As traditional perimeters disappear, organisations need to adopt new measures to ensure data and devices are safe in the cloud.
One observation about those clouds – they were constantly morphing. They had no fixed edge as they billowed and blew across the sky.
That lack of an edge that clearly defines the cloud environment your organisation may be considering sending your data to can make it seemingly difficult to protect. In fact, security is cited in numerous studies as the number one inhibitor to cloud adoption.
Think about possible points of entry for an attacker in a cloud environment. A customer uses an insecure mobile phone to access your network … you can be attacked. A contractor on your network uses a web application that has an embedded vulnerability, a back door that is not protected … you can be attacked. A database administrator at the cloud provider shares a password with someone … your data can be breached. These represent just some of the scenarios that keep the chief information security officer awake at night.
Securing the security perimeter of the traditional data centre was made relatively straightforward with the help of firewalls and intrusion detection systems. When we traded terminals for PCs, anti-virus software helped keep those devices safe.
With employees, customers, business partners, suppliers and contractors increasingly accessing corporate applications and data with mobile devices from the cloud, protecting the edge of the network is no longer enough. As the traditional perimeter disappears, here are six things to do to help ensure security in the cloud.
1. Know who’s accessing what
People within your organisation who are privileged users, – such as database administrators and employees with access to highly valuable intellectual property – should receive a higher level of scrutiny, receive training on securely handling data, and stronger access control.
2. Limit data access based on user context
Change the level of access to data in the cloud depending on where the user is and what device they are using. For example, a doctor at the hospital during regular working hours may have full access to patient records. When she’s using her mobile phone from the neighborhood coffee shop, she has to go through additional sign-on steps and has more limited access to the data.
3. Take a risk-based approach to securing assets used in the cloud
Identify databases with highly sensitive or valuable data and provide extra protection, encryption and monitoring around them.
4. Extend security to the device
Ensure that corporate data is isolated from personal data on the mobile device. Install a patch management agent on the device so that it is always running the latest level of software. Scan mobile applications to check for vulnerabilities.
5. Add intelligence to network protection
The network still needs to be protected – never more so than in the cloud. Network protection devices need to have the ability to provide extra control with analytics and insight into which users are accessing what content and applications.
6. Build in the ability to see through the cloud
Security devices, such as those validating user IDs and passwords, capture security data to create the audit trail needed for regulatory compliance and forensic investigation. The trick is to find meaningful signals about a potential attack or security risk in the sea of data points.
Adding a layer of advanced analytics – a security intelligence layer – brings all of this security data together to provide real-time visibility into the both the data centre and the cloud infrastructure.
In the same way that clouds in the sky have an ever-evolving perimeter, so does cloud computing. Security is an important factor in cloud deployments and by building in the security capabilities described in these six steps, organisations can better manage and protect people, data and their devices in the cloud.
