What are the best practices for securing your cloud network?

Evaluating a CSP is not rocket science. You should request their SOC2 Type II report, and SOC3 should already be publicly available. However, even if the provider makes certain claims in those reports, they will state that network connections are well-isolated, VxLAN is in use, Software-Defined Networks are in place, and there's Layer 3 over Layer 2 implementation. Nevertheless, it's essential to ask yourself if you fully understand what information about your company can be exposed through your own traffic data. Are you confident that your authentication tools don't log passwords via unencrypted data flows?

Enable native security groups, NACLs, and firewall rules on AWS, Azure, and GCP. Cloud WAFs and DDoS protections are deployed. For NGFW capabilities, we can implement NVAs like Check Point and Palo Alto. Microsegmentation is best handled via service endpoints and VPC controls. Forced tunneling to on-prem is configured for internet traffic inspection. We must also regularly review configs, routes, and logs, and validate security through assessments, this should be in the Cloud Security process.

When selecting a cloud service provider (CSP), a crucial step is to assess their security capabilities and policies. Look for a CSP with a solid reputation, compliance with industry standards and regulations, transparent and regular audits, and robust encryption, backup, and recovery options. Review the service level agreements (SLAs) offered by the CSP to fully grasp their roles and responsibilities in securing your cloud network. This evaluation is vital in making an informed choice for your cloud provider, ensuring a secure and reliable cloud environment.

In my cloud experience, the importance of IAM is paramount. Embracing the "least privilege" principle is crucial—only grant the minimum necessary access. MFA isn't optional given the rise in cyber threats; it's a necessity. While SSO eases user access, it should be paired with robust session policies. RBAC brings clarity in access assignments, eliminating ambiguity. Regularly auditing and updating these roles to match team dynamics is essential.

One thing I've found to be very useful, and not applied by many companies, is having a rotation policy for their users' keys. Creating an automatic key rotation policy is essential.

Implementing identity and access management (IAM) in cloud security is pivotal. IAM solutions authenticate users, devices, and services, enforcing precise permissions and policies. Employ multifactor authentication (MFA), single sign-on (SSO), and role-based access control (RBAC) to heighten security and streamline management. IAM safeguards your network, data, and applications, ensuring only authorised entities gain access, fortifying your cloud infrastructure against unauthorised breaches.

I have observed that encryption is often undervalued. While it's vital to encrypt both at rest and in transit, understanding the nuances of key management is equally critical. Using a CSP's default keys might be convenient, but for enhanced security, generating and managing your own encryption keys offers an additional layer of protection. Keeping abreast of advancements in encryption algorithms ensures that data remains impenetrable in a rapidly evolving threat landscape.

Data encryption is fundamental in cloud security. It shields data at rest and in transit, thwarting unauthorised access, tampering, and leakage. Robust encryption algorithms and secure key management are crucial. Utilise your encryption keys for enhanced control, instead of relying on your CSP's defaults, bolstering data protection in your cloud network.

One thing that I have found helpful is to enable the cloud monitoring tools when you are building Virtual Machines and Kubernetes clusters. Cloud monitoring provides wealth of tools to monitor many aspects of performance and track their historical trends. Try also building an Ops Agent in Monitoring, thereby combining logging and metrics into a single agent

Monitoring serves as a fundamental building block in cloud network security. However, automating the monitoring process is essential, especially at scale. This automation encompasses tasks such as processing logs, setting up alarms, and detecting anomalies in traffic patterns. These patterns, which involve both the rate (volume) of traffic and the rate of the number of packets, should be closely analyzed, allowing for swift identification of any deviations or shifts, ensuring a proactive approach to network security.

Adding monitoring using native CSP tooling, or third party tooling is important. You can't control and secure what you can't see, down to the packets traversing your network. Learn the security features of your provider's environment. Make sure that you control who can actually see that event and it will help your detection and response activities.

Continuous network activity monitoring is imperative for threat detection and prevention in your cloud environment. Employ tools and methods for real-time data collection, analysis, and timely alerts regarding unusual events like unauthorised access, data breaches, configuration alterations, or performance irregularities. Establish and regularly update baseline network behavior standards to effectively identify and respond to potential security threats and anomalies.

Not managing your infrastructure is a glaring weakness. Most customers don't understand how "shared" the shared responsibility model for cloud providers is. Automating the patching and updating and day-to-day management is key. Tools are out there that can pivot your infrastructure based on abnormal activity can ensure the security and availability of your cloud infrastructure and most people need it more than they thing they do.

Regular system patching and updating are crucial for thwarting attackers who exploit vulnerabilities in your cloud network. Employ automation and orchestration tools to streamline and simplify this process, reducing human errors and delays. Test patches and updates rigorously before deploying them in your production environment to ensure system integrity and security, minimising the risk of exploitation through outdated or unpatched systems.

Keeping your team up to date is crucial to staying ahead of 0-day attacks and other new attack vectors. By keeping a security channel in your team's messaging system, such as Slack, you can keep news and alerts flowing to ensure your team is always on top of potential threats.

Human error is one of the biggest security risks. Regular training programs can educate staff on best practices and how to recognize phishing attempts or other threats. We use a service named usecure to train our employees on the fundamentals of cybersecurity.

Cloud Security is a "shift-left" event. meaning everyone has to take an active role in keeping cloud environments secure. Policies have to be developed in most cases which bring a challenge of enforcement. Empowering those with CSP environment access watch, and control access and question everyone will prevent social-engineering attacks. Training is key to proactive enforcement. Make sure vendors and applications trying to access your account through automation (cross account / tenant / subscription roles or IAM access key pairs) are regularly audited and validated, and that when you remove a service or vendor access you remove the corresponding access permissions to prevent bad actors from having an (almost) open door.

Educating your staff is paramount in securing your cloud network. Train them on secure cloud service usage, cyberattack prevention, phishing scam avoidance, incident reporting, and compliance with standards and regulations. Cultivate a culture of security awareness and accountability within your team, reinforcing the importance of best practices and policies for cloud security. Well-informed staff play a critical role in safeguarding your cloud environment.

The Principle of Least Privilege is also applicable to Cloud Networking, as it reduces the attack surface. Reducing the attack surface is key in minimizing opportunities for attackers to exploit vulnerabilities.

Your Cloud provider is your partner in security. Just as you have an active interest in securing your cloud, they have an active interest in helping. If you need help, raise a ticket. Even if it is simple having a separate set of eyes (especially on individual contributors, or smaller teams) can go a long way. That is why you pay for support. You may not need consultants and professional services, but you can always use a sanity check when it comes to ensuring the security of your cloud estate. The rules around least needed privilege is also a key point to remember. Approach your cloud access in the same way you would any other critical system. Identify and Validate the user, and give them the least amount of access needed!