A cloud environment is not a replica of an on-premise network or a data centre. Unlike traditional data centres, which have a rigid IT architecture blueprint, the cloud comes with flexibility that allows users to architect their infrastructure and resources. With the cloud’s dynamic space, users can change their infrastructure or decide to go with a different architecture. Also, the way the data transfers and systems communicate differs largely between the cloud and on-premises networks.
In the cloud, applications interact with each other using application programming interfaces (APIs). Cloud vendors provide various APIs, such as Platform as a Service APIs, Software as a Service APIs, and Infrastructure as a Service APIs, for users to connect to their service, transfer data, and manage access to their data and systems hosted in the cloud.
Such stark differences in how the IT architecture is being designed and communicated differentiates cloud and network security.
How a network security model would not fit your cloud: Intrusions are one of the most common threats to on-premise networks. Adversaries try to exploit open ports, vulnerabilities in internet-facing endpoints, and break into the network. Later they move laterally within the network to gain hold of high-profile accounts or critical resources to carry out attacks. They also employ slow exfiltration tactics and techniques to sneak sensitive data out of the network without being detected. Such risks – network penetration and slow exfiltration of data – are irrelevant to cloud security. With the cloud, all adversaries must do is take control of the APIs to hijack the resources and steer the sensitive data to their command-and-control server.
According to the 2021 IBM Security X-Force Cloud Threat Landscape Report, two-thirds of cloud incidents can be attributed to misconfigured APIs that allow unauthorised access. As businesses rush to the cloud, many will likely fall for misconfiguration-caused-breaches in 2022. Technological research firms, such as Gartner, also expect that through 2023, at least 99% of cloud security failures will be through cloud resource misconfigurations.
Every cloud vendor has their own resource types, configuration attributes, APIs, and interfaces. If an organisation adopts a multi-cloud environment, the complexity of governing the many APIs and interfaces is huge. Setting up the cloud policies, controls, and configuration attributes isn’t a one-time effort. Post-deployment configuration changes, termed as drift, can also lead to huge cloud data leaks if not monitored constantly.
Here are two pointers to avoid cloud security threats:
While the visibility, shadow IT, and cloud traffic monitoring concerns can be addressed using a robust cloud access security broker (CASB) solution, detecting and fixing misconfigurations across the infrastructure, platform, and software hosted on cloud can be done using cloud security posture management (CSPM) tools. A security information and event management (SIEM) tool, with its behavioral analytics and extended detection and response (XDR) component, can complement the working of CASB and CSPM solutions in ensuring cloud security.
Organisations are adopting different tools to address cloud security concerns, such as keeping shadow IT under check, stopping malicious API traffic, ensuring that the right security policies and controls are employed, and detecting and fixing misconfigurations. When these tools are disjointed and don’t communicate with each other, it adds more complexity to ensuring cloud security. A unified console, that seamlessly orchestrates different security events and tools, displays applicable metrics that help resolve these issues and is both efficient and cost-effective.
The cybersecurity market has already learned the importance of security tool convergence. User and entity behaviour analytics, which was a standalone component for quite some time, converged predominantly with SIEM. All other security tools, such as threat intelligence platforms, security orchestration, automation, and response (SOAR), and XDR are getting consolidated within the bigger platform, SIEM. Such consolidations help businesses formulate stronger security strategies and defense systems to keep attackers at bay.
SIEM tools act as a platform where all security data are consolidated and analysed. Contextual security inputs such as threat feeds, malware data points, and vulnerability scanners’ inferences are fed to the system for effective analysis. With the artificial intelligence or machine-learning-based behavioural analytical component, security events are better analysed and the red flags are spotted accurately. With an effective SOAR or XDR component that comes with the SIEM tool, incident resolution becomes easier and the security operations centre can always keep track of their key metrics. The cybersecurity market has learned from the past and with the increase in cloud adoptions, tools such as CSPM and CASBs are also taking their place in bigger platforms such as SIEM.
Subscribe to our Editor's weekly newsletter
Share
