Bryan Doerr

Can You Afford the Risk of Not Going to the Cloud?

Risk of Not Going to the Cloud

If you’re considering a migration to a public cloud environment, you’re most likely motivated by the potential to reduce costs, while increasing capital efficiency, productivity, agility, and overall scalability. Yet with so much to gain, many organizations are still not convinced this is the right strategy, and often cite security as their main concern.

Polling results confirm that there is a common view that the public cloud entails simply too much of a security risk. As an example, in a recent poll,  IT leaders either believe that the cloud is less secure than their on-premise deployment or that they have equivalent security in place now.

Don’t bury your head in the sand

It’s hard to say why this misconception still exists. Many CIOs and IT leaders may prefer a hands-on approach, believing that they have better and more secure systems simply because they’re on-premise. “If I can see it, I can secure it,” seems to be their thinking – yet this logic isn’t sound.

No matter the reason, the fact remains that public cloud environments are inherently more secure than on-premise, legacy systems. Cloud service providers generally have more employees – with more experience – focused on security, unlike the average organization that has a limited headcount or even makes security a shared responsibility for their already over-burdened IT staff. Additionally, cloud vendors also have powerful tools and specialized services at their disposal to monitor networks, identify anomalies, and respond to potential threats. Another benefit of cloud service providers – they must also go through frequent, comprehensive testing and auditing in order to comply with stringent regulations and meet service-level agreements with their own customers. Legacy systems do not usually get this same attention.

Achieve better security on day one in the cloud

There’s one other important distinction. Unlike legacy, on-premise systems, cloud services such as Amazon Web Services (AWS) have benefitted from large-scale investments in scalable hardware, configuration and process automation, and the integration of critical log information. This combination of conditions means that many security flaws associated with on-premise security challenges are solved on day one of a cloud migration. Scale, maturity, and a vast universe of integration and solution partners help cloud vendors maintain an unparalleled security environment.

All of this means that cloud vendors are better equipped to address many security challenges that still confront IT and SecOps teams today. For example, cloud deployments successfully overcome three challenges related to conventional (on-premise) networks today: visibility, identity and access management services, and policy declaration and enforcement.

  • Visibility is the detailed understanding of how users, applications, and IT resources are behaving and it is better in the cloud than it is in conventional networks. Now, you can easily see account usage, user behavior, infrastructure management, application/service activity, network activity, and more, which is more difficult and expensive to develop and maintain within on-premise systems.
  • Fully integrated identity and access management (IAM) services that provide credentials for all aspects of cloud interaction and declare which user identities exist and what privileges they possess.
  • Comprehensive policy declaration and enforcement that enables both ad hoc and continuous auditing of AWS resources and their internal configurations.

Defeat known and unknown threats in the cloud

Yet even as you overcome such security challenges, you may still wonder how you can defend against known or unknown threats in the cloud.

To achieve this goal, there are two important questions to consider: “How are my cloud resources configured?” and “What are they doing at any particular time?” We will take a closer look at what both questions entail.

  • Asset configuration: The first step is knowing the configuration state of all your cloud resources, including services, devices, users, and policy objects. Once you have this information, you’ll know if these configurations are consistent with your expectations and best practices and if they are ideally configured with respect to known problems or vulnerabilities.
  • Asset behavior: Of course, not all problems are known before they happen. Malware that exploits undiscovered software vulnerabilities, usage of stolen credentials, and user misbehavior are all examples of issues that can’t be detected through configuration management policy management and can lead to significant security problems.

With the right instrumentation and visibility of the AWS environment, it becomes possible to gain insight into specific behaviors demonstrated by each AWS resource. However, this instrumentation can be a firehose of data. In such an environment of “information overload,” it becomes very difficult to isolate one behavior and determine if it represents a potential security problem.

The endpoint modeling advantage in cloud security

This is where endpoint modeling can help. This technology automatically discovers the role and behavior of cloud resources, and then tracks that behavior continuously to detect when risky or threatening behaviors occur. Then, if one of these assets begins to act abnormally, or in a way that is unexpected, endpoint modeling generates a real-time alert. Security professionals can then quickly investigate to determine if this behavior represents a potential threat and if so, take the most effective action to remediate it.

Endpoint modeling maintains a software model using input from structured data feeds from the cloud vendor itself. For example, in an Amazon Web Services (AWS) cloud environment, endpoint modeling uses AWS services such as VPC Flow Logs, AWS CloudTrail, Amazon CloudWatch, AWS Config, and Amazon Inspector.

In the case of VPC Flow Logs, they provide visibility into the network traffic that AWS servers send or receive. When any AWS VPC resources have a network interaction, a VPC Flow Log entry is made that records the details of the network conversation, including the source and destination, ports, protocol, byte count, and packet count seen. These logs are significant because they represent an auditable record of all network interactions within an AWS VPC.

Together, these AWS services represent a comprehensive visibility layer for any AWS footprint, and provide out-of-the-box visibility into account usage, user behavior, infrastructure management, application and service activity, and network activity. AWS users obtain the benefit of these services without having to bear the maintenance or capital costs required to provide them. By contrast, obtaining similar levels of visibility in on-premise environments is extremely difficult – if not impossible – for most organizations today.

Go confidently to the cloud

Despite the lingering perception that public clouds present too much of a security risk, they are more secure than on-premise, legacy systems for most applications when used in combination with next-generation tools built on top of the rich security information framework established by these clouds. So, if you’ve been putting off a cloud decision thinking there’s too much risk, it may be time to re-think your strategy.

By Bryan Doerr

Bryan Doerr

Bryan Doerr is the chief executive officer of Observable Networks, a leading provider of network security technology and advanced threat detection services. Bryan's career is embossed with over 25 years of industry experience in corporate research, product design, IT management, and executive management. Prior to Observable, Bryan was Chief Technology Officer at Savvis (now CenturyLink), where he led technology research and development and inspired the company's go-to-market strategy spanning cloud, network, hosting, security infrastructure and services, and internal IT systems development.

View Website
As Enterprises Execute Their Digital Strategies, New Multi-cloud Landscape Emerge

As Enterprises Execute Their Digital Strategies, New Multi-cloud Landscape Emerge

The Multi-cloud Landscape The digital universe is expanding rapidly, and cloud computing is building the foundation for almost infinite use cases and applications. Hence, it’s not surprising that of the Fortune 50 enterprises, 48 have ...
Ransomware Cyber-Attacks: Best Practices and Preventative Measures

Ransomware Cyber-Attacks: Best Practices and Preventative Measures

Ransomware Cyber-Attacks “WanaCrypt0r 2.0” or “WannaCry,” an unprecedented global ransomware cyber-attack recently hit over 200,000 banking institutions, hospitals, government agencies, and other organizations across more than 150 countries. The ransomware encrypted user data, and demanded ...
Cloud Security Alliance Issues New Code of Conduct for GDPR Compliance

Cloud Security Alliance Issues New Code of Conduct for GDPR Compliance

EDINBURGH, Scotland, Nov. 21, 2017 /PRNewswire-USNewswire/ -- The Cloud Security Alliance (CSA), the world's leading organization dedicated to defining and raising awareness of best practices to help ensure a secure cloud computing environment, today released the CSA Code of Conduct for ...
Journey Science In Telecom: Take Customer Experience To The Next Level

Journey Science In Telecom: Take Customer Experience To The Next Level

Journey Science In Telecom Journey Science, being derived from connected data from different customer activities, has become pivotal for the telecommunications industry, providing the means to drastically improve the customer experience and retention. It has ...
Secure Business Agility

Contrary to popular belief, a pro-privacy stance is good for business

Pro-Privacy Stance Right now privacy is a hot topic on LinkedIn posts, especially as it pertains to compliance with the General Data Protection Regulation. As a board advisor at Universal Patient Key, we've often talked about ...
The Lighter Side of the Cloud - Procurement
The Lighter Side Of The Cloud - Fear Of Heights
The Lighter Side Of The Cloud - Easter Egg Hunt
The Lighter Side Of The Cloud - Due Diligence
The Lighter Side Of The Cloud - Snowball Effect
The Lighter Side Of The Cloud - Security Overkill
The Lighter Side Of The Cloud - The Apple Watch
The Lighter Side Of The Cloud - Going Viral
The Lighter Side Of The Cloud - Low Tech

CLOUDBUZZ NEWS

China Approves Toshiba's $18 Billion Sale of Its Memory-Chip Unit

China Approves Toshiba’s $18 Billion Sale of Its Memory-Chip Unit

TOKYO—Private-equity firm Bain Capital received approval from Chinese antitrust regulators for its deal to buy Toshiba Corp.’s memory-chip unit, a person familiar with the matter said Thursday. A Bain-led consortium reached the $18 billion deal ...
Kaspersky Lab to open Swiss data center to combat spying allegations

Kaspersky Lab to open Swiss data center to combat spying allegations

LONDON (Reuters) - Moscow-based Kaspersky Lab plans to open a data center in Switzerland by the end of next year to help address Western government concerns that Russia exploits its anti-virus software to spy on ...
Oracle Enables Smart Manufacturing with New Artificial Intelligence Cloud Applications

Oracle Enables Smart Manufacturing with New Artificial Intelligence Cloud Applications

Intelligent applications help improve overall business performance in manufacturing by driving smarter decisions, increasing yields and enhancing production efficiency Oracle today announced new artificial intelligence (AI) cloud applications that enable manufacturing organizations to reduce costs ...