Story image

Five recommendations for effective cloud security

23 May 2018

Businesses are embracing cloud technology as a means to increase their agility and work with enhanced flexibility.

Security should be a topic of conversation organisations have before they transition to data storage in the cloud; rather than something that gets discussed once the project is complete.

If proactive security steps are not considered, the risk of data breaches will continue to linger. Hackers will target organisations with more sophisticated attacks as further vulnerabilities in modern microprocessors are discovered.

Steps to make cloud security more effective have become paramount. With these five recommendations for effective cloud security, organisations can reduce the inherent risks associated with cloud environments.

1. Begin with the end in mind

Flawless security is nearly impossible to achieve, but that does not mean enterprises should be paralysed by fear. First, assess and document the accepted level of risk tolerance for the areas in the cloud such as data, applications, the platform and the network.

Then highlight the most critical areas to be addressed first. Worst case scenarios should be brainstormed to anticipate what happens if a security control fails.

Wargame security infrastructures with regular red team/blue team exercises to test the effectiveness of security measures. The learnings gathered from these exercises should ensure response plans are made a bigger part of the security strategy.

Remember that you can't boil the ocean, but you can address risk with optimism and practicality.

2. Assess and leverage native security services

Security measures for cloud services should be an extremely important consideration.

Cloud service providers offer native security services that can be programmatically applied or implemented into standards and processes. Firewalls, intrusion detection, virus protection and data encryption are among the wide variety of security services available to cloud clients which help to identify and eliminate potential threats to the cloud.

This flexibility allows organisations to decide which services would best meet their needs for added instant protection.

3. Get identity management right

Identity management ensures the right individuals are able to access the right resources at the right time, for the right reasons. One of the tricks for identity management in the cloud is to integrate and apply it everywhere possible—across users, groups, roles, system, service accounts, and SSH key management.

In cloud environments, identity management can be a versatile and reliable security control. Done properly, identity management creates a win/win for both users and security. Users benefit from quicker access to the resources they need, ultimately boosting productivity.

Overall security is enhanced because identity management ensures information can only be accessed by people with permission.

4. Address configuration hygiene

As organisations adopt infrastructure-as-a-service (IaaS) and migrate workloads to the cloud, getting all the configuration details right from the start is fundamental to effective security.

If clouds are not configured correctly, they will not be lacking security. The cloud control plane is the best place to mind security hygiene. It's an ideal location to enforce and monitor policy while also enabling businesses to deploy tools to assess and repair issues. Software as a Service (SaaS) can identify cloud security gaps in the cloud control plane, close them, and ensure they stay closed.

For organisations using cloud services like Amazon Web Services (AWS), the Centre for Internet Security (CIS) Benchmarks Program, provides well-defined, unbiased and consensus-based industry best practices to help organisations assess and improve their security.

5. Think and act like a development team

For businesses that want to weave security throughout its cloud computing environment, the security team needs to think and act like a team of developers. In the cloud, developers can build, deploy and manage applications rapidly.

The security team should try to take advantage of existing workflows to ensure security keeps pace with development. In addition, encourage the security team to use standard images; because they are supported by the cloud service and have not reached the end of life status.

Prioritising cloud security

In a world that is becoming increasingly digitalised, organisations must be sure to take as many steps as possible to protect their cloud services from unwanted threats.

A simple mistake that leads to a breach can not only cause financial damage but result in unrecoverable reputational damage. By utilising these five recommendations of cloud security, enterprises will be better equipped to provide an effective and safe cloud platform. 

Article by SecureWorks senior security researcher Allex Tilley.

IoT and DDoS attacks: A match made in heaven
A10 Network’s Adrian Taylor uses findings from a number of reports to illustrate his point that advances in technology are facilitating cybercrime.
ForgeRock launches Sandbox-as-a-Service to facilitate compliance
The cloud-based testing environment for APIs enables banks to accelerate compliance with Open Banking and PSD2 deadlines.
Cloud application attacks in Q1 up by 65% - Proofpoint
Proofpoint found that the education sector was the most targeted of both brute-force and sophisticated phishing attempts.
Singapore firm to launch borderless open data sharing platform
Singapore-based Ocean Protocol, a decentralised data exchange that promotes data sharing, has revealed details of what could be the kickstart to a global and borderless data economy.
Huawei picks up accolades for software-defined camera ecosystem
"The company's software defined capabilities enable it to future-proof its camera ecosystem and greatly lower the total cost of ownership (TCO), as its single camera system is applicable to a variety of application use cases."
Barracuda expands MSP security offerings with RMM acquisition
Managed Workplace delivers an RMM platform with security tools and services, such as site security assessments, Office 365 account management, and integrated third-party antivirus.
Flashpoint: APAC companies must factor geopolitics in cyber strategies
The diverse geopolitical and economic interests of the states in the region play a significant role in driving and shaping cyber threat activity against entities operating in APAC.
Expert offers password tips to aid a stress-free sleep
For many cybersecurity professionals, the worries of the day often crawl into night-time routines - LogMeIn says better password practices can help.