Story image

Five recommendations for effective cloud security

23 May 18

Businesses are embracing cloud technology as a means to increase their agility and work with enhanced flexibility.

Security should be a topic of conversation organisations have before they transition to data storage in the cloud; rather than something that gets discussed once the project is complete.

If proactive security steps are not considered, the risk of data breaches will continue to linger. Hackers will target organisations with more sophisticated attacks as further vulnerabilities in modern microprocessors are discovered.

Steps to make cloud security more effective have become paramount. With these five recommendations for effective cloud security, organisations can reduce the inherent risks associated with cloud environments.

1. Begin with the end in mind

Flawless security is nearly impossible to achieve, but that does not mean enterprises should be paralysed by fear. First, assess and document the accepted level of risk tolerance for the areas in the cloud such as data, applications, the platform and the network.

Then highlight the most critical areas to be addressed first. Worst case scenarios should be brainstormed to anticipate what happens if a security control fails.

Wargame security infrastructures with regular red team/blue team exercises to test the effectiveness of security measures. The learnings gathered from these exercises should ensure response plans are made a bigger part of the security strategy.

Remember that you can't boil the ocean, but you can address risk with optimism and practicality.

2. Assess and leverage native security services

Security measures for cloud services should be an extremely important consideration.

Cloud service providers offer native security services that can be programmatically applied or implemented into standards and processes. Firewalls, intrusion detection, virus protection and data encryption are among the wide variety of security services available to cloud clients which help to identify and eliminate potential threats to the cloud.

This flexibility allows organisations to decide which services would best meet their needs for added instant protection.

3. Get identity management right

Identity management ensures the right individuals are able to access the right resources at the right time, for the right reasons. One of the tricks for identity management in the cloud is to integrate and apply it everywhere possible—across users, groups, roles, system, service accounts, and SSH key management.

In cloud environments, identity management can be a versatile and reliable security control. Done properly, identity management creates a win/win for both users and security. Users benefit from quicker access to the resources they need, ultimately boosting productivity.

Overall security is enhanced because identity management ensures information can only be accessed by people with permission.

4. Address configuration hygiene

As organisations adopt infrastructure-as-a-service (IaaS) and migrate workloads to the cloud, getting all the configuration details right from the start is fundamental to effective security.

If clouds are not configured correctly, they will not be lacking security. The cloud control plane is the best place to mind security hygiene. It's an ideal location to enforce and monitor policy while also enabling businesses to deploy tools to assess and repair issues. Software as a Service (SaaS) can identify cloud security gaps in the cloud control plane, close them, and ensure they stay closed.

For organisations using cloud services like Amazon Web Services (AWS), the Centre for Internet Security (CIS) Benchmarks Program, provides well-defined, unbiased and consensus-based industry best practices to help organisations assess and improve their security.

5. Think and act like a development team

For businesses that want to weave security throughout its cloud computing environment, the security team needs to think and act like a team of developers. In the cloud, developers can build, deploy and manage applications rapidly.

The security team should try to take advantage of existing workflows to ensure security keeps pace with development. In addition, encourage the security team to use standard images; because they are supported by the cloud service and have not reached the end of life status.

Prioritising cloud security

In a world that is becoming increasingly digitalised, organisations must be sure to take as many steps as possible to protect their cloud services from unwanted threats.

A simple mistake that leads to a breach can not only cause financial damage but result in unrecoverable reputational damage. By utilising these five recommendations of cloud security, enterprises will be better equipped to provide an effective and safe cloud platform. 

Article by SecureWorks senior security researcher Allex Tilley.

A10 aims to secure Kubernetes container environments
The solution aims to provide teams deploying microservices applications with an automated way to integrate enterprise-grade security with comprehensive application visibility and analytics.
DigiCert conquers Google's distrust of Symantec certs
“This could have been an extremely disruptive event to online commerce," comments DigiCert CEO John Merrill. 
One Identity a Visionary in Magic Quad for PAM
One Identity was recognised in the Gartner Magic Quadrant for Privileged Access Management for completeness of vision and ability to execute.
How to keep network infrastructure secure and available
Two OVH executives have weighed in on how network infrastructure and the challenges in that space will be evolving in the coming year.
Gartner names newcomer Exabeam a leader in SIEM
The vendor landscape for SIEM is evolving, with recent entrants bringing technologies optimised for analytics use cases.
52mil users affected by Google+’s second data breach
Google+ APIs will be shut down within the next 90 days, and the consumer platform will be disabled in April 2019 instead of August 2019 as originally planned.
Symantec releases neural network-integrated USB scanning station
Symantec Industrial Control System Protection Neural helps defend against USB-borne cyber attacks on operational technology.
Ramping up security with next-gen firewalls
The classic firewall lacked the ability to distinguish between different kinds of web traffic.