Cloud Security: Essential Practices and Tools

CLOUD SECURITY GUIDE FOR MID-SIZE ENTERPRISES

As organizations move more information and applications to the cloud, there are growing concerns for data security and regulatory compliance.

70% of organizations ?using a public cloud experienced a security incident in 2020.

--(Sophos State of Cloud Security, 2020 report).

Threats can come from anywhere — whether bad actors trying to compromise credentials and breach your systems or employees not following privacy and encryption standards on sensitive data. It only takes one weak link to wreak havoc.

Cloud-based threats and cyber-attacks are on the rise across the landscape, including IaaS, PaaS, and SaaS services. Bad actors try to target the weakest link across exposure points, including your core infrastructure, identities, network, data, devices, and apps to gain access to corporate resources and valuable data.?

Cloud security is more important than ever before.

Rapid adoption of cloud has also introduced additional complexity and challenges for many organizations, including the need for more sophisticated cloud security solutions.

Cloud security refers to the interconnected strategy, technologies, controls, processes, and policies to secure a cloud computing environment against cyber threats. For many organizations, cloud security is a new and unfamiliar landscape. While many of the security principles remain the same as on-premises, the implementation is often very different.

Let’s explore what we believe are the essential practices and tools to enable them to achieve confidence in your cloud security model.?

PRACTICE #1:

Risk and Control Assessment

Security risk and control assessments ?form the first stage of a comprehensive and proactive approach to cybersecurity and risk management. The objective of a security assessment is to evaluate and outline the existing security practices in place, the weaknesses, vulnerabilities and the gaps between the existing security posture and where it should be.?

Most organizations do not have comprehensive visibility into their security posture and aren't sufficiently prepared to protect against and respond to the threats that could cause significant harm. Many mid-sized organizations with more limited resources are forced to rely on ill equipped IT teams to carry out security functions. This approach usually leads to a reactive, 'whack-a-mole' program that leaves the organization with a poor cybersecurity posture and unable to detect and prevent threats before they happen.

We see organizations using these assessments to kickstart new conversations and investments into their cybersecurity and overall risk management agendas.

By carrying out a risk and control assessment, organizations can improve their visibility into unknown threats and move more proactively based on intelligence of where their existing vulnerabilities are, what their root causes are, and how to mitigate them.

The output is a comprehensive risk and control analysis outlining risk and control posture and vulnerabilities as well as recommendations to mitigate the issues.

How to do it:

• Go Beyond Scans and Tests. Unlike a vulnerability scan and penetration test, which provide a limited snapshot in time of potential vulnerabilities in a system, the security risk and control assessment looks at the whole organization and where its weaknesses are, many of which are non-technical issues to which no amount of testing with tools will ever find (for example, critical data being housed on laptops or in shadow systems – bypassing any security controls that are in place).
• Develop a Risk & Remediation Plan. Informed with?an assessment of your vulnerability to cyber threats and why they exist, you can build a more proactive and comprehensive action plan to prevent them in the future. Build a remediation plan with a prioritized set of mitigation actions based on a security and control gap analysis. Build an ongoing security roadmap that matches your organization's risk-tolerance level, skills, resources and budgets. Your plan should include estimations of impact of remediation (determining which areas reduce the most risk) and key interdependencies.

PRACTICE #2:

Identity and Access Management

Identity is at the foundation of security. You must protect your identities to protect your data and resources. Traditional security practices are not enough to defend against modern security attacks. Security is today's digital environment and threat landscape requires you to “assume breach.” In other words, protect as though the attacker has breached the network perimeter. Today, users work from many locations with multiple devices and apps.

Embrace a Zero-Trust Model

Zero trust is a proactive, integrated approach to security that follows the principles of verifying the identity of everything and anything trying to authenticate or connect before granting access. As part of a modern security framework,?zero trust should extend throughout the organization and serve as a foundational principle in your end-to-end security strategy.

How to do it:

You can do this by implementing Zero Trust controls and technologies across six foundational elements.

• Identities: Identities, whether they represent people, services, or IOT devices define the Zero Trust control plane. When an identity attempts to access a resource, we need to verify that identity with strong authentication, ensure access is compliant and typical for that identity and that it follows least-privilege access principles.
• Devices: Once an identity has been granted access to a resource, data can flow to a variety of different devices—from IoT devices to smartphones, BYOD to partner-managed devices, and on-premises workloads to cloud-hosted servers. This diversity creates a massive attack surface area, requiring we monitor and enforce device health and compliance for secure access.
• Data: Ultimately, security teams are focused on protecting data. Where possible, data should remain safe even if it leaves the devices, apps, infrastructure, and networks the organization controls. Data should be classified, labeled, and encrypted, and access restricted based on those attributes.
• Applications: Applications and APIs provide the interface by which data is consumed. They may be legacy on-premises, lift and shifted to cloud workloads, or modern SaaS applications. Controls and technologies should be applied to discover shadow IT, ensure appropriate in-app permissions, gate access based on real-time analytics, monitor for abnormal behavior, control user actions, and validate secure configuration options.
• Infrastructure: Infrastructure (whether on-premises servers, cloud-based VMs, containers, or micro-services) represents a critical threat vector. Assess for version, configuration, and JIT access to harden defense, use telemetry to detect attacks and anomalies, and automatically block and flag risky behavior and take protective actions.
• Networks: All data is ultimately accessed over network infrastructure. Networking controls can provide critical “in pipe” controls to enhance visibility and help prevent attackers from moving laterally across the network. Networks should be segmented (including deeper in-network micro segmentation) and real-time threat protection, end-to-end encryption, monitoring, and analytics should be employed.

Then, use these practices and tools to tie it together:

• Policy-Driven Access: Modern micro-segmentation means more than networks. It requires we also gate access based on role, location, behavior patterns, data sensitivity, client application, and device security. It’s important to ensure all policy is automatically enforced at the time of access and continuously throughout the session where possible.
• Implement Multi-factor Authentication (MFA): The vast majority of breaches begin with compromised passwords—they are the single weakest link in most security strategies. Multi-factor authentication (MFA) provides another layer of security by requiring two or more of the following authentication methods: Something you know (typically a password), Something you have (a trusted device that is not easily duplicated, like a phone), Something you are (biometrics).
• Leverage Conditional Access: Master the balance between security and productivity by factoring how a resource is accessed into an access control decision. Implement automated access control decisions for accessing your cloud apps that are based on conditions.
• Visibility, Analytics, and Automation: Telemetry from the systems above must be processed and acted on automatically. Attacks happen at cloud speed – your defense systems must act at cloud speed as well, and humans just can’t react quickly enough. Integrate intelligence with policy-based response for real-time automated threat protection.

PRACTICE #3:

Threat and Information Protection

Consistent with global trends -- and given recent geopolitical events -- our clients remain on high alert about the increasing volume of cyber threats as well as the increasing sophistication and impact of attacks. By prioritizing an integrated and automated threat protection program, you can meet the demands for advanced security to protect vital business and personal information.

It only takes one weak link to wreak havoc. With a strong security posture, organizations can manage their threat landscape from end to end, reinforced with integrated and comprehensive security tools, policies, training and compliance. By bringing these elements together, organizations can build layers of protection to proactively protect against threats and reduce the risk of costly data breaches and compliance violations.?

Our clients also tell us about the difficulties they have to holistically and consistently protect and govern their information. This is an especially critical issue for highly regulated industries.?For instance, one report uncovered that 64% of organizations admit that employees externally share PII and other sensitive business data without encryption.

Operational security posture—protect, detect, and respond—should be enabled and informed by unparalleled security tools and intelligence to identify rapidly evolving threats early so you can respond quickly.

Mitigate Threats

Operational security posture—protect, detect, and respond—should be informed by unparalleled security intelligence to identify rapidly evolving threats early so you can respond quickly.

How to do it:

• Use Multilayered Security Controls.?Select a cloud provider and platform, such as?Microsoft Azure , that offers the highest levels of security controls and threat intelligence.
• Enable Detection for All Resource Types. Ensure threat detection is enabled for virtual machines, databases, storage, and IoT. Leading tools such as Azure Security Center has built-in threat detection that supports all Azure resource types.
• Integrate Threat Intelligence. Use a cloud platform, such as Microsoft Azure, that integrates threat intelligence, providing the necessary context, relevance, and prioritization for you to make faster, better, and more proactive decisions.
• Modernize Security Information and Event Management (SIEM). Consider a cloud-native SIEM that scales with your needs, uses AI to reduce noise and requires no infrastructure.

Boost Organizational?Security Awareness

Just as?cloud adoption ?is a journey, cloud security is also an ongoing journey of incremental progress and maturity, not a static destination. As organizations adopt the cloud, they quickly find that static security processes cannot keep up with the pace of change in cloud platforms, the threat environment, and the evolution of security technologies. A strong security posture depends on an organizational culture that fosters the right behaviors to spread adoption of new controls.

How to do it:

• Educate Stakeholders. Share progress on your secure score with stakeholders to demonstrate the value that you are providing to the organization as you improve organizational security.
• Collaborate With Your DevOps Team on Policies.?To get out of reactive mode, you must work with your DevOps teams up front to apply key security policies at the beginning of the engineering cycle as secure DevOps.
• Protect Information Subject to Data Privacy Regulation. A number of information protection controls can be employed to help address data privacy compliance needs and regulations. These controls are within following solution areas: Sensitivity labels; Data loss prevention (DLP); Office message encryption (OME); Teams and sites access controls.
• Secure Apps and Data. Protect data, apps, and infrastructure through a layered, defense-in-depth strategy across identity, data, hosts, and networks.
• Strengthen Encryption. Encrypt data at rest and in transit. Consider encrypting data at use with confidential computing technologies.

Protect the Network

We’re in a time of transformation for network security. As the landscape changes, your security solutions must meet the challenges of the evolving threat landscape and make it more difficult for attackers to exploit networks.

How to do it:

• Strengthen Firewall Protection.?Setting up your firewall is still important, even with identity and access management. Controls need to be in place to protect the perimeter, detect hostile activity, and build your response. A web application firewall (WAF) protects web apps from common exploits like SQL injection and cross-site scripting.
• Enable Distributed Denial of Service (DDoS) Protection. Protect web assets and networks from malicious traffic targeting application and network layers, to maintain availability and performance, while containing operating costs.
• Create a Micro-Segmented Network.?A flat network makes it easier for attackers to move laterally. Familiarize yourself with concepts like virtual networking, subnet provisioning, and IP addressing. Use micro-segmentation, and embrace a whole new concept of micro perimeters to support zero trust networking.

The Plus+ Approach to Cybersecurity

Cybersecurity has become a top priority for many organizations in order to protect their brand, the trust of their clients, and their ability to operate successfully. Our?comprehensive approach to cybersecurity ?help clients understand, address and actively manage the risks they face to successfully operate their business in a secure cloud.?We put our 20+ years of experience to work to help you successfully navigate the rapidly evolving cybersecurity landscape.

Plus+ Consulting is classified as a Registered Provider Organization (RPO) by the CMMC-AB.

?We offer the convenience of choosing a standalone vulnerability scan or receiving one as part of our?Risk and Control Assessment . We enumerate every live host, open port, and available service during the course of the assessment. Then we let you know what the most severe threats are, so we can focus on those to maximize your ROI on the scan.

We can also help you with expert penetration testing if your organization needs a more in-depth solution. We have a range of pen test methodologies:

• Simulating a hacker profiling your business
• Attacking development areas created to mirror your production environment
• Evaluating the social engineering aspects of accessing your company’s information

Safeguard Your Business Assets With Confidence

We help mid-size to large organizations across many industries identify their cyber threats and design comprehensive programs to manage, remediate, and control these risks across their organization.

Get the guidance and capabilities you need for peace of mind knowing your sensitive business assets are safeguarded.We can help you navigate the rapidly-evolving cybersecurity landscape and secure your business now and in the future against the constantly changing range of cyber threats.

To get started,?speak with one of our cybersecurity advisors ?today.

Enjoy this article? Get more insights and resources to help you move from aspiration to results in our?+Insights Center .