In order to stay ahead in today’s competitive business landscape, companies need to constantly innovate. Development teams must continually release new products, features or services and cloud technology, along with agile development practices, make this perpetual iterating feasible.
Cloud technology has undoubtedly enabled companies to innovate quickly and frequently, however, historically it’s introduced a myriad of security concerns, often causing development, operations and security teams to become overwhelmed and distracted. Today, though, security doesn’t have to hold back high-velocity, cloud-based product development cycles. Companies can achieve complete cloud security and compliance without a security issue impacting delivery speed, as long as they use the right tools and best practices across their organization.
Below are three key tips companies should consider in order to overcome any lingering security concerns and scale quickly and securely in the cloud:
For companies moving to a cloud-based infrastructure for the first time, it’s essential to discuss the change and make sure everyone understands how they will be affected before any data is migrated over. A key part of this discussion should be explaining that security is no longer just about perimeter defense and prevention; understanding the behavior of your workloads, users and environment is critical knowledge that needs to be shared. It’s important that everyone on the development, operations and security teams understand what all of their assets are doing and what’s taking place within the cloud workload at all times, as this is the best way to detect real cloud security threats as soon as they take place.
Back in the days of ‘racking and stacking,’ it was easy to know what servers you had and where they were. But with cloud-based infrastructures, one of the key value propositions is elasticity: you might spin up an EC2 Instance or cluster, for instance, do some data analysis for an hour or two, and then turn it off. There are advantages to such elasticity; however, it’s crucial to also have the ability to go back in time and view activity to ensure compliance and potentially investigate any risks. Additionally, as you’re building up and burning down, you want to know that those transient systems and workloads were compliant with your security posture. All too often companies focus on catching cloud security incidents only when they’re happening. But to remain consistently secure and compliant, security teams need to be able to ‘rewind’ and look at instances that may no longer exist.
The beauty of the software-defined nature of the cloud is that it can actually make security teams’ jobs easier; they’re able to inject themselves throughout the infrastructure landscape and lifecycle. They no longer need to figure out how to capture information from switches, routers, and other devices at various layers of the network and try to correlate the data, because it’s all tied together. Additionally, integrations with tools like PagerDuty and Slack enable internal dialogues that empower non-security team members to collaborate on detection and response to potential issues. And when it’s time for security teams to intervene and investigate, deep audit trails make it possible to track not just whether a user logged in, but what processes they kicked off (and whether it was really them).
Some companies think cloud technology introduces a new layer of vulnerability, however in reality, it’s just the opposite. The cloud presents companies with an opportunity to evaluate their security requirements and reconsider their strategy and processes. It can enable security teams to focus on more strategic initiatives and also improve collaboration with Operations and Engineering teams. This, in turn, allows development, operations and security teams to spend more time on projects that drive real business value and less time frantically checking for potential security gaps.
Don’t let a past security issue prevent your company from migrating to the cloud and reaping its benefits. Discuss the change in detail and address any concerns with everyone in your organization well in advance. Track historical instances in order to ensure security and compliance, and consider implementing a cloud security solution to help gain deep insight into your environment in real-time, because software-defined everything is only possible with complete visibility (and vice versa).
By Chris Gervais
