloud control plane, close them, and ensure they stay closed.

For organisations using cloud services like Amazon Web Services (AWS), the Centre for Internet Security (CIS) Benchmarks Program, provides well-defined, unbiased and consensus-based industry best practices to help organisations assess and improve their security.

5. Think and act like a development team

For businesses that want to weave security throughout its cloud computing environment, the security team needs to think and act like a team of developers. In the cloud, developers can build, deploy and manage applications rapidly.

The security team should try to take advantage of existing workflows to ensure security keeps pace with development. In addition, encourage the security team to use standard images; because they are supported by the cloud service and have not reached the end of life status.

Prioritising cloud security

In a world that is becoming increasingly digitalised, organisations must be sure to take as many steps as possible to protect their cloud services from unwanted threats.

A simple mistake that leads to a breach can not only cause financial damage but result in unrecoverable reputational damage. By utilising these five recommendations of cloud security, enterprises will be better equipped to provide an effective and safe cloud platform. 

Article by SecureWorks senior security researcher Allex Tilley.

Five things MSPs need to keep in mind in 2019
A Datto APAC channel exec outlines the most important factors for MSP to being paying attention to in the coming year.
Survey: IT pros nostalgic over on-prem data centre visibility
There are significant security and monitoring challenges faced by IT staff responsible for managing public and private cloud deployments.
61% of CIOs believe employees leak data maliciously
Egress conducted a survey to examine the root causes of employee-driven data breaches, their frequency, and impact.
Opinion: BYOD can be secure with the right measures
Companies that embrace BYOD are giving employees more freedom to work remotely, resulting in increased productivity, cost savings, and talent retention.
Sonatype and HackerOne partner on open source vulnerability reporting
Without a standard for responsible disclosure, even those who want to disclose vulnerabilities responsibly can get frustrated with the process.
OutSystems and Boncode team up for better code analysis
The Boncode and OutSystems alliance aims to help organisations to build fast and feel comfortable that the work they're delivering is at peak quality levels.
Nozomi and RIoT to deliver advanced ICS security solutions to Australia
''As a specialised integrator of robust and resilient ICT and IoT solutions within Australia, we are delighted to be partnering with Nozomi Networks."
Nuance biometrics fight back against fraud
Nuance Communications has crunched the numbers and discovered that it has prevented more than US$1 billion worth of fraud from being passed on to users of its Nuance Security Suite.