Moving to the cloud? Read about 8 security challenges to watch out for

1. Control and Monitoring

As organizations move increasingly more applications to cloud environments, the need to maintain an overview of what's happening in all cloud deployments across the company can be a challenge. This complicates the detection of and response to security threats.

Control and monitoring tools should be capable of gathering and analyzing data related to the security of the entire cloud environment, thereby providing real-time alerts and reports. Organizations can also use Security Orchestration, Automation, and Response (S OAR) platforms to automate incident response processes and enhance their detection and response capabilities.

The default security level of cloud services may not meet customer requirements (either their own or those mandated by, for example, a regulator) and standards, which they have applied with significant effort in their data centers. Therefore, it is necessary to transfer the relevant measures to the cloud environment. At the same time, there is the adoption of PaaS and SaaS, whose unique nature requires the creation of entirely new or targeted security measures.

The cloud environment naturally offers a wide range of IDS/IDP applications, which necessitates the secure integration of on-prem SIEM with cloud security services. Otherwise, there is an increase in the number of applications that security teams have to work with.

2. Data Protection

Cloud environments can make it easier for hackers to access sensitive data and also make it harder to detect when there has been a breach.

One way to ensure partial data security is through encryption keys. By default, encryption keys are fully under the control of the provider, essentially handing the keys "to your house" over to a "stranger." While one might argue that there is a contract with the provider outlining specific conditions, in the end, it hardly matters because someone else already has the keys. A solution could be to use your own keys (BYOK – Bring Your Own Key or Customer Managed Encryption Keys) or to employ specialized devices for securing encryption keys, technically called Hardware Security Modules (HSM), whether on a pay-as-you-go model or as an on-prem instance. Another approach is to design architectures based on client-side encryption, where data is encrypted before being sent to the cloud. However, due to its complexity, this method is primarily used in cases with the highest data security demands.

3. Data Classification

Data classification is one of the fundamental pillars for proper security management. The data classification process categorizes data based on their sensitivity and business impact to identify risks and appropriate security measures.

With the growth of cloud data processing, the importance of proper and timely data classification has increased. Cloud technologies offer extensive options for every stage of the data lifecycle, and without quality classification, it can be challenging to choose the optimal approach. In the cloud, physical and geographical boundaries often blur, and proper classification helps meet various compliance requirements. Furthermore, with the advent of AI/ML, tools for detecting and protecting sensitive data (e.g., personal information, financial data, access credentials) have emerged, and proper classification facilitates their use.

4. Access and Permission Management

With so many different users and systems accessing cloud resources, managing and controlling access and permissions in a way that keeps data secure can be challenging. Organizations can address this issue by implementing identity and access management (IAM) solutions, which provide granular access control and ensure that only authorized users access sensitive data. Organizations should also implement multi-factor authentication (MFA). Now more than ever, the "Least Privilege" approach is crucial. Its goal is to ensure that both the user and the administrator access only the information they absolutely need for their job or specific task.

Moreover, cloud adoption is often associated with the adoption of the DevOps approach, which places additional demands on cybersecurity due to the number of users involved. In this context, it is essential to ensure role separation and proper setting of user rights.

5. Compliance Requirements

Many organizations are subject to strict regulations and regulatory requirements, including GDPR, EBA, HIPAA, and PCI-DSS. Meeting these requirements can be complex and is always a multifaceted discipline. Organizations can address this challenge by collaborating closely with their cloud providers to understand their requirements and ensure their cloud deployments are configured to meet them.

However, in the end, it is the organizations themselves and their solutions created specifically in cloud environments that must meet the arising security requirements. Organizations should also implement security solutions that will help them meet compliance requirements, such as encryption, access control, and incident response capabilities.

Additionally, there are new requirements for geographical data location. It is possible that some global cloud services may require the location of specific data types (like SSL certificates) in a geographical region different from the customer's. This can pose a problem with regulatory requirements.

6. Shared Responsibility Model Solution

In a cloud environment, the responsibility for security is shared between the cloud provider and the customer. A misunderstanding or lack of knowledge of this shared responsibility model can lead to security gaps.

Therefore, it is crucial for organizations to understand the shared responsibility model and both the cloud provider's security responsibilities and their own. They should also regularly review their cloud deployments and collaborate with their cloud provider to address any identified security deficiencies.

7. Third-Party Vendor Risk Management

Organizations often rely on third-party suppliers who provide cloud services, which can pose additional security risks. This issue can be addressed by implementing a Vendor Risk Management (VRM) program and regularly assessing the security status of their vendors. It is also advisable to include security clauses in their contracts with suppliers and to implement incident response plans that address the possibility of a security incident involving a third-party supplier.

8. Environmental Complexity

There is a demand for secure integration between on-premises and the cloud world:

• Datacenter boundaries vs the complexity of the on-prem and cloud environment (everything is everywhere) - you are not in your own home.

• Geographical location (connecting geographically distant locations) - data is spread across the world, with regulatory implications (especially from the EU).

• New patterns in network configurations.

A crucial discipline and area for addressing all the above challenges are security baselines. It is essential to define them and then enforce and monitor security standards for each service a customer wants to use. Default settings provided by the supplier offer basic security, which may not meet customer requirements. Therefore, it is vital for each service within the offered portfolio that you decide to use to have this defined and ensure the desired security level.

At the same time, one must not forget about security monitoring, because it is easy to make a mistake. An admin might misclick "one item" in the settings, and suddenly the service is publicly accessible on the internet to everyone or exposes sensitive data.

It is better to leave nothing to chance and involve experienced experts.

Cloud security is an ever-evolving field, and it can be challenging for organizations to keep up with the latest threats and best practices. Companies should consistently inform themselves about the newest security threats, best practices, and solution implementations. They should also invest in regular security training for their employees and raise awareness about new security solutions and services available.

It is worth noting that cloud security is so complex that it is advisable to involve seasoned experts with hands-on experience from real implementations and solutions. There are several reasons for this, but two main ones stand out: time-saving by acquiring proven know-how and avoiding "exploring dead-ends." Do you want assistance with this issue? Please do not hesitate to contact us at mbares@thetrask.cz, and we will be happy to discuss everything with you.

Author

Martin Bares
Cybersecurity, IT Manager at Trask
mbares@thetrask.com