multi-cloud - PATECCO GmbH

Five Еffective Approaches for Security in Multi-Cloud Environments

Multi-cloud can bring great benefits to a company. For example, more and more companies are utilising the high degree of flexibility to develop and host applications natively in the cloud. These applications consist of so-called micro-services – services that only take on individual or a few tasks, exist independently of each other and are loosely coupled. This modular software architecture enables companies to implement changes to cloud-native applications quickly and easily. To get the best out of their multi-cloud environment without playing into the hands of criminals, organisations need a security approach that enables a consistently high level of security and seamless compliance management across all clouds. What is Multi-Cloud security? To understand multi-cloud security, you need to know the difference between multi-cloud and hybrid cloud services. The term „multi-cloud“ is used when cloud services from multiple cloud service providers are used. With this concept, your company can oversee separate projects in the different cloud environments of multiple cloud service providers. Like „multi-cloud“, „hybrid cloud“ also includes several cloud environments. However, in a hybrid cloud environment, work is distributed across a common workload system consisting of public cloud, local resources and a private cloud. A common advantage of hybrid cloud and multi-cloud is their adaptability and cost efficiency. Both support the highly flexible management of resources and data migrations that take place between local resources and the cloud. In addition, companies benefit from more control and security when operating a private cloud in a hybrid cloud environment. More and more industries are switching to multi-cloud and hybrid cloud infrastructures, exposing them to the typical risks of an unprotected cloud environment. These include an increased risk of data loss, unauthorised access, lack of transparency in multi-cloud environments and increased non-compliance with regulations. A single cyberattack can have negative consequences for the company and lead to a lack of customer confidence and loss of revenue and reputation. In this article PATECCO will share five useful tips that will sharpen your focus on the security aspects of multi-cloud environments. 1. Build up expertise for multi-cloud As a first step, companies need to build up the necessary expertise for multi-cloud environments. This involves topics such as containers, container orchestration, runtime environments or cloud-native development and provision. In many cases, this requires investment in employee training and development. 2. Establish visibility of your cloud workload It’s almost a mantra, but nevertheless the basis of any security strategy: I can only protect assets that I know. In the context of cloud and multi-cloud environments, this applies in particular to applications and the corresponding information stores. The first step is therefore always to determine what type of information and applications are used in the cloud and by whom. In many complex organisations, however, this is one of the first hurdles because the use of different cloud services has often developed historically. 3. Focus on centralised services and tools for scanning and monitoring In particular, tools, that can not only be used in different cloud environments, but can also transmit their results to a central console, are ideal for keeping the dashboards and processes required for monitoring up to date. As a rule, this allows all cloud systems used by a company to be monitored. In recent years, a new category of cloud monitoring tools has been developed, which is summarised under the term Cloud Workload Protection Platforms (CWPPs). A CWPP protects the workloads housed in the cloud from attacks by using techniques from the areas of network segmentation, system integrity protection and application control, behaviour monitoring, host-based intrusion prevention and, optionally, anti-malware solutions. In many cases, manufacturers also offer functions for zero trust, micro-segmentation and endpoint detection and response in this area. By focusing on logging and centralised services and tools for scanning and monitoring a multi-cloud environment, security teams can develop a coherent and sustainable strategy for their protection. This means that any problems and security incidents that arise can be recognised and rectified more quickly. In addition, integration into an overarching IT security strategy will sooner or later also make it easier to manage cloud solutions. 4. Recognise vulnerabilities It is a common misconception that moving to the cloud also means getting rid of vulnerabilities, or that these are now primarily a problem for the cloud provider. This is only partially true. Although reputable CSPs (cloud service providers) usually protect the vulnerabilities in their own infrastructure very reliably, the number of data breaches at third-party providers, such as cloud service providers, is rising sharply. The reason for the increased number of attacks on cloud service providers is generally not their lax security precautions (although this does happen). Rather, the cause is often due to incorrect or careless security settings by cloud users. One example of how this can occur is the temporary use of services, as often happens for marketing campaigns in which customer data, among other things, is used. If the services are not carefully cleaned up after use, such orphaned databases can quickly become a ticking time bomb that can cost a company dearly later on. 5. Trust is good, control is better All preventive measures, such as access restrictions, authentication procedures and data flow controls, however sophisticated they may be, can be circumvented or cancelled out sooner or later given enough time and the right methods. Security monitoring, which continuously observes the security-relevant processes and alerts the IT security managers in the event of deviations, helps to prevent this. This is easy to do within your own four walls because all the necessary information such as network, system and application logs is directly accessible. However, this traditional approach fails when this information is stored in the environment of one or more cloud providers. It is therefore important to ensure that the CSP has the appropriate functions for security monitoring when selecting the appropriate CSP. How PATECCO can support the planning and implementation of your cloud strategy? PATECCO’s cloud security services help our customers plan their native or hybrid cloud strategy. The

Five Recommendations From PATECCO For Security in Multi-Cloud Environments

Uncategorized / Von Ina Nikolova

Traditional security concepts are not enough for multi-cloud environments. What is needed is an approach that enables a consistently high level of security and seamless compliance management across all clouds. These five recommendations will sharpen your focus on the security aspects of multi-cloud environments. The digitalization of companies is progressing and with it the shift away from traditional infrastructure to the cloud. Hardly any company today completely dispenses with the advantages of the cloud. However, this change often does not take place in one step, but rather an ecosystem of applications and cloud storage from various cloud providers is gradually emerging. This is why most companies also have multi-cloud environments. There is nothing wrong with this in principle. However, it should not be forgotten that a company is also responsible for the security of its data and the fulfillment of its regulatory requirements in the cloud. Though, the implementation of these security requirements sometimes differs considerably from the security concepts that we have previously applied in traditional data centers. The following five tips should help to raise awareness of the security aspects in multi-cloud environments. Establish visibility of your cloud workload It’s almost a mantra, but nevertheless the basis of any security strategy: I can only protect assets that I know. In the context of cloud and multi-cloud environments, this applies in particular to applications and the corresponding information stores. The first step is therefore always to determine what type of information and applications are used in the cloud and by whom. In many complex organizations, however, this is one of the first hurdles because the use of different cloud services has often developed historically. Identity is the new perimeter We are used to thinking in a traditional perimeter security environment. What is outside our perimeter is bad. What’s inside is good. As soon as cloud services come into play, this concept no longer works. Our data no longer lies within a clearly defined perimeter but is theoretically accessible from anywhere. In native, hybrid and multi-cloud environments, identity is therefore the new perimeter that needs to be protected. On one hand, this can be ensured through the use of zero-trust architectures. On the other hand, this can be achieved through the technical implementation of secure authentication methods, such as multi-factor authentication (MFA). Applicability and user-friendliness are important when designing these methods. PATECCO also offers corresponding solutions for various scenarios with its Identity & Access Management Services. Recognize vulnerabilities It is a common misconception that moving to the cloud also gets rid of vulnerabilities, or that these are now primarily a problem for the cloud provider. This is only partially true. Although reputable cloud service providers usually protect the vulnerabilities in their own infrastructure very reliably, the number of data breaches at third-party providers, such as cloud service providers, is rising sharply. The reason for the increased number of attacks on cloud service providers is generally not their lax security precautions. Rather, the cause is often due to incorrect or careless security settings by cloud users. One example of how this can occur is the temporary use of services, as often happens for marketing campaigns in which customer data, among other things, is used. If the services are not carefully cleaned up after use, such orphaned databases can quickly become a ticking time bomb that can cost a company dearly later on. Encryption creates trust If I store sensitive data on a data carrier, then I will choose a data carrier that is able to encrypt my information securely. The same principle also applies to cloud storage. This does not necessarily have something in common with mistrust of a cloud provider. But, we have to assume that a cloud provider is fundamentally exposed to the same risks as any other organization. There are people who make mistakes, sometimes even people who deliberately want to harm an organization. It is therefore sensible to prevent these risks in principle by encrypting your workload in the cloud. Trust is good, control is better All preventive measures, such as access restrictions, authentication procedures and data flow controls, however sophisticated they may be, can sooner or later be circumvented or undermined given enough time and the right methods. Security monitoring, which continuously observes the security-relevant processes and alerts the IT security managers in the event of deviations, helps to prevent this. This is easy to do within your own four walls because all the necessary information such as network, system and application logs is directly accessible. However, this traditional approach fails when this information is stored in the environment of one or more cloud providers. It is therefore important to ensure that the CSP provides the appropriate functions for security monitoring when selecting a provider. How can PATECCO support the planning and implementation of your cloud strategy? PATECCO’s cloud security services support our customers to plan their native or hybrid cloud strategy. The Cloud security risk assessment identifies the relevant technical and regulatory risks based on your business/IT strategy and takes them into account in the planning. Our Cloud Access Control and Identity and Access Management solutions help with implementation and operation, regardless of whether your company is pursuing a public or private cloud strategy.