Cloud security: what you need to know

Cloud security is not that different from on-premises security. Confidentiality, integrity, and availability remain the main pain points to solve, but the tools and means of assuring them are different. We take a look at cloud security and what it means for both users and providers.

Best practices

Security in a public cloud environment can be tricky. Access control mechanisms for cloud providers are typically separate from internal processes. They sometimes fall outside approved and documented methods to manage access. This is why minimising root account access and group accounts remains the best solution for both cloud and traditional systems administration.

Organisations need to extend their identity services into the cloud for a strategic use of on-demand computing services. They should, however, keep in mind that the creation of a federated Identity and Access Management scheme allows for auditability, traceability, and accountability of actions only as long as you can enforce it.

Cloud security models

The cloud security model is different for each provider. Cloud services providers manage the hardware and hypervisor in an efficient manner based on very large scale. Meanwhile, the clients take care of the specific aspects of their environment, based on their application requirements. For example, the cloud provider manages the patching of the hypervisor and provides a set of allowable operating system versions allowed on their platform; the users are responsible for patching their virtual instances and installing the correct versions of required applications. There is a sliding scale of allowances made when transitioning from IaaS to PaaS and SaaS. The cloud provider takes on increasing responsibilities for managing applications, while the user benefits from the increased abstraction to focus on the activities bringing the most benefits.

What we think

 

Certifications ensure that cloud providers adopt best practices and provide third party attestation, guaranteeing their level of compliance. They also give organisations assurance that providers can accept or minimise the risk they transfer as part of the outsourcing during procurement. The challenges for cloud services clients are to determine which work best for their operating environment and to adapt their existing processes to map cloud controls to their own.

Cloud contracts: how to get them right?

Entering into an agreement with a cloud provider is the same as negotiating a contract with any outside vendor. Procurement and legal groups should address specific points based on the potential impact to your business services. The most important is to make sure that any technological solution fully complies with the applicable EU Data Protection legislation (i.e. Regulation (EC) 45/2001, or the upcoming GDPR).

Cloud contracts are often complex and contain many clauses with significant implications on the organisations. To name just a few: service level agreements (SLA), data security, responsibilities, infrastructure availability and ongoing pricing and support.

Cloud deployments provide limited physical control over infrastructure, limited vulnerability assessments, and limited availability of audit logs and activity monitoring. So, it’s critical to have a robust governance process around vendor contracts, terms and conditions.

Data protection and privacy become critical in a public cloud environment because important data now resides outside the organisations’ firewall. Therefore, a breach could result in major ramifications. Cloud security governance must deal with elasticity, multi-tenancy, and abstracted controls. It should also consider data identification, control, confidentiality, integrity and availability.