Security in Cloud : why is it important?

With the entry of Cloud with a promise of reducing infrastructure cost, enhancing security by leveraging shared infrastructure, etc, organizations are slowly moving to Cloud to get the advantages of it. With multi-fold advantages, one big concern stays as-is - “Security”. Security in on-prem world is of multiple layers - Network Security, Infrastructure Security, and Application Security. However, in Cloud the security is of multiple layers but with multiple dynamic moving parts. Also, because of the nature of Cloud the regulatory bodies are strict on ensuring regulatory compliances and bringing in additional regulatory requirements. 

There are multiple challenges in the cloud - 

1. Slowly the penetration and the attack surface is changing, particularly in cloud environment. The various workloads have different needs - some are public facing in a public subnet and remaining are in private subnet with a strict firewall for inter subnet communication. 
2. Earlier, the penetration point was only on the perimeter network. Organizations used to secure the perimeter only and claim the security. Now the hackers if get into the network, then they can spread from workload to workload or within the workload it can move east-west. 
3. When such workload changes its position, the attack surface also changes and the threat also moves along with the workload. 
4. So, it has become extremely important that security is built as part of application. 
5. A business application changes its position and so, the security model so that application owners won’t have to worry about security. 
6. So, organizations also looking for programmable security as an integral part of applications as hiring and building security experts is one of the major challenges 
7. Security should be programmable so that application developers, DevOps and Ops can understand the security requirements and from time to time can change the configurations required and continuously monitor to ensure the application is secure 

With Cloud, the security needs become multi-fold because of following reasons - 

1. Deployment of Business Applications are not static and they change their positions in the network or expand with business demand. For e.g. the workload for an e-retail store will need to add more web servers during the peak demand and considering the demand and region, the web servers may need to be added to a separate subnet. 
2. As the application changes its configuration, the threat landscape associated with it changes along with the change in the application’s position in the network. 
3. New threat vectors emerge as the application position changes or the kind of softwares associated with the application changes.
• For e.g. the application moves from a private subnet to a public subnet and hence, the threat landscape changes
• The application adds application server layer as a new application layer or changes messaging layer from RabbitMQ to Kafka and the threats associated with it change. 
4. Because of the nature of cloud, new threat vectors always keep on emerging. 

Public cloud vendors like AWS, Azure, Google Cloud’s protection is mainly for underlying infrastructure, but not necessarily for the business applications running on it, the access granted to those applications, the data managed by those applications, and the connections from those systems other systems in the same public cloud or similar or to their private cloud running in their premise. Attackers do not care where their target is located - whether public cloud infrastructure, private cloud or in a closed private network . Their only objective is to gain access to the network; navigate to a target, be it data, servers or network; and then execute their end goal. So, from attacker's perspective there is no difference between public cloud or private cloud/on-prem managed systems. From customer's perspective, the public cloud deployment is nothing but an extension of your data center, and the steps to protect it should be no different than those you take to protect your own private data center/cloud or own managed private network of computer systems. The speed of the public cloud deployment and managed by the cloud provider is sometimes leading to security shortcuts where little to no security is being used. Generally, it is believed that the use of native security solutions or point security solutions are sufficient to address the security needs in public cloud as these cloud providers have certified their infrastructure from security point of view. The reality is that these point security products only act on specific issues, more in a reactive mode than preventive mode. Considering the dynamism and agility associated with cloud, public cloud should not be treated with the same security needs as on-prem data center. I hope, as public cloud deployments increase in volume and scope, more diligence is needed to the security model around business applications running on public cloud. It should include complete visibility and control at the individual instance level, business application level and the prevention of known and unknown threats & vulnerabilities, with an objective to alert customers/users about security issues in a more reactive manner. As you go through my next set of articles on usage of Machine Learning/Deep Learning, BigData Analytics and Security Intelligence, you will realize that such frameworks will need to be leveraged by Information Security or Cloud Security teams for implementing predictive security postures across public, private and SaaS cloud infrastructures. 

So, Security for Cloud should be 

1. Dynamic 
2. Built along with the application 
3. Programmable Security 
4. Easy to understand for Developers, DevOps and Ops 
5. Completely automated 

Components of Cloud Security - 

1. Automated recommendations for various applications 
2. Automated configured or built 
3. Configurable or programmable security 
4. Automated security configurations based on network model 
5. Security Analytics 
6. Anomaly detection 
7. Security events for developers, DevOps and Ops