Cloud security and privacy: 7 action items you should consider
While cloud migration isn’t as controversial as it used to be for many organizations, issues about security linger. That’s why it’s important for security teams to put together a solid program to protect their cloud environments.
To do that, it’s useful to have a list of action items—high-priority projects—that will serve as the pillars of a robust cloud security program.
Here are key action items to consider to bolster your cloud security and privacy.
Using an industry standard should be the starting point for building, implementing, and maintaining a cloud security strategy.
“Security guidelines can be useful for organizations to ensure that they’ve covered a full set of protections,” said Eric Hanselman, chief analyst at 451 Research.
Guides available to organizations include the Center for Internet Security Controls Cloud Companion Guide, the Cloud Security Alliance Cloud Controls Matrix, and the National Institute of Standards and Technology publication SP 800-144, “Guidelines on Security and Privacy in Public Cloud Computing.”
“Guides can be used to show customers, stakeholders, and partners that you’re investing in security and can pass audits, which is key to doing business in the modern world,” said Arick Goomanovsky, co-founder and chief business officer at Ermetic, an access policy management company.
However, he cautioned: “You have to remember that they give you high-level guidance of what you should be thinking about. They’re not comprehensive. They can miss a lot.”
Cloud security posture management (CSPM) is a way to determine whether an organization’s cloud applications and services are configured securely.
“CSPM is one of the first things an organization should do when it deploys to the cloud, because it allows it to get a quick sense of its security posture,” noted Deloitte Risk & Financial Advisory partner Aaron Brown. “CSPM can identify misconfigurations and vulnerabilities within the cloud platform.”
“CSPM is the necessary sanity check on cloud operations,” 451 Research’s Hanselman added. “It’s the backstop that organizations require to ensure minimum security configurations in cloud.”
Tim Bandos, CISO at Digital Guardian, a data loss protection and managed detection and response company, explained that CSPM allows organizations to monitor risks and fix some security issues automatically. “CSPM can detect issues like lack of encryption, improper encryption key management, extra account permissions, and others,” he said.
The technology also fits nicely into modern application development techniques by integrating security procedures into DevOps processes. “Locking down your environment with vulnerability scanning and CSPM solutions is a key part of a shift-left strategy, securing as much as possible pre-runtime,” said John Morgan, CEO of Confluera, a cloud cybersecurity detection and response provider.
Cloud access security brokers give organizations the visibility to maintain consistent security policies and governance across one or multiple cloud deployments. The broker does network inspection as it sits between the cloud service provider and the organization.
“It can catch shadow IT,” Deloitte’s Brown said. “It makes sure people in your organization aren’t consuming cloud services outside your governance model.”
“CASBs aren’t a comprehensive solution to cloud or SaaS security,” warned Tim Bach, vice president of engineering at AppOmni, a provider of security posture management services.
“Access may get intentionally granted to these users or granted accidentally through misconfiguration or user error,” he continued. “Unfortunately, we see that more than 95% of organizations have overprovisioned access to their external users.”
Knowing what security controls are offered by a cloud service provider (CSP) is an essential part of cloud management. Clearly defined, documented, and agreed-to responsibilities are imperative to securing an organization’s cloud environment.
