For many
companies, security is still the greatest barrier to implementing cloud
initiatives. But it doesn't have to be.
Organisational
pressure to reduce costs and optimise operations has led many enterprises to
investigate cloud computing as a viable alternative to create dynamic, rapidly
provisioned resources powering application and storage platforms. Despite
potential savings in infrastructure costs and improved business flexibility,
security is still the greatest barrier to implementing cloud initiatives for
many companies. Information
security professionals need to review a staggering array of security
considerations when evaluating the risks of cloud computing.
With such a
broad scope, how can an organisation adequately assess all relevant risks to
ensure that their cloud operations are secure? While traditional security
challenges such as loss of data, physical damage to infrastructure, and
compliance risk are well known, the manifestation of such threats in a cloud
environment can be remarkably different. New technologies, combined with the
blurring of boundaries between software-defined and hardware infrastructure in
the datacentre, require a different approach.
One of the
first steps towards securing enterprise cloud is to review and update existing
IT polices to clearly define guidelines to which all cloud-based operations
must adhere. Such policies implement formal controls designed to protect data,
infrastructure, and clients from attack, and enable regulatory compliance.
Government bodies such as NIST, the US Department of Commerce, and the
Australian Government Department of Finance and Deregulation (PDF) have produced
cloud computing security documents that outline comprehensive policies for
their departments, which can be a useful starting point for implementing a
corporate policy.
It is
important to recognise that cloud security policies should provide protection
regardless of delivery model. Whether building private, public, or hybrid cloud
environments within the enterprise, cloud security is the joint responsibility
of your organisation and any cloud service providers you engage with. When
conducting due diligence on third-party cloud service providers, carefully
review the published security policies of the vendor and ensure that they align
with your own corporate policies.
A
fundamental security concept employed in many cloud installations is known as
the defence-in-depth strategy. This involves using layers of security technologies and
business practices to protect data and infrastructure against threats in
multiple ways. In the event of a security failure at one level, this approach
provides a certain level of redundancy and containment to create a durable
security net or grid. Security is more effective when layered at each level of
the cloud stack.
When
implementing a cloud defence-in-depth strategy, there are several security
layers that may be considered. The first and most widely known protection
mechanism is data encryption. With appropriate encryption mechanisms, data
stored in the cloud can be protected even if access is gained by malicious or
unauthorised personnel. A second layer of defence is context-based access
control, a type of security policy that filters access to cloud data or
resources based on a combination of identity, location, and time. Yet another
popular security layer in cloud-based systems is application auditing. This
process logs all user activity within an enterprise application and helps
information security personnel detect unusual patterns of activity that might
indicate a security breach. Finally, it is critical to ensure that all
appropriate security policies are enforced as data is transferred between
applications or across systems within a cloud environment.
Unfortunately,
there is no one-size-fits-all solution for cloud security that can protect all
of your IT assets. Nor is it wise to adopt a closed-perimeter approach.
Organisations can no longer rely on firewalls as a single point of control, and
security practices must
expand beyond the datacentre to include key control points for endpoints
accessing the cloud and edge systems. When incorporating third-party public and
hybrid cloud solutions in your enterprise IT strategy, you cannot assume that
the security policies of these service providers meet the standards and levels
of compliance required. Make sure you spell out and can verify what you require
and what is delivered. Read
More
No comments:
Post a Comment