According to a recent survey of 250 IT leaders by Snow Software, 82 per cent of survey participants said they had ramped up their use of cloud in direct response to the pandemic, with 60 per cent saying the use of off-premise technologies has continued to grow during the crisis.
In fact, more than 76 per cent of respondents said Covid-19 had led to an increased in spending on private and public cloud infrastructure services (source: Snow Software, June 2020).
As a result, the threat landscape is adapting to this new reality by not only becoming more sophisticated and complex, but also by expanding to target new networked environments that often have a less mature security infrastructure in place.
Because the cloud has changed the way data flows, defending against traditional cyber attacks is no longer the only thing security teams need to consider. Now, because so many of these systems are interconnected, they must also focus on the increase in “east-west” data traffic patterns between services inside the cloud, as well as connections to the cloud control plane’s user interface and application programming interfaces (APIs).
However, there is a unique challenge in that, as organisations or developers shouldn’t feel inhibited in any way, but also should not be at risk of breaching laws or regulation policies. So how can a business strike the right balance between cloud deployments and security?
Shared responsibility among security teams
The shared security responsibility model is mainly concerned with the approach that security teams take when securing the cloud. It encompasses the idea that the cloud provider is not responsible for all security in the cloud, but rather that cloud security solutions need to be flexible enough to support the level of protection required by these environments, including issues of performance, scalability and multi-cloud interoperability.
With cloud adoption, it is essential that both the business and the cloud provider understand who is responsible for security, and ensure that certain risks aren’t introduced due to misunderstandings of the shared responsibility.
Assuming that a cloud provider handles everything, including security, is a common mistake among those who are new to cloud security. In a shared responsibility model, the focus of the provider is to secure the cloud infrastructure and to isolate tenants so they do not present risks to best protect computing power, storage and networking. They should also enable customers with the ability to implement effective security for the cloud services provided.
When it comes to securing the cloud, people aren’t the only risk factors organisations need to take into account. The type of cloud deployment implemented is also a key consideration.
Hybrid cloud deployments
As businesses start to realise the risk factors of a full public cloud transformation, they’re looking into the benefits that a hybrid cloud environment offers. That being said, these mixed environments present the most challenges with regards to choosing an effective security solution.
With data and other digital assets spanning private and public clouds, visibility across hybrid cloud environments is critical for any security team to get the full picture of their environment and understand whatever challenges they are facing. End-to-end management, segmentation and the consistent security for connections should be at the top of the list of priorities for any hybrid cloud security solution.
Choices made for the development of a business’s cloud environment, including migrating critical applications and data centres, must not only link to the overall business plans, but ensure that the business remains compliant.
Data regulation and compliance concerns come with moving workloads to the cloud, and an environment where some data and applications are in the cloud and some are on- premise, pose an added risk. Security teams need to consider what type of data is being collected and where, as many countries have their own rules and compliance requirements.
Single-pane management
The hybrid cloud presents a complex, physical-virtual environment that can be difficult to manage, meaning siloed point solutions with individual management interfaces will not suffice. Instead, a cloud security solution must integrate a singular view across all systems operating in the cloud, enabling centralised management.
This single-pane approach must allow for network-wide tracking of data flows and consistent security policy implementation, all while incorporating centralised threat intelligence that will more accurately inform decisions.
Segmentation
Segmenting traffic and systems across the cloud is most critical when internal resources are on a network that is open to the public or third parties. Segmentation plays an especially crucial role in minimising a breach in a mixed (hybrid) environment since business-critical applications and workloads that are not associated with the hybrid environment can be effectively “walled off” for protection.
Secure connectivity
In a hybrid cloud environment, data, workflows and applications need to move between external and internal locations, including third-party services that are connected to internal networks, presenting unique types of risks. A hybrid cloud security solution must provide the right kind of protection for all of these discreet network connections based on the unique risk profiles of each one.
As part of its strategy for defending this complex infrastructure, hybrid cloud security must incorporate functionality for on-demand Virtual Private Networks (VPN) to provide secure temporary access to resources as needed, while still protecting the rest of the network.
Ultimately, cyber risks are becoming more complex as attackers become more sophisticated and businesses transform their technology stacks or transition to the cloud at a rapid pace. This means security teams have more things to manage, but with a shared security approach and a transparent hybrid cloud model that utilises automation, security teams can be confident they have the tools to combat growing threats.