The Top 12 Hybrid Cloud Security Threats
Using a multiple-cloud architecture calls for a hybrid cloud security mindset, which tends to focus less on network security in favor of securing data wherever it may be.
RightScale’s “2017 State of the Cloud” survey describes hybrid cloud as the preferred enterprise strategy, with 67 percent of the respondents using it. The interesting trend is that there is movement away from private cloud to public cloud. Over the long haul, that will create more hybrid environments. Done well, a hybrid cloud can help make wide swaths of your company more productive while saving money. But there is a price to pay.
Securing the Hybrid Cloud: Not an Easy Task
It’s common knowledge in infosec circles that hybrid cloud is difficult to secure. It requires a heightened data-security orientation and the security skills that go with that. But what does that mean in practical terms and what are the security gaps and vulnerabilities that threaten your company’s data? Is public cloud secure, and what aspect of its security are you responsible for?
You can’t just expand your existing security policies and network security around a hybrid cloud architecture. Securing hybrid cloud requires some clean-sheet thinking and likely an increased focus on encryption and data access control. By the same token, you don’t want to create another siloed solution. So start with this primer to get the lay of the land—even those who have existing hybrid cloud implementations will likely find something here to check on.
1. Data is the Target
Putting data on the network throughout a hybrid cloud implementation creates a large, complex attack vector. Experienced CISO and security consultant Ganesh Krishnan, described this as “increased surface area.” “Companies now have to secure public clouds in addition to their data centers,” he says. “Unlike private clouds, which are confined to a secured perimeter wall, public cloud is perimeter-less.”
Instead of beefing up your network security, you need to button down your data access control system and keep its user lists updated religiously. Even more importantly, you need to encrypt all your data.
“Strategically, you want to ensure logical control of your data assets, not just physical control of the borders, so to speak. There is no better logical control of data assets than strong cryptography, where you hold the keys and no one else can decrypt to the data,” says Jason Lango, CTO of Bracket Computing.
2. Information is Decentralized
“In many cloud configurations, data is spread across many physical or virtual servers,” says Jason McDonald, president of Contino. “Decentralization of data makes it more difficult to monitor information and detect possible attacks.” It may also complicate discovery, compliance, security patching and data analytics for the same reason. Data redundancy and accessibility are also more difficult to manage. The classic workarounds for some of these challenges—most of which aren’t directly related to security—may quickly get you into a security dilemma if you’re not careful.
3. Lack of Visibility
“With public cloud part of the mix, the visibility problem gets worse,” says Krishan. “DevOps may spin up several VM instances and delete them. As a result, it’s a challenge to have a real-time inventory of workloads and it’s more complicated to secure them. You can’t secure what you can’t see.” Monitoring is one of the most important jobs the security team has.
4. Are the Lines of Communication Vulnerable?
In a multiplatform environment, with communication lines running between several different cloud services and on-premises systems, those connecting lines may be the most vulnerable part of your cloud architecture. Make sure they are checked and rechecked.
“In a hybrid cloud environment, application workloads and data may move from on-premises infrastructure to the cloud, or between clouds,” says Amir Jerbi, CTO and cofounder of Aqua Security. “Its unique vulnerability may lie in that movement, in how the current activity and data transfer methods are managed.” The situation, he says, calls for in-transit encryption in VPNs, multifactor authentication “and there also has to be a unified framework that doesn’t leave security gaps when moving between clouds and on-premises. For example, if there is a reliance on a certain identity and access management solution, it has to be applied across the board.”
5. Third Parties Control Your Data
“All major cloud providers strive to ensure the security of the data entrusted to them, but placing data in the public cloud requires giving up direct control of it,” McDonald says. “This can be a significant deterrent when either your company or government regulation prohibits the storage of sensitive information on third-party servers.”
6. A Lack of Hybrid Cloud Security Skills
Qualified security people are always in short supply. “With hybrid cloud, enterprises must train their security staff not just on their data center security but also on multiple public cloud providers and their security management tools,” says Krishan. In the hands of someone inexperienced, a cloud service provider’s options and settings should not be a guessing game. Certain settings could create obscure security gaps.
7. The Shared Security Model
Public cloud providers are responsible for the global infrastructure including, storage, databases and networking. The enterprise customer is responsible for everything else. “Enterprises need to architect and design safeguards in the systems, incorporating security and logging tools, to make it possible to analyze the data and continually respond to incidents,” says McDonald. “Making use of infrastructure as code to build out the infrastructure and deployments in a consistent way lets enterprises embed the provisioning of these resources in a compliant fashion to ensure the systems and network configurations are always security hardened.”
8. Patching is Key to Hybrid Cloud Security
It’s up to enterprises to make sure that all servers and applications are up to date and patched against all known security vulnerabilities. This can be challenging without the right plan and personnel.
9. Cloud Environments Change, Sometimes Rapidly
“The makeup of most clouds changes from time to time, which makes it more difficult to secure information than it would be in a static environment,” McDonald points out. Enterprises need to address this propensity for change when developing their cloud security policies.
10. Increased Frequency, Complexity of Attacks
“Attacks tend to be more frequent and complex, which means a single mistake can be very costly,” notes Krishnan. Equifax is the quintessential negative example.
11. Be Ready for Insider Threats
When you set up a hybrid cloud, you create a place where a disgruntled employee with access to the cloud could cause serious damage. In a hybrid cloud environment, you can multiply that threat by the numbers of employees of your cloud providers, too.
12. Potential Application Exposure
There is a threat of potential application exposure to the internet,” says Eitan Bremler, cofounder and VP of products at Safe-T, “due to badly designed interconnectivity between cloud and on-premises servers.”
Want to go a little deeper deeper on hybrid cloud security gaps? Security vendor Pulse Secure offers a list of 17 hybrid cloud security threats and the basic remedies for each threat.
Pingback: The Top 12 Hybrid Cloud Security Threats - Security Boulevard - MyTopPosts