Cloud security challenges
The cloud offers plenty of opportunities and possibilities for your organization and your IT department, but it also requires you to give careful thought to cloud migrations, protecting data and managing the cloud workload. The following four challenges need to be factored in:
- Master data management
Organizations are rightly keen on preventing data loss, data corruption or improper use of data. However, keeping data under control is not just a technical problem. See also our page on master data management. - Multi or hybrid cloud
Data can end up in countless different places. The most common IT environments are multi cloud and hybrid cloud. In practice, even maintaining a good overview of all environments is enough of a challenge, let alone keeping security under control. - Ease of use
One of the great advantages of cloud environments is that they are so easy to configure. The downside of this is that things can also easily go wrong, the main consequence being improper use. - Responsible, accountable, consulted and informed (RACI)
There are multiple stakeholders, from IT security to DevOps teams, compliance officers, network professionals and architects. And a hybrid solution definitely doesn’t make things any easier.
Cloud security competencies
Getting a grip on cloud security starts with having a clear picture. We list the competencies with the most impact:
- Governance
The starting point is a RACI (a matrix displaying the roles and responsibilities of those involved in a project or business process). Who is responsible or consulted? The second step is to gain a clear understanding of the landscape and the suppliers. The final step is to create clarity with regard to ownership of cloud security and internal expectations. - Strategy
Maintain an overview. The cloud is dynamic and platforms are being adapted all the time, so perform periodic reviews and identify what you have now and where the market is heading. - People
As in any other field involving security, human behavior is the weakest link – but it’s also the fastest way to success! Make people aware of the issues, ensure good communication and bear in mind that this is not a one-off project. - Process
Consistency and clarity are the keys to growth in cloud security. A sensible, intelligible policy and clear processes are the basis for these qualities. - Automation
Use tooling for central management of the cloud, but also for enforcing and auditing the security guidelines. - Measure, measure, measure
Good measurement and reporting ensure a focus on the right behavior. Take unmanaged login details, for example – one of the commonest causes of data leaks. Keep an eye on them and measure the state of affairs on an ongoing basis. An understanding of risk levels generates support and minimizes security issues.
Maturity in cloud security
Where should you start? It depends on the organization. How complex is your cloud environment? What is the current risk? Be realistic. The organization’s maturity largely determines what you should do next and how fast you can act.
At a basic level, it’s a good idea to start with understanding the business impact, the overall cloudscape and transparency in the various stakeholders’ roles. Don’t assume that everything is directly under control. Central ownership is the first priority.
If you’re already a bit further along, it makes sense to get started with processes and automation. This will not only improve security, but also ensure cost control.
The experts can help by making sure that the entire landscape is not only clearly organized but kept under control with a continuous and highly automated process and formalized commitment from the business.
Recommendations
Maintain a proportionate approach. Every organization is different, and it isn’t realistic to expect to get and keep everything under control in a short time. Start with understanding, priorities and ownership. Set maturity targets and budgets and define feasible next steps. Finally, ensure transparency. Start measuring and reporting. Only then will there be support for mature cloud security, allowing the cloud to really develop fully and the organization to become more agile.
