The author explains the seven most important steps in securing the public cloud that every organisation can follow.
The simplicity and cost-effectiveness of the public cloud have lead more and more organisations to take advantage of Amazon Web Services (AWS), Microsoft Azure and Google Cloud Platform (GCP). You can spin up a new instance in minutes, scale resources up and down whenever you need while only paying for what you use, and avoid high upfront hardware costs.
While the public cloud solves many traditional IT resourcing challenges, it does introduce new headaches. Rapid growth of cloud usage has resulted in a fractured distribution of data, with workloads spread across disparate instances and, for some organisations, platforms. As a result, keeping track of data, workloads and architecture changes in those environments to keep everything secure is often a highly challenging task.
Public cloud providers are responsible for security of the cloud (physical data centres, and separation of customer environments and data). However, responsibility for securing workloads and data placed in the cloud lies firmly with the customers. Just as organisations need to secure the data stored in their on-premises networks, they also need to secure their cloud environment. Misunderstandings around this distribution of ownership are widespread, and resulting security gaps have made cloud-based workloads the new pot of gold for today’s savvy hackers.
Seven steps to securing the public cloud
The secret to effective cybersecurity in the cloud is improving the overall security posture—ensuring that the architecture is secure and configured correctly, that there is necessary visibility into the architecture and, importantly, into who is accessing it.
1. Learn your responsibilities
This may sound obvious, but security is handled a little differently in the cloud. Public cloud providers such as AWS, Microsoft Azure and GCP run a shared responsibility model—they ensure security of the cloud, while you are responsible for anything you place in the cloud.
2. Plan for multi-cloud
Multi-cloud is no longer a nice-to-have strategy; rather, it has become a must-have strategy. There are many reasons why you may want to use multiple clouds, such as availability, improved agility or functionality. When planning your security strategy, start with the assumption that you will run multi-cloud—if not now, at some point in the future. This way you can future-proof your approach.
3. See everything
If you cannot see it, you cannot secure it. That is why one of the biggest requirements to getting your security posture right is getting accurate visibility of all your cloud-based infrastructure, configuration settings, API calls and user access.
4. Integrate compliance into daily processes
The dynamic nature of the public cloud means that continuous monitoring is the only way to ensure compliance with many regulations. The best way to achieve this is to integrate compliance into daily activities, with real-time snapshots of the network topology and real-time alerts to any changes.
5. Automate security controls
Cybercriminals increasingly take advantage of automation in their attacks. Stay ahead of hackers by automating your defenses, including remediation of vulnerabilities and anomaly reporting.
6. Secure all environments (including dev and QA)
You need a solution that can secure all your environments (production, development and quality assurance, or QA) both reactively and proactively.
7. Apply on-premises security learnings
On-premises security is the result of decades of experience and research. Use firewalls and server protection to secure your cloud assets against infection and data loss, and keep your endpoint and email security up-to-date on your devices to prevent unauthorised access to cloud accounts.
Moving from traditional to cloud-based workloads offers huge opportunities for organisations of all sizes. Yet, securing the public cloud is imperative if you wish to protect your infrastructure and organisation from cyberattacks. By following the above-mentioned seven steps, you can maximise the security of your public clouds, while also simplifying management and compliance reporting.
Harish Chib is vice president – Middle East and Africa, Sophos
