Why multicloud security is your next big challenge
While each cloud vendor may have a secure solution for their own cloud service and offer a rich set of security tools to its customers, how can companies ensure that they are protected across all the different boundaries of cloud implementations they employ? This is especially important if they don’t want to implement multiple independent security mechanisms, or have to deal with security logs and data flows that are incompatible?
Why is this an issue? Because the average company has three-five different instances of cloud services deployed in their business– from public cloud to private cloud to hybrid cloud, to on-prem cloud — in addition to legacy data center implementations. All of these have their own way of protecting the organization from malware, data exfiltration and more general attacks. And with increased emphasis on regulatory compliance requirements, the capability to manage all these disparate systems is crucial.
Most companies who use cloud services to deploy applications, websites, databases and related solutions have a problem.
While each cloud vendor may have a secure solution for their own cloud service and offer a rich set of security tools to its customers, how can companies ensure that they are protected across all the different boundaries of cloud implementations they employ? This is especially important if they don’t want to implement multiple independent security mechanisms, or have to deal with security logs and data flows that are incompatible?
Why is this an issue? Because the average company has three-five different instances of cloud services deployed in their business– from public cloud to private cloud to hybrid cloud, to on-prem cloud — in addition to legacy data center implementations. All of these have their own way of protecting the organization from malware, data exfiltration and more general attacks. And with increased emphasis on regulatory compliance requirements, the capability to manage all these disparate systems is crucial.
Although I estimate that about 50 to -60 percent of companies have implemented a SIEM (security Information and event management) solution, which in theory aggregates threat intelligence information from a variety of sources (data center, network routers, end points, cloud servers and so on), it may or may not be fully integrated with each instance of cloud in a multi-cloud environment. In fact, we’ve seen organizations that rely on the available public cloud threat detection infrastructure by itself, rather than even try to integrate with a complete SIEM solution.
That practice essentially makes each cloud instance a standalone threat management system and requires the security group to monitor multiple information sources to see if they are under attack. Further, it’s quite possible that a particular SIEM does not support the APIs for a particular cloud instance that companies are using. And what should companies that have not implemented a SIEM system do to manage their security? At best this is a messy situation, and at worst, it can expose companies to unneeded security risks present within the gaps.
With so many corporate cloud service providers working with enterprises (e.g., AWS, Google Cloud, Microsoft Azure, Oracle, IBM, SAP, Alibaba, Baidu, Tencent and so on.
