#1. Understand The Shared Responsibility Model
One of the main selling points of cloud computing is that it allows an organization to outsource some responsibility for its IT infrastructure to a cloud services provider. However, a cloud provider does not take full responsibility for their customer’s infrastructure or for securing it.
A clear understanding of the Cloud Shared Responsibility Model is an essential foundation for a cloud security strategy. The Shared Responsibility Model breaks down responsibilities between the cloud provider and the customer for various cloud service models, such as Infrastructure as a Service (IaaS), Platform as a Service (PaaS), and Software as a Service (SaaS). An understanding of the model and the responsibilities that it assigns to the customer enables an organization to develop a strategy to fulfill its responsibilities.
#2. Adopt Zero Trust Control
The zero trust security model is designed to limit an organization’s cybersecurity risk. Under a zero trust model, all users and devices are treated as potential threats, and each access request by an authenticated user is independently evaluated based upon role-based access controls and environmental factors.
Adopting cloud-based infrastructure expands an organization’s attack surface, and the unique nature of the cloud means that cloud-based infrastructure is more exposed to external threats than on-premise resources. Adopting and enforcing a zero trust security model helps to improve cybersecurity risk by reducing the probability and impact of an intrusion.
#3. Optimize Uptime and Performance
Shadow IT is a problem in many organizations. The most common cause for this is that corporate services do not meet employees’ needs, so they seek out alternatives and workarounds that enable them to do their jobs efficiently. However, these alternatives often also place the company at risk.
One way to minimize the risk of shadow IT is to work to eliminate the pain points that cause employees to seek out alternatives. Optimizing the performance and uptime of cloud services helps to ensure that employees have a frictionless experience that eliminates the need to search for more usable but less secure alternatives.
#4. Acknowledge The Importance of Visibility and Observability
Visibility is difficult to achieve in the cloud. The cloud service provider controls the underlying infrastructure, making it impossible to deploy security appliances within cloud data centers.
Visibility and observability are equally as important in cloud environments as it is on-premises. An important aspect of cloud security is achieving consistent visibility across an organization’s entire IT ecosystem. This requires deploying security solutions that offer support for both on-prem and cloud environments.
#5. Develop a Security Posture and Governance Strategy
With the move to the cloud, an organization’s cyber attack surface and exposure to cyber threats. Protecting against these threats requires a clearly defined security strategy.
The first step in developing this strategy is determining the organization’s target security posture and governance requirements. From there, the company can work to develop and put in place policies and security controls, such as a cloud security posture management (CSPM) solution, that can achieve these goals in the cloud as well as in its on-prem environment.
#6. Enforce Consistent Security Policies
Securing the cloud can be more difficult than in an on-premise network. In the cloud, a company lacks control over the underlying infrastructure, meaning that it is more difficult to design the network to meet its needs and to deploy security appliances.
However, despite these difficulties, it is essential to create and enforce consistent security policies across an organization’s entire IT ecosystem, including both on-prem and cloud-based environments. In the modern enterprise, on-prem environments and cloud deployments are closely linked. If a company does not consistently enforce security across its entire environment, an attacker can exploit security weaknesses in one part of the corporate network for initial access and then leverage its connections to on-prem or other cloud environments to move laterally and access other corporate IT assets.
#7. Achieve Compliance With Regulatory Mandates
Most companies need to comply with at least one and potentially several regulations. In recent years, existing regulations such as the PCI-DSS and HIPAA have been augmented with a growing number of new requirements (GDPR, CCPA, CMMC, etc.) that are designed to protect certain types of sensitive data.
In most cases, the data protected by these regulations is stored, processed, or transmitted on an organization’s cloud-based infrastructure. These cloud deployments are also within the scope of compliance audits and must meet compliance requirements.
Often, compliance requirements will dictate the choice of cloud infrastructure used by an organization, such as public or private clouds. Additionally, companies must identify and put in place the required security controls needed to protect this data (encryption, access controls, etc.) in the cloud as well as on-premises.
#8. Deploy Centralized Identity Management
Expanding to the cloud introduces significant complexity to an organization’s IT infrastructure. Often, companies adopt a multi-cloud infrastructure with solutions from various providers. A company may also deploy cloud solutions under different service models, such as SaaS, PaaS, and IaaS services.
With this additional complexity comes the need to manage users’ identities across all of these new services. Centralized identity management is critical to cloud security because it allows companies to ensure that user accounts are properly provisioned and deprovisioned and that permissions are updated as needed. Forcing users to individually authenticate to each service decreases usability and increases the risk that excessive permissions will be abused.
#9. Secure The Infrastructure
Infrastructure security in the cloud is complicated due to the relationship between the cloud services provider and the cloud customer. As the Cloud Shared Responsibility Model outlines, cloud customers have different amounts of responsibility for their infrastructure in the cloud depending on the cloud services model selected (SaaS, PaaS, IaaS, etc.).
That said, securing infrastructure in the cloud is essential to securing the services built on top of it. In addition to managing the levels of infrastructure under their control according to the shared responsibility model, companies should also look at securing the network and selecting the cloud platform best suited to their security requirements. In some cases, security policies and regulatory requirements may mandate the use of a private or hybrid cloud model rather than the public cloud due to the ability to better control access to the underlying infrastructure.
#10. Use Strong Network Controls
Cloud infrastructure is directly accessible from the public Internet and lies outside the traditional network perimeter. Additionally, cloud-based services often communicate with other cloud environments and on-premises systems. This makes it more difficult for companies to restrict access to cloud-based resources and makes strong cloud network security controls vital.
Cloud networks should be segmented based upon the purpose, risk levels, and sensitivity of various cloud resources. By implementing network segmentation, an organization gains the ability to monitor, inspect, and enforce security controls on not only north-south traffic flows but also east-west traffic between segments. This more granular visibility and security enforcement is essential for a zero trust security strategy and enables a company to compartmentalize risk and potential intrusions into its network.
#11. Protect Workloads
Companies are increasingly adopting cloud-based workloads to take advantage of the full potential and benefits of the cloud. Serverless and containerized applications are often more agile and scalable than traditional applications, making them better suited to rapid DevOps development cycles.
These cloud workloads have unique security needs that may not be met by traditional, built-in cloud security solutions. As part of a cloud security strategy, companies must deploy application security solutions that provide the granular visibility and security required by their cloud workloads.
#12. Protect Against Alert Fatigue
Most enterprise security operations centers (SOCs) are overwhelmed by alerts from their arrays of security solutions. The average enterprise receives 10,000 alerts per day, which is far more than a SOC team is capable of triaging, investigating, and responding to. As a result, true threats are lost in the noise and other important work is left undone as SOC analysts waste time dealing with false positive detections.
With a move to the cloud, corporate security infrastructure will likely grow more complex, causing alert volumes to rise even further. Ensuring that the company is capable of maintaining security visibility and protecting itself against cyber threats requires a deliberate effort to manage alert volumes. By selecting an integrated security solution that uses artificial intelligence and preventative controls to minimize false positive alerts, an organization can ensure that alert volumes remain manageable and that analysts’ efforts are focused where they can provide the most benefit to the enterprise.
#13. Leverage Cloud Intelligence, Forensics, and Threat Hunting
Most cloud security controls are protective and detective, designed to help prevent threats or to detect them once they enter the network. However, these controls provide imperfect protection and need to be augmented by more proactive security as well.
Both responsive and proactive cloud security requires access to high-quality information about threats and the ability to respond to these threats in real time. For this reason, threat intelligence feeds and automation are essential components of a cloud security strategy. Automated threat detection and response systems can ingest log data and threat intelligence and take action to prevent, remediate, or quarantine potential threats to the organization.
Threat intelligence and automation also support proactive and human-driven security efforts, such as threat hunting and forensic investigations. The ability to automatically collect and process data from across the entire IT environment provides valuable context to threat hunters and investigators and enables more rapid, scalable, and sustainable threat detection and response.
Achieving Cloud Security with Check Point
Before an organization can design an effective cloud security strategy, it must know which security gaps it needs to fill. A good starting point is Check Point’s Cloud Security Checkup, a self-guided assessment tool for cloud security. Based on the results of this assessment and a review of Check Point’s Cloud Security Blueprint, a company can start developing a strategy for securing its cloud resources.
A vital part of this strategy is a security solution capable of meeting the unique security needs of the cloud. Request a free trial of Check Point CloudGuard to see how it can help to simplify and streamline your organization’s cloud security strategy.
Feedback