Sophos. 7 best practices for securing the public cloud

Given the simplicity and cost-effectiveness of the public cloud, it’s no surprise that more and more organizations are turning to Amazon Web Services (AWS), Microsoft Azure, and Google Cloud Platform (GCP).

You can spin up a new instance in minutes, scale resources up and down whenever you need while only paying for what you use, and avoid high upfront hardware costs.

While the public cloud solves many traditional IT resourcing challenges, it does introduce new headaches. The rapid growth of cloud usage has resulted in a fractured distribution of data, with workloads spread across disparate instances and, for some organizations, platforms.

As a result, keeping track of the data, workloads, and architecture changes in those environments to keep everything secure is often a highly challenging task,

Public cloud providers are responsible for the security of the cloud (the physical datacenters, and the separation of customer environments and data). However, if you put data and workloads in the public cloud you are also responsible for securing them.

Misunderstandings around this distribution of ownership is widespread and the resulting security gaps have made cloud-based workloads the new pot of gold for today’s savvy hackers. (For more details read Matt Boddy’s recent research: Cyberattacks on Cloud Honeypots).

Seven steps to securing the public cloud

The secret to effective public cloud security is improving your overall security posture. You need to ensure your architecture is secure and configured correctly, and that you have visibility into both your architecture and who is accessing it.

There are many elements to public cloud security and it can be difficult to know where to start. If you’re using the public cloud – or thinking about migrating – we recommend these seven steps to help maximize your security.

Step 1: Learn your responsibilities

This may sound obvious, but security is handled a little differently in the cloud. Public cloud providers such as Amazon Web Services, Microsoft Azure, and Google Cloud Platform run a shared responsibility model – meaning they ensure the security of the cloud, while you are responsible for anything you place there.

Step 2: Plan for multi-cloud

Multi-cloud is no longer a nice-to-have strategy. Rather, it’s become a must have strategy. There are many reasons why you may want to use multiple clouds, such as availability, improved agility, or functionality. When planning your security strategy, start with the assumption that you’ll run multi-cloud – if not now, at some point in the future. In this way you can future-proof your approach.

Step 3: See everything

If you can’t see it, you can’t secure it. That’s why one of the biggest requirements to getting your security posture right is getting accurate visibility of all your cloud-based infrastructure, configuration settings, API calls and user access.

Step 4: Integrate compliance into daily processes

The dynamic nature of the public cloud means that continuous monitoring is the only way to ensure compliance with many regulations. The best way to achieve this is to integrate compliance into daily activities, with real-time snapshots of your network topology and real-time alerts to any changes.

Step 5: Automate your security controls

Cybercriminals increasingly take advantage of automation in their attacks. Stay ahead of the hackers by automating your defenses, including remediation of vulnerabilities and anomaly reporting.

Step 6: Secure ALL your environments

You need a solution that can secure your all environments (production, development, and QA) both reactively and proactively.

Step 7: Apply your on-premise security learnings

On-premise security is the result of decades of experience and research. Use firewalls and server protection to secure your cloud assets against infection and data loss, and keep your endpoint and email security up to date on your devices to prevent unauthorized access to cloud accounts.

Moving from traditional to cloud-based workloads offers huge opportunities for organizations of all sizes. Yet securing the public cloud is imperative if you are to protect your infrastructure and organization from cyberattacks.

To learn more, download our new guide: Securing the Public Cloud: Seven Best Practices