4 minute read
Cloud Security: Doing cloud the right way
By Scott Nursten, CEO, ITHQ
On-demand availability, scalability, measured services, accessibility from anywhere … the benefi ts of cloud infrastructure are many. However, this does not mean cloud is a magic bullet guaranteeing success. And, contrary to popular belief, cloud does not automatically take care of cyber security either.
WHY DOES YOUR BUSINESS NEED THE CLOUD?
I hear organisations state three reasons for cloud adoption, and they’re not the best. One: to save money. Two: to remove the hassle of running and maintaining their own servers. Three: because everyone is doing it.
Better reasons could be to drive resilience, provide services in different geographies or to new clients. Specifi c service requirements are another good reason. As an example, if a key service depends on a web application, it makes sense to be in the cloud, instead of trying to create global, resilient web architectures yourself.
Even with a clear reason to migrate, it still doesn’t mean that your entire business belongs in the cloud yet. Using a cloud adoption framework and ensuring your ‘why’ is aligned with your security strategy should come fi rst.
❛❛ When you can fire up machines all over the world in a few clicks, the danger of Shadow IT increases rapidly ❜❜
HOW RESPONSIBILITY FOR SECURITY IS SHARED BETWEEN YOU AND YOUR CLOUD PROVIDER
It is a huge mistake to assume your cloud provider takes responsibility for your cyber and data security.
All major providers - AWS, Google Cloud, Azure, DigitalOcean, Linode, Rackspace - specify their own terms and conditions regarding which areas of security they manage.
Most commonly, the provider takes responsibility for physically securing their data centres to an extremely high standard: SOC2/3 or ISO 27001/27018 for example, or multiple of these.
They secure their own management, virtualisation and storage platforms. In addition, some level of distributed denial of service (DDoS) protection is usually included. So, if someone tries to take out their cloud through mass traffi c attacks, they’ll be stopped upstream before they reach your network.
YOUR SECURITY RESPONSIBILITIES
Securing your infrastructure, whether on-premise or cloud, remains your responsibility. If you run cloud services, there is no security provided out of the box.
If you open Remote Desktop Services on Windows for example, there is nothing preventing that from being attacked. But before you consider tactics, the most important aspect to consider is your overarching security strategy – which, unfortunately, most organisations we engage with, simply don’t have. Every organisation should have a threeyear security roadmap in place as an imperative. Your cloud strategy should support this security plan. Again, start with questions: Can we maintain our levels of security? Can we plug recognised gaps effectively? Can we justify the costs? Does the business case still stack up, if we move this to cloud?
“What if I don’t have a security strategy?” I hear you ask. Simple answer – time to get one.
USE A CLOUD ADOPTION FRAMEWORK
The six Rs ensure best practice with your migration: Rehost, Replatform, Refactor, Retire, Replace and Retain.
Considering each of your workloads and use cases in turn, the six Rs allow you to assess and plot each potential migration, ensuring they’re managed in the most cost-effective and business-appropriate way.
The fi rst step, Rehost, for instance, is often called ‘Lift and Shift’. This fast, simple route to the cloud is favoured when a hard deadline looms, such as a data centre closure. However, it lifts and shifts everything including legacy issues. Whichever applications are not suitable for Rehost are then assessed under Replatform, and so on.
OVERCOMING CLOUD CHALLENGES
While the essential tools and techniques are the same in the cloud, they are deployed differently.
The easiest solution to this is to select a cloud-native provider whose platform has been created in the cloud or with the cloud in mind, rather than using a partner who has adapted their technology to fi t cloud requirements. Many cloud challenges are the fl ip side to a benefi t. For example, you can spin up machines almost anywhere fast, creating high availability, improving resilience and putting servers much closer to customers. This also increases your attack surface massively.
Another challenge is visibility of how traffi c fl ows through a virtual network. In a data centre you can physically plot cables or use different racks to denote private and public zones, whereas the virtual world is theoretical. Despite virtualisation being around for years, visualising a virtualised world is still a unique skill.
SHADOW IT
When you can fi re up machines all over the world in a few clicks, the danger of Shadow IT increases rapidly. We recently heard from an organisation who receive a research grant from a big UK manufacturer. When there is a research project with a tight deadline, they purposefully go around IT, engaging a cloud provider to get things moving.
Shadow IT has increased exponentially, because it’s so easy to fi re up a whole new IT infrastructure in the cloud. In bigger organisations, this is a growing problem and becoming very serious. How do you secure assets you don’t know about?
QUESTIONS FOR IT
n Did we implement our cloud platform using a framework? n How are we doing asset management, monitoring and ensuring controls are consistent between our on-premise environments and the cloud? n Do we have a cloud strategy aligned to our security strategy? n Can you present it to the board?
}}NEXT MONTH’S TOPIC
THE LATEST FBI IC3 REPORT ON CYBERCRIME
