Amidst Cloud Complexity, You Need Complete Clarity

As cloud environments become ever-more complex, you need complete visibility -- from how your data and users are engaging with your environment to how your various stakeholders are changing your infrastructure – to achieve security and compliance.

jeremy bishop 200527

While cloud adoption continues at a fiery pace, the speed to migrate to this new platform sometimes comes at the cost. Meaning, we’re not always paying the necessary attention required of critical security needs. CIOs certainly recognize and plan for data security, but because the cloud operates as a new paradigm, some IT professionals don’t fully understand the complexity of their new environment and how to be secure within it. The cloud certainly is a more complex environment, but it is also more flexible in serving customers’ needs. To build an effective and secure cloud environment, your organization needs visibility across how your data and users are engaging with your environment, and how your various stakeholders are changing your infrastructure.

Let's first think about complexity, and we can start by questioning what that means in the context of a public cloud platform. Complexity doesn't have to necessarily mean difficult, however, and this is an important distinction. Among the selling points of the cloud: it makes the life of IT easier. There are fewer physical assets to manage, a decreased reliance on technology expertise, and an easing of the overall technology coordination burden. While these things are true, ease of use and an elimination of some of the more arduous management duties is only part of the cloud story.

There are two aspects related to security that require attention, and herein is where you can see where things can get a bit complex:

  1. Cloud vendors use a shared responsibility model for how security management is conducted, which requires customers to maintain an always-on awareness of their responsibilities within the cloud. It is ultimately up to you as the cloud customer to ensure a secure and compliant environment for your own operations. Less work perhaps, because you don’t have physical assets to manage, but far from easy.     

  2. The cloud stack is made up of various elements, each one of which has different security and compliance requirements. The storage layer, for example, emphasizes securing data access, having data encryption policies, and other types of rules for things like logging and versioning. With six different layers of the cloud stack, and with dependencies among them, there has to be some level of continuous coordination to ensure these pieces are all secure and compliant.

While I hope I've made the case for recognizing and handling complexity, it's also really important to understand that with the right type of security tools, much of the work of identifying vulnerabilities in the cloud can be handled in a continuous, automated way. This is one of the ways we distinguish between complexity and difficulty. All this complexity can be mitigated, in terms of the amount of work, but to do so requires visibility. With all this interaction going on, and with data being transacted internally, externally, and through APIs and other types of connectors, keeping your cloud environment safe means you have to know where it is and how it's being handled.

Cloud security is, in large part, about awareness. This includes the need to maintain visibility into your cloud environment at all times, the ability to act upon any issues identified to mitigate risks, and the need for increased automation of security efforts to apply emerging best practices as consistent and enforceable behaviors.

It’s impossible to properly secure dynamic cloud environments without truly knowing every interaction within your environment and in all corners of your cloud. In today's cloud platforms, however, things like elastic infrastructures and API-driven cloud service suites have changed the way security needs to be architected, implemented, and managed throughout the workload lifecycle.

The lack of skilled cloud resources has further compounded the problem. Countless IT and cloud security teams grapple with the ambiguity of what to monitor, when to monitor it, how to identify evidence of compliance, overall reporting requirements, and so on. What is clear is the need for automation in dynamic, cloud-centric environments.

Without continuous automation and assessment, organizations lack timely visibility into infrastructure configuration and workload risk and will have a hard time proving any form of compliance in the cloud. But with increased visibility, teams can mitigate the most common vulnerabilities in minutes to drastically reduce the organization’s threat surface. And that means they can focus resources on issues that require more time and attention to fix.