June 18, 2018 By Scott McAvoy 3 min read

I joined a number of security professionals at the IBM Security Summit in London last month during the “Innovating With Cloud Security” breakout session, which was hosted by Martin Borrett, chief technology officer (CTO) of IBM Security Europe. The audience took part in discussions about typical cloud transformation journeys, security for and from the cloud, development operations (DevOps) disruption of enterprise security and regulatory expectations.

Audience polls discovered that all of the attendees use cloud services in their business — and the majority use the public multi-cloud. (This is also true for our working environment at IBM.) The audience also reflected our past experiences with polar business attitudes toward security in the cloud. For example, the assumption that the cloud is too insecure for use in the enterprise, or (just the opposite) that security is automatically built into cloud platforms.

What’s more, less than 10 percent of the audience had a formal strategy supported by policies and procedures for security in the cloud.

Cloud Security: For vs. From

It’s essential to distinguish security for the cloud (which protects cloud workloads) and security from the cloud (which safeguards other cloud workloads or on-premises infrastructure and applications).

Examples of security for the cloud include native and off-the-shelf products for identity and access management (IAM), patching and data encryption. Security-as-a-service (SECaaS) offerings for security information and event management (SIEM), IAM and vulnerability and application scanning are examples of security from the cloud.

Regulatory Requirements and the Cloud

Though enterprise workloads are often modified to adapt to the cloud, the standards, regulations and legislation that govern these workloads won’t necessarily change. Where compliance has been achieved in on-premises environments, organizations must assess policies, procedures and controls to determine whether they are still required and (if so) whether they are implemented effectively.

Auditors, in particular, will expect security leaders to account for data sovereignty, IAM, auditability, availability, data classification, encryption, incident management and response and business continuity in the context of the cloud.

Map Your Cloud Transformation Journey

During the breakout session, we talked about the transformation contexts of migrating workloads to the cloud, cloud-native and hybrid cloud. Migration and hybrid were the most popular approaches in the room, in addition to a general desire to move toward cloud-native.

We recommend conducting a current state security assessment and mapping exercise to translate it to the cloud, as well as developing a cloud security strategy. Where security policies, procedures and controls are already documented, refresh these with the cloud environment in mind. Also, look for how the cloud environment can be used to improve, streamline or automate your security enforcing functions. This is particularly true of cloud-native, but it applies to migration and hybrid too.

Infusing Cloud Security Into DevOps

The cloud has enabled new ways of working, including tightly integrated development and operation teams and processes. DevOps has taken advantage of the cloud to enable continuous delivery.

In many cases, DevOps engineers have direct access to cloud environments and are in a position to make and implement business-changing decisions. We need to integrate security into DevOps to take advantage of cloud and deliver security. Developers write application code and operations staffers write infrastructure-as-code (IaC). We need to get in line with this and demonstrate how security-as-code can be part of this process and how a culture of security can help DevOps teams think and behave like security professionals. This will enable us to organically move security to the left within our organizations.

Different Techniques, Same Outcomes

Across everything we discussed, one thing hasn’t changed: the security outcomes we’re aiming to achieve. We’re all using different techniques, implementing more automation and achieving greater efficiency and faster improvements — but all in the name of the same outcomes.

If we change the way we think about security delivery, we can not only secure our cloud workloads, but also drive support for the enterprise as a whole as it transforms to a cloud business.

Read the interactive white paper: One for All — New Parity for Your Enterprise Security

More from Cloud Security

AI-driven compliance: The key to cloud security

3 min read - The growth of cloud computing continues unabated, but it has also created security challenges. The acceleration of cloud adoption has created greater complexity, with limited cloud technical expertise available in the market, an explosion in connected and Internet of Things (IoT) devices and a growing need for multi-cloud environments. When organizations migrate to the cloud, there is a likelihood of data security problems given that many applications are not secure by design. When these applications migrate to cloud-native systems, mistakes in configuration…

New cybersecurity sheets from CISA and NSA: An overview

4 min read - The Cybersecurity and Infrastructure Security Agency (CISA) and National Security Agency (NSA) have recently released new CSI (Cybersecurity Information) sheets aimed at providing information and guidelines to organizations on how to effectively secure their cloud environments.This new release includes a total of five CSI sheets, covering various aspects of cloud security such as threat mitigation, identity and access management, network security and more. Here's our overview of the new CSI sheets, what they address and the key takeaways from each.Implementing…

Why security orchestration, automation and response (SOAR) is fundamental to a security platform

3 min read - Security teams today are facing increased challenges due to the remote and hybrid workforce expansion in the wake of COVID-19. Teams that were already struggling with too many tools and too much data are finding it even more difficult to collaborate and communicate as employees have moved to a virtual security operations center (SOC) model while addressing an increasing number of threats.  Disconnected teams accelerate the need for an open and connected platform approach to security . Adopting this type of…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today