Hybrid Cloud Security Lags Behind Implementation

For many organizations, particularly those in highly regulated industries such as healthcare, hybrid cloud environments offer the best of both worlds. Companies get to enjoy the easy scalability and other benefits of AWS, Microsoft Azure, or Google Cloud while isolating their critical workloads and sensitive data in a private cloud that they have complete control over. At least, that’s the theory. As it turns out, not all clouds have a silver lining. Firemon’s State of Hybrid Cloud Security Survey, which polled over 400 security practitioners, revealed a severe disconnect between hybrid cloud adoption and hybrid cloud security. Among the findings: * Most organizations are running multiple disparate cloud systems, which greatly increases complexity. Half of organizations deploy at least two different cloud environments (multicloud), and 40% have hybrid cloud deployments. Further, 39% use Infrastructure-as-a-Service (IaaS), Platform-as-a-Service (PaaS), and Software-as-a-Service (SaaS) models concurrently. * Despite this complexity, many organizations expect non-security personnel to handle public and hybrid cloud security. 56% of respondents reported that cloud security was handled by network security, security operations, or security compliance teams. The rest of the time, the responsibility is placed on IT/cloud teams, application owners, or other teams outside the security organization. * Security personnel lack the resources to keep up. 60% of respondents indicated that their organizations’ cloud initiatives were outpacing their ability to secure them. This isn’t surprising, given that 57.5% indicated that less than 1/4 of their security budget was dedicated to cloud security, and 52% reported that their security teams consisted of 10 or fewer members. Only 28% have network security tools that work across multiple environments to secure their hybrid clouds. * In many cases, DevOps and security teams are siloed, further impeding cloud security. 7% of respondents reported being part of their organizations’ DevOps team as part of the DevSecOps trend, but 30% indicated their relationship with DevOps was either complicated, contentious, not worth mentioning, or non-existent. Hybrid cloud security issues are challenging, but not insurmountable Like public clouds, hybrid cloud environments are not inherently less secure than on-prem infrastructures, but hybrid clouds are complex, requiring expertise with APIs and network configurations that many traditional system administrators are unfamiliar with. While the technical specifics of securing a hybrid cloud environment will vary, certain best practices apply in all environments. Eliminate organizational silos and give security a seat at the table. Cyber security should be the primary conce when deploying a hybrid cloud environment, not an afterthought. Security teams must be involved every step of the way. Don’t forget compliance conce s. Compliance is tricky in a hybrid cloud environment. You must understand the differences in compliance responsibility in each environment; be able to demonstrate that both your private cloud and your public cloud meet applicable compliance mandates; ensure that any data moving between the two clouds is protected in transit; and establish safeguards that prevent sensitive data from being moved from compliant storage on a private cloud into non-compliant storage on a public cloud. Most AWS breaches are due to sensitive data being uploaded onto improperly configured AWS buckets. Establish consistent risk management processes throughout the hybrid cloud environment. While some processes will have to be different, keep things as consistent as possible to reduce complexity. For example, the principle of least privilege applies in both environments; ensure that your employees do not have more privileges in one environment than they do in the other. Seek help from cyber security professionals with expertise in hybrid cloud security. Both the cloud computing and cyber security domains are suffering from a significant skills shortage that is projected to persist into the foreseeable future. Pawning off the responsibility to staffers who lack security expertise only sets your company up for a cyberattack. Organizations that do not have sufficient staff in-house to ensure hybrid cloud security need to seek outside help.