Many clients and organizations I speak with are interested in moving to public clouds. Some are just beginning an investigation, while others have been migrating for years. We get involved with a new project transitioning to the cloud almost on a daily basis. The project goal may be to build out a new application or to add burst capability to an existing system; in other cases, the goal is the wholesale migration of on-premise infrastructure to infrastructure-as-a-service (IaaS). The cloud is rapidly becoming an essential tool for IT.

Public Clouds Mature

The topic of cloud security comes up at every stage of a cloud project, but I find that once an organization commits to hosting on the cloud, the security considerations tend to take a back seat. Downplaying the security topic can sometimes happen for good reasons — namely, security barriers to cloud adoption are breaking down. With enhanced data center capabilities, better compliance and reporting, better tooling and growing administrator experience with the platforms, the security barriers are being addressed one by one. Basic familiarity with the cloud platform’s security capabilities can go a long way in preparing for the transition as well. Soon, many organizations will begin treating cloud security concerns as an afterthought.

However, the breakdown of cloud security barriers has raised an unusual challenge for security practitioners: CIOs and line-of-business owners are becoming increasingly comfortable with cloud security, while the actual cloud security implementations lag far behind traditional enterprise security. Many factors contribute to the gap, from the fast speed of adoption and complexity in implementation to weaknesses in available cloud security tools.

To consider a straightforward example, how would deployment of an event management and visibility solution change when a portion of the on-premise infrastructure migrates to a public cloud? Not only would multiple data centers require integration with a single product, but new classes of events also must be added to the existing system: hypervisor activity, software-as-a-service (SaaS) logs, cloud platform audit records, automation logs, etc. Even if these new event sources could be integrated seamlessly, do security intelligence and analytics seamlessly make use of the new data? Visibility across the entire environment requires a new generation of security tools and capabilities.

5 Steps Toward a More Secure Cloud

My webinar presentation, “5 Easy Steps to Securing Workloads on Public Clouds,” highlights how complex cloud security requirements can be made easier by unlocking advantages in public clouds. The presentation covers five areas to easily get up and running with cloud security. To help convey the step-by-step implementation, each of the five topics includes detailed recommendations based on hands-on experience.

The five steps begin with fundamental capability and gradually increase in terms of cloud capability leveraged.

  1. The first step addresses basic functions to achieve security parity with on-premise deployments
  2. The second step moves on to automated security patterns
  3. The third step to rapid integration with existing systems
  4. The fourth step covers integrated intelligence and visibility across the many new aspects of a hybrid cloud
  5. I’ll leave the fifth topic unnamed here so as not to spoil the entire presentation, but I will posit that it can be the most powerful — and simple — of the topics. It shows us where the cloud is heading and why the cloud can make security easier than anything we had before.

While basic enablement is just a starting point, cloud automation enables security deployment at a level never before possible in on-premise environments. The cloud shifts us from physical appliances that monitor network perimeters to virtual appliances that can be deployed anywhere easily and rapidly. Combine automated configuration with easy-to-use policies and reporting, and suddenly an application workload can have Defense in Depth and in Breadth without expert guidance supplied to the application developer.

My webinar concludes with a look at the future of cloud security. Automated deployment of highly-tuned infrastructure around specific workloads gets us focused back on the most important topic: securing high-value assets. If the most sensitive data in an organization can be hosted with protections deployed automatically, as well as monitored and audited automatically, suddenly we have strong, turnkey security capability. Lower-priority workloads and data can be deployed with respectively appropriate levels of security, and those systems can be easily segregated using software-defined networks. Every application can have its own customized security zone. Once this happens, we can begin to fundamentally rethink security for the cloud.

I invite you to watch my on-demand webinar below to learn more about the trends we see in cloud security, easy steps that can be taken to secure cloud workloads and the emerging solutions that will be unlocked by future cloud capability.

More from Cloud Security

How Posture Management Prevents Catastrophic Cloud Breaches

We've all heard about catastrophic cloud breaches. But for every cyberattack reported in the news, many more may never reach the public eye. Perhaps worst of all, a large number of the offending vulnerabilities might have been avoided entirely through proper cloud configuration. Many big cloud security catastrophes often result from what appear to be tiny lapses. For example, the famous 2019 Capital One breach was traced to a misconfigured application firewall. Could a proper configuration have prevented that breach?…

How to Implement Cloud Identity and Access Governance

Creating identity and access governance across cloud environments is crucial for modern organizations. In our previous post, we discussed how important human and non-human identities are for these environments and why their management and the governance of their access can be difficult. In the face of these challenges, our cloud identity and access governance (CIAG) approach offers an orchestration layer between cloud identity and access management (IAM) and enterprise IAM, as the following graphic shows. As we continue our CIAG…

How Do You Plan to Celebrate National Computer Security Day?

In October 2022, the world marked the 19th Cybersecurity Awareness Month. October might be over, but employers can still talk about awareness of digital threats. We all have another chance before then: National Computer Security Day. The History of National Computer Security Day The origins of National Computer Security Day trace back to 1988 and the Washington, D.C. chapter of the Association for Computing Machinery’s Special Interest Group on Security, Audit and Control. As noted by National Today, those in…

Why Are Cloud Misconfigurations Still a Major Issue?

Cloud misconfigurations are by far the biggest threat to cloud security, according to the National Security Agency (NSA). The 2022 IBM Security X-Force Cloud Threat Landscape Report found that cloud vulnerabilities have grown a whopping 28% since last year, with a 200% increase in cloud accounts offered on the dark web in the same timeframe. With vulnerabilities on the rise, the catastrophic impact of cloud breaches has made it clear that proper cloud security is of the utmost importance. And…