Operating a Cloud Environment that Runs Secure, Stays Secure
Enterprise cloud implementations are most effective when they run secure and stay secure, meaning that processes are in place to validate architecture for security and maintain security levels as threats evolve, as well as facilitate redundant operations for disaster recovery or business continuity.
Security is at the top of the list of processes needed to control critical cloud functionality. To be most effective, the cloud’s shared infrastructure requires a security-in-depth approach to ensure cloud systems are secure. This includes a layered security model with network segmentation, network access control lists, firewalls, proxy servers, web application firewalls, and encryption.
Using a security-in-depth approach for the cloud reduces risks should one layer be compromised by a vulnerability or unauthorized access. For example, web application firewalls, robust encryption, logging, and key management systems all help organizations run secure and stay secure against a full range of vulnerabilities, including those cited in the Open Web Application Security Project’s (OWASP’s) top 10 vulnerabilities for 2017.
Security-in-depth ensures that if a system is compromised or a vulnerability is discovered in one of those layers there are multiple responses and corrective actions in place to obviate vulnerabilities. Such robustness of security is not always available with on-premise solutions because of cost or resource availability, but which is now readily available to users of cloud services at lower cost and commitment levels.
“Leveraging security capabilities of the cloud means that organizations don’t have to maintain and patch an encryption key management system, for example, because it is a service they can obtain directly from the cloud provider—a capability that keeps data secure at the highest possible level,” said Tom Fleming, Sila cybersecurity practice lead and former CISO at a nationwide retailer.
Run Secure, Stay Secure
Just because you have a plethora of security capabilities does not mean, however, that you always stay secure over time. Security is not a one-time event. That’s why it is imperative that cloud architecture designs and implementations be vetted through threat modeling and peer review processes to ensure that the architectures and implementations meet security requirements.
Once the systems are vetted and implemented, additional processes such as vulnerability scans, patching, configuration delta monitoring, and encryption key rotations are required. This is one of the areas where cloud computing provides the most bang for the buck—maintaining the system’s desired security posture over time through continuous improvement, the addition of automated components, and security leading practices.
Configuration delta monitoring in the cloud, for example, ensures that someone has not compromised your system or loaded malware onto it. This is an example of how the cloud gives you more capability and produces more business value for you.
When using the cloud, you have a security partner who shares the responsibility of maintaining security of the environment. In the new shared model, you can focus on maintaining security of your data, access, and applications, while the cloud provider is responsible for ensuring security and maintaining the infrastructure environment.
Automation is the Key to Security in the Cloud
The automation capabilities of the cloud—particularly change management that keeps security up to date—provides organizations with robustness and consistency that does not necessarily exist today in their on-premise infrastructures.
The on-premise mindset of utilizing process-heavy change management and change control boards to manage manual requirements can inhibit your ability to be successful from a continuous integration and continuous delivery perspective.
We’re not saying that change management and change control isn’t critical, as it is. We are saying that the cloud and the automation tooling that goes with it offers much less time-intensive and process-heavy options. In the cloud realm of infrastructure as code, if a change needs to be made, you change the code (in a best-case scenario), run it through an automated testing pipeline, and redeploy instead of someone manually creating a change. Presuming you have good coding practices, you are basically documenting your changes within your code. Now you have traceability and auditability around what you did and when. That means developers can makes changes and/or deploy new features in a matter of hours versus weeks in an un-automated environment.
By leveraging the cloud's automation, security, and redundancy capabilities, organizations can devote more time and effort to producing business value while improving the security posture of their business solutions at a lower cost than on-premise.
Takeaways for Running Secure, Staying Secure in the Cloud
The following bullets provide some key takeaways for organizations that want to ensure they are securely moving their on-premise infrastructure to the cloud.
Cloud provides all the capabilities and tools to run as secure in the cloud as on-prem; in most cases it is even more secure. There are numerous use cases of organizations that achieve regulatory compliance (e.g. Payment Card Industry Data Security Standard, Health Insurance Portability and Accountability Act, Sarbanes-Oxley Act). But as with everything, it depends on how you architect, deploy, maintain, and operate your systems that is the cornerstone of whether you achieve those cloud security benefits. On-prem processes doesn’t necessarily translate verbatim to the cloud, and need to be adapted.
Cloud provided services are available to scan and detect configuration vulnerabilities in your architecture, in addition to the areas you target.
You have explicit control of where data is stored in the U.S. or abroad.
It’s important to understand the cloud’s shared security model, and not assume the cloud provider is providing all security needs.