Fortifying Cloud Security Before the Year Is Out – Spiceworks News and Insights

A company applying traditional security measures left over from static environments to cloud environments is setting itself up for failure. Greenfield companies about to migrate or newly migrated to cloud services in particular could be victim to a set-it-and-forget-it approach to security, given that the move to cloud platforms requires a great deal of change management resources even before considering data security. We have observed that greenfield companies must go beyond the basics to secure the organization against the top cloud vulnerabilities, like inadequate identity access management security, insecure APIs and interfaces, misconfiguration and inadequate change control. 

See More: How Misuse of Credentials Poses Significant Threat to Cloud Operations

Baseline Security Is Only Step One of Securing Cloud Environments

Baseline security systems and measures are built-in to cloud services of the major providers like AWS and IBM Azure, who, combined, own over half of the world’s cloud infrastructure. The core security infrastructure of such leading providers includes centralized, automated, and fine-grained controls so that CISOs can manage and minimize operational, technical, and security risks. A greenfield company has done well to set up federated identity and least privilege access management policies into its cloud, virtual private cloud firewall rules, a properly configured web application firewall or API gateway, and logging and monitoring dashboards. 

But while this may sound like extensive protection to the non-technical executive, this is the most basic coverage. For example, while logging and monitoring tools will alert you to an active threat event, it is still complex and time-consuming to determine the root cause of the incursion. Optimizing the basic security programs built-in to leading providers is only step one to creating a “safe landing zone” for a tech company to conduct business securely.

Beyond the Baseline Security for a Safe Landing Zone

Cloud service providers expose 1st and 3rd party security constructs at multiple layers — storage, network, application and users, among others. To achieve a “safe landing zone” to do business in the cloud, companies should address the gaps in the baseline cloud providers’ security to protect against certain vulnerabilities like SQL injection, cross-site scripting, DoS and brute force attacks. As previously mentioned, companies need more advanced logging and monitoring to be able to detect and analyze a threat event automatically and to measure and assess behaviors related to data, applications and infrastructure. 

For growing tech companies recently new to the cloud, they may have plugged one or two pressing needs in their security but fall well short of a stout comprehensive defensive posture. More advanced security postures include cloud armor to understand what’s going on from a web application firewall perspective and a security command center to aggregate different signals coming in from different places and be able to investigate them in depth. 

Additionally, companies should appraise their cloud infrastructure and their software supply chain to parse out security gaps, to identify the weak points in their code itself where hackers discover loopholes. They should make sure all these security frameworks are institutionalized into their code base itself.

See More: Scaling Cloud Security with Policy as Code

Assess and Reassess To Stay Ahead of the Increasing Complexity of Cloud Environments

As of 2022, 60% of all corporate dataOpens a new window was stored in the cloud. Data breaches cost companies enormous sums of money in non-compliance penalties and business interruption, ruin corporate reputations, and damage trust with customers. The mass business exodus toward cloud computing means we must fortify our cloud security sooner than later. The time is now for tech companies to assess or reassess cloud security postures.