Even before the COVID-19 pandemic, many organizations were operating in a multicloud environment, or using more than one cloud provider. During the pandemic, as organizations adjust to a more decentralized workforce, the reliance on multiple cloud platforms is increasingly underway. However, deploying a multicloud environment isn’t without its challenges, especially when it comes to security.
For example, a recent report on Cloud Security Report 2021 by Fortinet touts security as the key concern for CIO/CISOs in a multicloud environment.
Most organizations are pursuing a hybrid or multi-cloud strategy for greater scalability, flexibility or business continuity reasons. In the survey, organizations are most concerned with data protection (58%) followed by a lack of security skills (57%) and understanding how different solutions fit together (52%).
Multi-cloud environments give hackers a larger attack surface, especially when you’re using multiple public clouds. The more services you have running in the cloud, the higher the likelihood you’ll experience a misconfiguration or data exposure incident, mentions Holger Schulze, CEO and Founder, Cybersecurity Insiders that conducted the research on behalf of Fortinet.
At the same time, Schulze identifies that cybersecurity professionals are operating under tight budget constraints, with cost being the primary criteria for deciding which security solution to implement.
“It seems some organizations may still not have grasped that, in order to achieve the business goals that they are looking to realize with cloud; that is – cloud security is a critical enabler.
Another white paper from ISACA on the security impacts of a cloud environment indicates, “Implementations can be driven by different groups: One business team may employ a different cloud provider from the one strategically selected for broader organizational use.” By the time IT is aware of the usage, several business processes may have been set in motion that are dependent upon it.
A sound multicloud security strategy
The key is cultivating a sound multicloud security strategy, beginning with a discovery phase that includes an inventory of current cloud providers in use and how they are being deployed. As the ISACA paper indicates, “To develop a multicloud strategy, it is important for an enterprise to do more than simply recognize that multicloud is occurring. Instead, the enterprise must align its tools, processes, monitoring capabilities, operational mindset and numerous other elements of its security plan to consider that multiple providers are in play. Compliance requirements and risk tolerance must also be considered.
According to a Checkpoint blog, there are basically 8 best practices that will help businesses mitigate security threats in a multicloud environment.
Synchronize policies and settings: If you’re using multi-cloud for availability, with identical operations on two clouds, the same security settings should be maintained across both. This can be achieved by synchronizing policies and settings across providers.
Use different security policies for different services: If your organization is using different workloads/applications, individual security policies should be created for each service. For example, if you’re planning on setting up a new BI service, the advantages of building it on each platform should be considered first. The security policies should then be based on the chosen platform.
Use a system that automates various tasks: This reduces the human risk factor and allows businesses to stay agile. But be sure to address automation from not only a DevOps perspective, but a DevSecOps perspective, to ensure that security is a core consideration and driver throughout the entire process.
Choose the right tools: Find tools and products that allow you to synchronize your security policies across different providers. Your security policies should be written in general terms, with the tools interpreting them based on how your various providers work.
Monitoring: Establish a security monitoring strategy that consolidates logs, alerts and events from different platforms into one location. Tools that automatically remediate issues, or provide guidance on remediation strategies are even better.
Compliance: Find tools to help you maintain compliance in a consistent and efficient way across different platforms.
Single point of control: Simplify your sprawl by using a single-pane-of-glass tool that gives admin a single point of control to manage all application and data security across all their cloud deployments.
Minimize point security solutions: Minimize the number of point security solutions, which don’t integrate well together. Each additional point solution requires expert staff as well as new integrations and deployment. This adds to the complexity and increases the likelihood of error.
The way forward
Misconfiguration of a multicloud environment could make it easier for cyber criminals and hackers to target your organization — but that’s only if the environment is set up poorly. If the IT and security teams can get hands-on with the environment and get to know what’s really there, they can make big steps towards correcting any errors
For enterprises that choose to pursue a multicloud environment, the success will depend on whether it has a holistic strategy in place and executed to ensure value is being added while mitigating the related security vulnerabilities, believe security researchers.
