Many agree that multicloud is worth the risk.
The multicloud trend has taken hold in recent years, with RightScale finding
that 84% of enterprises run a multicloud strategy. With multicloud,
organizations deploy applications across two or more cloud platforms, like
AWS, Azure, or Google Cloud.
Increased flexibility is one of the biggest appeals of a multicloud strategy.
Companies avoid vendor lock-in by deploying workloads to different cloud platforms
based on cost and application needs. Hyperscale cloud vendors have data centers
across the globe, so organizations are able to control their cloud expenditures
by scheduling workloads based on location and local time. Multicloud also
protects business operations by reducing down time, and improving resilience in
the event of an outage or workload-disruptive breach (like a DDoS attack).
However, multicloud still has drawbacks that require careful consideration.
The increased complexity of a multicloud environment exponentially increases
an organization’s attack surface and level of risk. Most of these risks can be
mitigated with a thorough assessment and strategy addressing security needs –
and as a study from IDG and IBM has found,
70% of survey respondents agreed that the benefits of multicloud outweigh the risks.
That being said, there’s a lot to consider. In this blog, we’ll run through
some of the top security challenges of multicloud, and dig into the strategies
to conquer them. If you're short on time, feel free to skip down to the best
practices section.
Key security challenges and how to manage them
Access and permissioning
Multicloud adds complexity to your identity and access management efforts.
Employees need access to multiple cloud services as part of their daily work,
and will access your data from a multitude of locations and devices. We
recommend you take a Zero Trust approach here: Allow access on an as-needed
basis, and no more. Data classification levels can help you streamline access
determinations across different clouds, but the key idea is that limited access
will both protect your most mission critical and sensitive information, and
allow you a clear view of when (and by whom) that information is accessed.
Staying up to date
While this is a security concern for any cloud use, upgrades and patching in
multicloud are more challenging because the vulnerabilities and mitigations
from each cloud service provider are different. Multicloud complexity also
makes it difficult to keep track of vulnerabilities as applications communicate
across multiple clouds. Mike Bursell from RedHat
calls this need “workload freshness” – and suggests that this might require you
to upgrade or patch in place, restart the workload with the latest image, or
check and reload recent dependencies, in order to maintain the most recent
versions of any dependent libraries, middleware, or executables.
A disjointed view of security
Most cloud vendors offer native tools to help you manage security within their
cloud platform, and most of those tools can’t be applied to other vendors. This
disjointed approach to monitoring makes it difficult to gain a thorough
understanding of all the vulnerabilities present in your infrastructure.
Instead of making piecemeal security sense, adopt a multicloud management tool
that serves as a single pane of glass into all the happenings across all of your
cloud platforms. Bursell notes that any monitoring tool needs to be fully aware
of the scope of your deployment. It’s also important to have regular, if not
real-time, updates to your data view so that you’re aware of unusual changes or
activities and can address attacks as they come in. A centralized tool is also
valuable for conducting forensic analysis of your systems in the event of a
late-discovered breach.
Control plane complexity
RedHat’s Bursell defines the control plane as any communication which controls
your applications or how they are run. In addition to securing communications
between and within applications, all scheduling, monitoring, and routing
communications should also be encrypted. It’s critical to secure the
administration, logging, and audit functionality of your applications
(lest you want to give hackers the opportunity to take down your entire
infrastructure). David Locke of World Wide Technology writes
that security functionality and enforcement needs to be uniform within all of
your cloud environments, allowing those functions to communicate and coordinate
between themselves and support security automation.
Application hardening
When hardening your infrastructure, Bursell recommends knowing what APIs are
exposed, understanding what controls you have on them, and planning what
mitigations you can apply if they come under attack. Tripwire notes that
any software that your organization develops or acquires from a third party must
be patched and security hardened by your organization.
Best practices
Need a TL;DR? We’ve got you covered:
Key security capabilities and strategies: Multi-factor authentication,
cloud workload security, security analytics, encryption, identity and access
management, cloud security gateways, microsegmentation, threat modeling,
threat intelligence, and endpoint detection and response.
Keep things consistent: Develop a set of security policies and procedures
to enforce on all of your clouds (and any on-prem software too, for that matter).
While there will almost always be some kind of incompatibility, a benchmark or
standardized security policy will reduce the risk of oversights.
Cloud agnostic software: Use security tools that can easily integrate with
any cloud service, and that can scale with increased apps and workloads.
Go beyond your CSP’s tools: Your cloud providers have tools to keep their
offerings safe, but protection of the data itself falls to you. Some vendors
may be able to advise which capabilities you need within their infrastructure
to keep your data safe.
Confidential computing: Data protection usually focuses on data at rest and
in transit, but what about data in use? Protect data as it is being processed,
and always know where the data is being used. Confidential computing will
allow encrypted data to be processed in memory without exposing it to the rest
of the system. This is a relatively new area, so consider keeping tabs on
the Confidential Computing Consortium to
stay in the loop.
Anticipate unforeseen changes: Planning for the unknown seems like an
oxymoron – but in tech, it’s not. Things change constantly, and often in ways
we don’t predict. Make sure your systems and environments can adapt to whatever
the market throws at you.
Stay informed of new computing trends: For instance, Nick Ismail from
Information Age highlights that serverless computing adoption is growing as it allows cloud
instances to be scaled and patched instantly, and machine learning will be able
to help servers identify patterns of malicious behavior and respond faster than
human administrators can respond.
Looking ahead
Just like every market, cloud will continue to change as vendors make new
alliances and focus on new capabilities. In 2020, Forrester predicts
that hyperscale global public cloud leaders will form more alliances, while
cloud management vendors will shift their focus to security – after a
high-visibility data breach. Take steps to ensure that that breach isn’t yours
by assessing the current and future state of your cloud strategy, and infusing
security into everything you do.
Cover image by Michael Weidner on Unsplash.
<%= partial "includes/blog/blog-merch-banner" %>
