Why Multi-Cloud Doesn’t Mean Clear Skies Ahead for Security Teams

Cloud Security

As part of Solutions Review’s Premium Content Series—a collection of contributed columns written by industry experts in maturing software categories— Steve Riley of Netskope soars into cloud security, and lays out why multi-cloud doesn’t mean clear skies ahead for security teams.

SR - Premium ContentEvery company today is a multi-cloud company. Once, that meant something as simple as subscribing to more than one SaaS application. Now, it means deploying some internal applications to AWS, others to Azure, and yet others to GCP. How did this come to be? Sometimes, a specific cloud platform is mandated by senior leadership. Other times, a particular platform might be more suitable for a specific application or better aligned with developer proficiency.

While multi-cloud may bring benefits, including increased resiliency, flexibility to optimize performance, and cost control, it doesn’t always mean clear skies ahead for a company – especially regarding security.


Widget not in any sidebars

3 Thoughts to Consider in Cloud Security

Lack of Expertise Leads to More Mistakes

It’s already exceedingly challenging to become an expert in just one of the most popular cloud platforms. While they often employ substantially similar vocabulary, the similarity rarely extends to functionality. For instance, identity and access management models for AWS and GCP aren’t alike, even though both vendors call it “IAM.” Bringing the AWS model to GCP will leave your GCP projects exposed. As one can imagine, trying to become an expert in two or three cloud platforms is nearly impossible. This lack of expertise translates into greater mistakes, most of which manifest themselves as security vulnerabilities that are advantageous to attackers.

Companies are not immune to mistakes. In fact, during my time as a cloud security analyst at Gartner, while interacting with thousands of clients, it became clear that the vast majority of cloud security failures are configuration mistakes of some kind or another. It also became clear that developing the discipline of correct configuration is the best thing a company can do to ensure that it uses the cloud safely and securely.

SaaS Applications Offer Minimal Built-In Security

An average company subscribes to anywhere between 100 to 1,000 software-as-a-service (SaaS) applications. While these applications often help to boost productivity and collaboration, amongst other benefits, most, unfortunately, offer few built-in security features. A few of the most business-critical SaaS applications have evolved good security controls over time, but they may be wildly different in quantity and degree. For example, Microsoft Office 365 offers more built-in controls than Dropbox.

Unlike infrastructure-as-a-service (IaaS) public cloud resources, where newly-created objects are closed by default, the opposite is true with SaaS. For example, the default configuration of a Microsoft 365 tenant is such that if users have access to a file, they can share that file with anyone in the world. Whoever finds the link can forward it to anyone else in the world. Microsoft decided to facilitate sharing — it wants it to be as easy as possible for individuals to collaborate. It’s a business decision, one with ramifications, so it’s imperative to think clearly and deliberately about how to configure SaaS security controls. Misconfiguration can be ruinous.

Cloud Security Isn’t One-Size-Fits-All

The best way to protect the cloud is with the cloud. There is no other way. However, a single “cloud security” market does not exist. What companies often face is hundreds of cloud security products in a dozen overlapping markets, all vying for attention and a portion of the security budget. Countless startups have identified cloud security gaps and, as a result, established compelling offerings. In several scenarios, some of the more major, mature security players have acquired such startups, thus evolving their own cloud security capabilities.

It’s easy to be blinded by the shiny lights and false promises, though. One best practice to strengthen a company’s cloud security strategy is to prefer vendors who offer integrated platforms and can work with existing infrastructure, such as SIEMs and endpoint protection products. As a general rule, conduct a proof-of-concept to verify the cloud security platform’s integration effectiveness. It’s also sensible to rely on third-party, provider-neutral security posture management tools to ensure consistent and repeatable security policies across all cloud environments. Posture management tools sit alongside existing cloud deployments, and because they rely on cloud APIs to investigate configuration, they don’t require scheduled production downtime or lengthy integration phases to begin delivering value.

As cloud adoption continues to accelerate, companies must maintain an adequate security posture. By deploying an effective security posture management strategy, companies can continue to find and eliminate cloud security failures rooted in configuration errors.


Widget not in any sidebars

The post Why Multi-Cloud Doesn’t Mean Clear Skies Ahead for Security Teams appeared first on Solutions Review Technology News and Vendor Reviews.



from Solutions Review Technology News and Vendor Reviews https://ift.tt/vf63pQr

Comments

Post a Comment

Popular posts from this blog

5 Key Steps to Include in Your Incident Response Plan

Image
As part of Solutions Review’s Premium Content Series—a collection of contributed columns written by industry experts in maturing software categories— Max Henderson of Pondurance breaks down the key steps every SOC team should follow when building an incident response plan. Sad but true: Thousands of organizations across just about every industry suffer data breaches every year. The 2022 Verizon Data Breach Investigations Report analyzed 23,896 incidents equaling 5,212 confirmed data breaches, which means that the odds of not being breached are pretty slim. But hey– knowledge is power, so embracing the knowledge that you’re likely to be breached and being prepared for it inevitably puts the odds in your favor of a smooth recovery. To be prepared for a cyber-attack means having an incident response (IR) plan, which, according to the NIST Computer Security Resource Center, is “The documentation of a predetermined set of instructions or procedures to detect, respond to, and limit conse
Read more

The Best Business Process Improvement Courses for Beginners

Image
The editors at Solutions Review have compiled this list of the best business process improvement courses that beginners and aspiring professionals should consider. The growing importance of business process management (BPM) best practices and techniques for optimizing day-to-day business operations are paramount in the enterprise. One facet of that is business process improvement, which is a critical factor in a company’s continued success and evolution in changing markets. However, not everyone is fully educated on business process improvement since it changes on a case-by-case basis across companies and industries. With this in mind, the editors at Solutions Review have compiled this list to spotlight some of the best business process improvement courses available on online learning platforms like LinkedIn Learning and Udemy. These training courses can be completed in relatively short periods, making them an ideal choice for busy professionals and students looking to get famili
Read more

Identity Management and Information Security News for the Week of October 14; Nudge Security, McAfee, Castle Shield, and More

Image
The editors at Solutions Review have curated this list of the most noteworthy identity management and information security news for the week of October 14. This curated list features identity management and information security vendors such as Nudge Security , McAfee , Castle Shield , and more. Keeping tabs on all the most relevant identity management and information security news can be a time-consuming task. As a result, our editorial team aims to provide a summary of the top headlines from the last month, in this space. Solutions Review editors will curate vendor product news, mergers and acquisitions, venture capital funding, talent acquisition, and other noteworthy identity management and information security news items. Widget not in any sidebars Identity Management and Information Security News for the Week of October 14 Nudge Security Emerges from Stealth to Address Security’s Hardest Problem: People Nudge Security emerged from stealth this week with the first-ever Saa
Read more