Chris Gervais

The Cloud Isn’t a Security Issue; It’s a Security Opportunity

Security Issue

In order to stay ahead in today’s competitive business landscape, companies need to constantly innovate. Development teams must continually release new products, features or services and cloud technology, along with agile development practices, make this perpetual iterating feasible.

Cloud technology has undoubtedly enabled companies to innovate quickly and frequently, however, historically it’s introduced a myriad of security concerns, often causing development, operations and security teams to become overwhelmed and distracted. Today, though, security doesn’t have to hold back high-velocity, cloud-based product development cycles. Companies can achieve complete cloud security and compliance without a security issue impacting delivery speed, as long as they use the right tools and best practices across their organization.

Security Issue

Below are three key tips companies should consider in order to overcome any lingering security concerns and scale quickly and securely in the cloud:

1. Educate your team

For companies moving to a cloud-based infrastructure for the first time, it’s essential to discuss the change and make sure everyone understands how they will be affected before any data is migrated over. A key part of this discussion should be explaining that security is no longer just about perimeter defense and prevention; understanding the behavior of your workloads, users and environment is critical knowledge that needs to be shared. It’s important that everyone on the development, operations and security teams understand what all of their assets are doing and what’s taking place within the cloud workload at all times, as this is the best way to detect real cloud security threats as soon as they take place.

2. Track the ephemeral

Back in the days of ‘racking and stacking,’ it was easy to know what servers you had and where they were. But with cloud-based infrastructures, one of the key value propositions is elasticity: you might spin up an EC2 instance or cluster, for instance, do some data analysis for an hour or two, and then turn it off. There are advantages to such elasticity; however, it’s crucial to also have the ability to go back in time and view activity to ensure compliance and potentially investigate any risks. Additionally, as you’re building up and burning down, you want to know that those transient systems and workloads were compliant with your security posture. All too often companies focus on catching cloud security incidents only when they’re happening. But to remain consistently secure and compliant, security teams need to be able to ‘rewind’ and look at instances that may no longer exist.

3. Embrace software-defined everything

The beauty of the software-defined nature of the cloud is that it can actually make security teams’ jobs easier; they’re able to inject themselves throughout the infrastructure landscape and lifecycle. They no longer need to figure out how to capture information from switches, routers, and other devices at various layers of the network and try to correlate the data, because it’s all tied together. Additionally, integrations with tools like PagerDuty and Slack enable internal dialogues that empower non-security team members to collaborate on detection and response to potential issues. And when it’s time for security teams to intervene and investigate, deep audit trails make it possible to track not just whether a user logged in, but what processes they kicked off (and whether it was really them).

Some companies think cloud technology introduces a new layer of vulnerability, however in reality, it’s just the opposite. The cloud presents companies with an opportunity to evaluate their security requirements and reconsider their strategy and processes. It can enable security teams to focus on more strategic initiatives and also improve collaboration with Operations and Engineering teams. This, in turn, allows development, operations and security teams to spend more time on projects that drive real business value and less time frantically checking for potential security gaps.

Don’t let a past security issue prevent your company from migrating to the cloud and reaping its benefits. Discuss the change in detail and address any concerns with everyone in your organization well in advance. Track historical instances in order to ensure security and compliance, and consider implementing a cloud security solution to help gain deep insight into your environment in real-time, because software-defined everything is only possible with complete visibility (and vice versa).

By Chris Gervais

Chris Gervais

Chris Gervais, VP of Engineering. As Threat Stack’s head of Engineering, Chris is passionate about building, not only a rock solid, high-performance product, but also a team of elite engineers, industry best processes and a culture that attracts the best talent. Prior to Threat Stack, Chris held senior positions at lifeIMAGE, Enservio, Partners Healthcare, Inc., Inflexxion, Inc. and VIS Corporation, where he was responsible for engineering, technical operations, and technology strategy for cloud platforms.

View Website

CONTRIBUTORS

Principles of an Effective Cybersecurity Strategy

Principles of an Effective Cybersecurity Strategy

Effective Cybersecurity Strategy A number of trends contribute to today’s reality in which businesses can no longer treat cybersecurity as ...
What Futuristic Transportation Will Look Like In Your Lifetime

What Futuristic Transportation Will Look Like In Your Lifetime

Futuristic Transportation Being stuck in traffic or late for work because of a hold up on the dreaded commute could ...
Battle of the Clouds: Multi-Instance vs. Multi-Tenant Architecture

Battle of the Clouds: Multi-Instance vs. Multi-Tenant Architecture

Multi-Instance vs. Multi-Tenant Architecture  The cloud is part of everything we do. It’s always there backing up our data, pictures, ...
Achieving Network Security In The IoT

Achieving Network Security In The IoT

Security In The IoT The network security market is experiencing a pressing and transformative change, especially around access control and ...
Bryan Doerr

Cyber-Threats and the Need for Secure Industrial Control Systems

Secure Industrial Control Systems (ICS) Industrial Control Systems (ICS) tend to be “out of sight, out of mind.” These systems ...
4 Open Source Business Intelligence Tools For Big Data Reporting

4 Open Source Business Intelligence Tools For Big Data Reporting

Open Source Business Intelligence Tools It’s impossible to take the right business decisions without having insightful information to back up ...
AWS S3 Outage & Lessons in Tech Responsibility From Smokey the Bear

AWS S3 Outage & Lessons in Tech Responsibility From Smokey the Bear

AWS S3 Outage & Lessons in Tech Responsibility Earlier this week, AWS S3 had to fight its way back to ...
3 Ways to Protect Users From Ransomware With the Cloud

3 Ways to Protect Users From Ransomware With the Cloud

Protect Users From Ransomware The threat of ransomware came into sharp focus over the course of 2016. Cybersecurity trackers have ...
Scale Matters in the Enterprise Cloud

Scale Matters in the Enterprise Cloud

The Enterprise Cloud What used to be an unknown and mysterious term, “the cloud” is now a common and mostly ...
10 Ways The Enterprise Can Prevent Data Leaks In The Cloud

10 Ways The Enterprise Can Prevent Data Leaks In The Cloud

Prevent Data Leaks In The Cloud More companies are turning to the cloud for storage. In fact, over 60 percent ...

NEWS

Deloitte TMT Predictions: Machine Learning Deployments, On-Demand Content and Live Events Will Continue to Drive Growth

Deloitte TMT Predictions: Machine Learning Deployments, On-Demand Content and Live Events Will Continue to Drive Growth

NEW YORK, Dec. 12, 2017 /PRNewswire/ -- Deloitte forecasts double digital growth in machine learning deployments for the enterprise, an increasing worldwide ...
U.S. IT Sector Employment Expands by 8,100 Jobs in November, CompTIA Analysis Reveals

U.S. IT Sector Employment Expands by 8,100 Jobs in November, CompTIA Analysis Reveals

DOWNERS GROVE, Ill., Dec. 8, 2017 /PRNewswire-USNewswire/ -- New hiring in computer and electronics manufacturing and technology services and custom ...
Hackers shut down infrastructure safety system in attack: FireEye

Hackers shut down infrastructure safety system in attack: FireEye

Hackers shut down infrastructure safety system (Reuters) - Hackers likely working for a nation-state recently penetrated the safety system of ...