In a traditional datacenter, there might be just a handful of people with access to the server room, adding a single component at a time through rigorous financial, security, and change management practices.
Datacenter infrastructure delivery is slow and frustrating. Your competitors are getting ahead of you, using public cloud computing to add value at lightning speeds.
So, you've decided to enable public cloud at your organization. Your developers now have access to deploy workloads independently of other teams. But how do you secure your cloud?
This creates a problem. Your security experts could easily handle five people deploying a single component to the datacenter each month. Now you have fifty people, with access to over two hundred services, deploying workloads twice per day.
In the above scenario, assuming one person making one security misconfiguration equates to a unit of risk, your risk exposure has increased by a factor of 120,000 (10x people, 200x services, 60x opportunities for misconfiguration). Human error is the number one cause of cloud data breaches, and with the above numbers it's easy to see why.
Here's how you reduce that risk.
Attack Surface Reduction
When starting out with public cloud, you don't need access to 200 services. 200 unvetted services is a great place to start with reducing your attack surface and could significantly lower your risk. It is much simpler to prevent access to 200 services than to secure 200 services.
Use your cloud provider's control plane to prevent the use of services that are not important to your business. Typically, organizations can reduce to around 20 services when starting out with public cloud - a 10x reduction in potential attack surface area.
Maintain a completely isolated sandbox with no production data allowed, so that teams can still experiment with the full suite of services. This enables experimentation and innovation to continue - if discovery indicates a service could be useful in production, enable it after going through a security and best practices review.
Policy Enforcement
For the services that you do have enabled, a cross-functional community of practice can evaluate and align security best practices. Security policies set to enforce mode can be used to guarantee secure configurations no matter who is using the service.
By preventing the expanded user base from making misconfigurations in the first place, this mitigates the increase in people accessing the services - a 10x reduction in risk.
DevSecOps
We increased the risk of misconfiguration by a factor of 60 due to the increased rate of change to the platform (twice a day versus monthly). This increased delivery speed is only attainable through DevOps techniques and Infrastructure as Code.
Using repeatable code templates, enforcing peer review, and scanning every code change for security issues automatically in the pipeline, we can reverse the increase - a 60x reduction in risk. It has been shown that DevSecOps can actually mitigate the threat of human error while increasing productivity.
Residual Risk
By implementing the above controls, we reduced the risk to a x20 increase. This makes sense, as we enabled 20 new services, and each service in our example is an additional unit of risk.
Below are some other important security considerations for public cloud.
Secure your Cloud with Identity
Identity is a cloud solution's biggest weakness, but also, it's greatest strength. Failure to secure user access to an internet-connected environment is a fast path to a data breach.
If using an IDP like Azure Active Directory, you want to be using all of the following tools:
Multifactor Authentication - prevent password brute-force attacks.
Number matching requirements - mitigate MFA fatigue.
Privileged Identity Management (PIM) - reduce the number of active administrator accounts.
Risk-Based Identity Protection - adaptive access control based on user characteristics.
Conditional Access - restrict access based on location, device, and more.
Managed identities - for service-to-service authentication.
When combined, the above tools and techniques make identity a strength. You should use Single-Sign-On to bring this strength to all of your SaaS applications.
Compliance Controls
Most cloud service providers offer a way to dynamically assess your environment against industry standard compliance controls like NIST, PCI, and HITRUST. Make sure you understand which framework your organization uses for its baseline security posture and apply the relevant benchmark to your workloads.
This is a fantastic way to identify security misconfigurations in your cloud services in near real-time based on industry standard best-practices.
Your cloud platform already did most of the hard work by creating the policies - but many organizations fail to use the built-in functionality as part of their operations.
Conclusion
Attack surface reduction, policy enforcement, DevSecOps, identity management and compliance controls are some of the biggest wins for cloud security, but we are only scratching the surface.
Consider choosing us as your partner to guide your teams through securing public cloud workloads at enterprise scale.
Cloud security is a balancing act; too little and you assume greater risk of a breach, too much and you could slow down the delivery of business value. We help organizations harmonize the balance of security, value, and costs with their public cloud investments.
Further Reading
This article was Part 4 of our “9 things C-Suite executives need to know about Public Cloud” series. Follow us for more Public Cloud strategic insights!
Get help with your Cloud Platform today!
Get in touch with us today through our Contact Page to start your journey to a compliant, efficient, and more cost-effective cloud! We teach organizations how to get the most value out of their public cloud investments.
Follow our LinkedIn page to stay updated on new posts about cloud technology strategy, techniques, and tips.
1-877-727-8859