Web Security: How Can GRC Help?

Cloud Security

An integrated GRC approach to cloud acceptance, adoption and scale includes the risk perspective from the beginning. Harnessing the power of cloud security with a GRC framework can promote and improve information security practices and drive better business performance.

One of my favorite Dilbert cartoons shows Mordac, the “Preventer of Information Service,” saying, “cloud computing is no good because strangers would have access to our data.” Dilbert tries to explain encryption technology is trustworthy—certainly more trustworthy than Mordac himself. The grain of truth here is that, within any organization, there are still mixed responses to cloud computing.

Today, enterprises are adopting cloud computing in a big way. According to CIO.com, the National Association of State CIOs (NASCIO) recently surveyed its members and reported cloud adoption is the second biggest priority for CIOs, only after cybersecurity. But CIOs today are still choosy about what data they want to place in the cloud. The majority have asserted that they do NOT want to put confidential company financial data or credit card data in the cloud. Makes sense—personal information Data leaks are terrible PR.

Simply stated, the perception of cloud computing at most companies is mixed. Those advocating for the cloud speak to its improved agility, flexibility, high performance and lowered costs. Those who are still on the fence are concerned about data security, decentralization of their IT team, service reliability and the loss of control over their IT ecosystem. Both sides of the debate have valid points.

10 Key Imperatives

To increase acceptance and adoption of cloud computing at your organization, there are ten must-haves that can be sub-divided into two groups – infrastructure imperatives and information security imperatives. The first set is the infrastructure imperatives, which affect the cloud-hosting environment:

Federated identity management & access control – The cloud-based system must permit several users at a time, with differing levels of access to ensure proper segregation of duties.
Centralized control and visibility over the IT landscape – The IT manager should have the capability to monitor and manage the system from a centralized console.
Dynamic failover protection & data replication – The system should guarantee 99.5 percent reliability as a minimum.
Automated application performance management – For a uniform user experience, the system should ensure performance as per the service-level agreement (SLA).
Network segmentation – The ability to segment and segregate the networks, across various customers, will ensure minimal propagation of any cybersecurity issue.

Given the proliferation of cybersecurity threats and Vulnerabilities, the remaining five are information security imperatives that apply to both hosted and otherwise.

Continuous threat and vulnerability assessments – Data center security needs to be assessed regularly to ensure adherence to latest information and network security standards.
Security upgrades and monitoring on demand – Monitor security posture and ensure that regular updates are being provided as per the latest set of cyber-threats.
Meta-data driven information security – Analysis of meta-data being generated across the security and system logs will identify significant, potentially malicious, patterns.
Continuous control monitoring of policies – It is vital to have continuous monitoring and adherence to security, access and other policies across the cloud.
Virtualized security & perimeter controls – The security and perimeter controls need to percolate to the virtualized machine level.

How can we achieve these imperatives across cloud-based deployments?

The enterprise needs to implement a robust governance-risk management-compliance (GRC) framework across the complete cloud infrastructure, which can act as a the single source of truth across all regulatory compliances, security and access controls as well risk and vulnerability assessments.

Wish list for a GRC Framework

Basic Components

First, let’s look at the “bare minimum” requirements for a GRC framework for cloud computing:

Continuous system monitoring – Feed regular system related logs and reports into the GRC framework for continuous risk assessments.
Penetration Testing audits – Audit the third-party penetration test results, findings and remediations on a pre-determined schedule.
Incident response management – Create and manage a defined workflow within the organization to ensure a coordinated response from various departments such as IT, Legal, Finance, etc. and respond appropriately to any cloud security events.
Data portability testing – Perform a yearly or quarterly audit and document the process and audit findings to ensure that the data is portable across data centers.
Disaster recovery & business continuity – Ensure that proper disaster recovery and business continuity measures are in place along with regular tests and documentation.
Onsite & offsite backup audits – Audit backups to check for their ability to restore data.

Advanced Components

Once the must-haves have been checked off, here is a list of “nice to haves”:

Data encryption audits – Audit and document the storage control and key management procedures for encrypted data. This is typically applicable for sensitive data only.
Forensics log management and reporting – Analyze meta-data continuously generated by system and security logs, and identifying any adverse patterns.
Elasticity & load tolerance testing – Ensure that resources can be augmented in the peak performance periods by performing regular load tolerance and elastic demand management testing.
Advanced cyber-attack prevention measures – Monitor and implement cyber attack prevention measures pro-actively by integrating with new threat and vulnerability solutions.
Advanced cloud security analytics – Establish an advanced cloud security analytics information center as part of the GRC dashboard and centralize its monitoring and management.

Apart from the components listed above, as the cloud computing world evolves, there is an increasing number of regulations and checklists coming up to ensure its adherence to established standards, including SSAE16 SOC 2 controls, FedRAMP certification, HIPAA regulation and Cloud Security Alliance (CSA). Your organization’s GRC framework for cloud should be able to streamline the audit and checklist-based assessments around these and ensure proper adherence to world-class standards for cloud adoption and security.

Conclusion

An integrated GRC approach to cloud acceptance, adoption and scale includes the risk perspective from the beginning. Harnessing the power of cloud security with a GRC framework can promote and improve information security practices and drive better business performance.

By Vibhav Agarwal

Martin Mendelsohn

Of Rogues, Fear and Chicanery: The Colonial Pipeline Dilemma and CISO/CSO Priorities

The Colonial Pipeline Dilemma The Colonial Pipeline is one of a number of essential energy and infrastructure assets that have been recently targeted by the global ransomware group DarkSide, and other aspiring non-state actors, with ...
Alex Tkatch

Dare to Innovate: 3 Best Practices for Designing and Executing a New Product Launch

Best Practices for Designing and Executing a Product Launch Nothing in entrepreneurial life is more exciting, frustrating, time-consuming and uncertain than launching a new product. Creating something new and different can be exhilarating, assuming everything ...
James Crowley

Does Open-Source Software Hold the Key to Data Security?

Open-Source Software Data Security Whether you realize it or not, open-source software is everywhere in our everyday tech, from mobile phones to air travel, from streaming Netflix to space exploration. Open-source software has played a ...
James Corbishly

Addressing Teams Sprawl in the Remote Workspace

Teams Sprawl in the Remote Workspace As working from home has become the new everyday norm, with more employers embracing the remote-work model as a new and likely permanent fixture of the employment world, there ...
David Loo

The Long-term Costs of Data Debt: How Inaccurate, Incomplete, and Outdated Information Can Harm Your Business

The Long-term Costs of Data Debt It’s no secret that many of today’s enterprises are experiencing an extreme state of data overload. With the rapid adoption of new technologies to accommodate pandemic-induced shifts like remote ...

CLOUD MONITORING

The CloudTweaks technology lists will include updated resources to leading services from around the globe. Examples include leading IT Monitoring Services, Bootcamps, VPNs, CDNs, Reseller Programs and much more...

  • Opsview

    Opsview

    Opsview is a global privately held IT Systems Management software company whose core product, Opsview Enterprise was released in 2009. The company has offices in the UK and USA, boasting some 35,000 corporate clients. Their prominent clients include Cisco, MIT, Allianz, NewVoiceMedia, Active Network, and University of Surrey.

  • Nagios

    Nagios

    Nagios is one of the leading vendors of IT monitoring and management tools offering cloud monitoring capabilities for AWS, EC2 (Elastic Compute Cloud) and S3 (Simple Storage Service). Their products include infrastructure, server, and network monitoring solutions like Nagios XI, Nagios Log Server, and Nagios Network Analyzer.

  • Datadog

    DataDog

    DataDog is a startup based out of New York which secured $31 Million in series C funding. They are quickly making a name for themselves and have a truly impressive client list with the likes of Adobe, Salesforce, HP, Facebook and many others.

  • Sematext Logo

    Sematext

    Sematext bridges the gap between performance monitoring, real user monitoring, transaction tracing, and logs. Sematext all-in-one monitoring platform gives businesses full-stack visibility by exposing logs, metrics, and traces through a single Cloud or On-Premise solution. Sematext helps smart DevOps teams move faster.