Why CISOs Must Let IAM Guide Cloud Security
The adoption of the cloud has been swift and significant.
More companies now have at least a portion of their computing capacities deployed into the cloud. However, despite its great promise of reward, cloud computing also brings with it significant risk. Managing that risk requires a sophisticated, agile, and intelligently planned strategy to maximize investments in the cloud. At the center of that plan should be a central guiding principle: protecting your digital infrastructure by managing the access of every identity that comes in contact with your enterprise.
Cloud Computing Growth
Since 2010, the cloud computing industry has grown from $24.6 billion annually to over $265 billion annually, the projected estimate to the end of this year. More than 60% of all enterprise infrastructure is now cloud-based, and 81% of all enterprises are in the process of adopting a multi-cloud strategy.
Evidence of cloud usage is everywhere too, which reveals how pervasive it is already in society. Whether they knows it or not, the person typically uses over 35 cloud-based services every day, looking at social media, shopping online, paying bills, or just looking up directions. And millions of businesses use Internet-based communications platforms to connect with their customers and each other. All of these online services flow from mega-cloud data centers and conglomerates that no one sees but everyone accesses. By the end of 2020, some experts estimate that over 50 zettabytes of data (50 trillion gigabytes) will be flowing through cloud networks and servers every year.
Cloud Continues to Grow in Popularity, Too
Why is the cloud so popular? There are many reasons that resonate differently with different cloud users:
Easier Operations
Every cloud service comes from a service provider, so the costs and activities related to maintenance and operations of the of services are shifted to the service provider. In turn, users pay for the services without having to manage the underlying systems. This frees up significant amounts of time, reduces costs as well as can lead to reduced risk..
Greater Flexibility
Unlike a legacy on-prem system, a cloud deployment can grow and shrink to meet the real time needs on demand.. Seasonal business fluctuations require high capacities, but those are expensive to maintain when that need for capacity wanes. Cloud users only pay for the services they use, not for the machines or technology that provides those services.
Cost Savings
In most cases, it is overwhelmingly complicated for an organization to purchase, configure, and deploy an on-prem system that could compete against the capacities of today’s cloud environments. Cloud services provide the infrastructure and connectivity that they need without compelling them to absorb those expenses. And it shifts the computing costs from the capital expenditure budget to the monthly operating budget, so there’s no expensive outlay needed to get started either.
Great Opportunity And Great Risk
But with that opportunity also comes significant risk, and, for many companies, that risk outweighs the promise of the benefits of the cloud. They are rightfully concerned about maintaining high security levels across their organization even while they see the great value in accessing multiple tiers of cloud resources. They’re also confused about the nature of the agreement with a cloud provider: who ‘owns’ the data? Who on the provider side can access it? How does the customer know that the cloud provider is up-to-date with all of its security procedures?
In many ways, these corporate leaders aren’t wrong: even in the cloud, the more service providers, vendors, and third-party participants in your computing constellation, the higher your risk of losing data, exposing your own or your client’s confidential information, or losing your industry competitiveness due to misconfigurations and malicious actors. Despite the belief of as many as 72% of respondents to a CISO Mag survey, cloud service providers are NOT solely responsible for maintaining the data, computing, processing, and storage security processes for all their customers. Instead, cloud service providers expect shared responsibility; they expect their customers and tenants to be as savvy about their internal security practices as the cloud folks are. That requirement is quite off-putting to too many companies, so they don’t explore the cloud’s possibilities for their business and lose out on all of its opportunities.
Securing Your Cloud-Based Assets
There are, of course, many methods of securing your cloud assets that reduces your risk of utilizing cloud services. Most systems are still built around the legacy premise of establishing a perimeter around your network. However, the future of cloud security and defense (and therefore, the safest method) is how well you manage the people and things that actively engage with your network. Your strategic philosophy should establish ‘Identity’ as its perimeter, and ‘access management’ as its ‘firewall:’
Build Your Foundation on Identity
The reason for setting Identities as your security perimeter is because it significantly narrows the scope of your security practices. At any given time, your cloud based workloads accessible by many Identities , such as your employees, vendors, proprietary apps, and even industry-relevant apps that you use to maintain your business. Network perimeter security measures require you to maintain adequate protections based on all the types of technology those users use to access your organization. Computers, devices, applications, etc. each present their own individual security risks, and it is impossible to program all the assets of your enterprise to be sensitive and alert to all the threats they pose.
However, all those Identities must accomplish one single act to actively engage with your organization: they must (somehow) prove that they are authorized to do so. Identity management lets you control the methodologies by which they can confirm both their legitimate identity and their legitimate use of your assets.
Use ‘Access’ as Your Perimeter Definition
In addition to using identity management to control who and what gets access to your cloud based assets, you also want to control why and when they want in. Those supporing the cloud, as well as DevOps teams, are most often the teams with the most access, but even that scope might be too broad in the case of especially sensitive assets. Further, while vendors often require access to whole systems, they usually don’t also need access to all systems; you’ll want to ensure that only those entities with the need for access can gain access and only for that purpose.
Just as only specific workers and partners should be privy to individual corporate decisions, only particular and valid users should have permission to access to each unique asset.
Deploy the Principle of Least Privilege as Your Corporate Information Protection Standard
Introduced in 1975, the Principle of Least Privledge recommends limiting user access to digital assets to the least available scope that permits them to perform their job function, and nothing more. Further, it also suggests ongoing monitoring of that scope to ensure that the state of least principle is maintained. Installing the appropriately comprehensive Identity Governance solutions enables you control what data your users can access, and where and when that access is acceptable based on why they want to see it.
By using identity and access management (IAM) as your cloud deployment core security principle – controlling the who, what, why, where, and when your human and technical corporate actors access any element of your network and systems – you gain control over your entire network. You can oversee that control from that singular perspective.
SonraiSecurity provides cutting edge, cloud-based IAM security solutions to its customers who deploy some or all of their corporate assets in the public cloud.
The post Why CISOs Must Let IAM Guide Cloud Security appeared first on Sonrai Security.
*** This is a Security Bloggers Network syndicated blog from Blog - Sonrai Security authored by Eric Kedrosky. Read the original post at: https://sonraisecurity.com/blog/cisos-iam-guide-cloud-security/
