As many organizations move resources to cloud-based environments, their unique characteristics can present new and undocumented risks. Cloud end-points generally suffer from the same problems as on-premise hosts, with a few additional twists. Organizations not aware of this often leave management controls unmonitored, resulting in weak or uncontrolled password policies, security settings and vulnerabilities. From a risk perspective, such conditions would never be satisfactory for servers in a data center.
Resources in the cloud are typically implemented to mimic on-premise solutions while providing more flexibility than physical or virtual systems. The primary difference between on-premise and cloud solutions can be determined by the presence of hardware. When an operating system or application is deployed locally, it uses physical resources to operate. Such resources include rack space, electrical power, cooling and backups to existing network infrastructure. When using the cloud, all of the physical components are removed, and all that is maintained is typically the system (often referred to as an instance) and its network communications policy.
When maintaining on-premise solutions, great care is usually given to the physical access of the data center or outsourced raised floor (hosting locations for servers). With the cloud, this is not applicable, but limiting rogue connectivity to the host remains a challenge. This is where cloud security risks begin to materialize. You have no control of the system except its runtime parameters. The system needs to be locked down, hardened and monitored for all risky activity because the mature on-premise technology you rely on, such as vulnerability management, IDS/IPS, firewalls and privileged account management, may not be available in the cloud unless you place comparable controls there as well.
Merely assuming your on-premise technology will work on the cloud means that your instances will run without the latest patches, secure password policies and other security tools like antivirus to keep them secure. Your cloud environment is an extension of your business, data center and resources. Thus, it may contain sensitive information that needs to be protected.
So how do you address the new risks in your cloud environment? An auditor would agree it should be secured and managed the same way as an on-premise solution. Treat cloud resources as your own, and extend the security policies you have now to cover them. This may include licensing new tools that are comparable to on-premise technologies, but operate securely in the cloud.
The following five security processes are recommended to every organization to protect their cloud assets. These are everyday processes and not just one-offs used in incident response:
- Make sure all the latest operating system and application security patches are installed. Ensuring there are no outstanding vulnerabilities will help minimize risk by negating the effect of any publicly known exploit.
- System hardening closes application or operating system entry points left on by default for convenience. Assessing and hardening a system to turn off unwanted communications, accounts and services minimizes risk by reducing the attack risk surface in a default configuration.
- Controlling, restricting and recording all access to the system is key. When a solution is on-premise, it is easy to set up trusted communication paths through a management network or access control lists. In the cloud, all authorized interaction should be controlled with a cloud access service broker, virtual private network and privileged account management software. If access is not controlled, the system could be entered directly through the web.
- Basic security tools found on every server and desktop in your environment should also be installed and managed for every instance operating in the cloud. This includes antivirus tools, log management and least privileged agents. This typically increases licensing costs and may even increase bandwidth to the cloud. Without these controls, however, the risk is significantly increased due to a lack of proper security visibility.
- Centralized authentication is also important. When instances are spun up in the cloud, they typically act as standalone servers. These would never be acceptable in a data center without joining an active directory domain or connecting to an authentication service. In order to minimize the risk of rogue accounts and insecure passwords, ensure all systems are using centrally managed authentication services that have been extended to the cloud, such as Windows Azure Active Directory. This maintains the company’s control of applications and users.