How do you secure the cloud? New data points a way

New reports show big differences in risk among public, private, and hybrid cloud deployments. Here’s advice on the tools, information, and organizational structure needed to execute a successful cloud security strategy.

The march toward the cloud for data and services has many companies rethinking their approach to cyber security. Do they need a cloud security strategy? What is different about a cloud security strategy? Recent surveys have shed light on how security strategies are changing, and more important, how they should change.

Placing more IT infrastructure in the cloud is in some ways more secure than having it in house. For instance, you can be reasonably sure that the system is running the latest version with the proper patches in place. Cloud service providers are also building in new capabilities such as using machine language for anomaly detection. However, it also presents new risks, some of which is the result of misunderstanding how to manage cloud security.

It is important to know how a company’s cloud IT strategy—whether it’s hybrid, private hosted, or public—affects its cyber security strategy and the tactical execution of that strategy.

What is the cloud security risk?

Data from cloud security provider Alert Logic shows the nature and volume of risk for each form of cloud environment as compared to an on-premises data center. For 18 months, the company analyzed 147 petabytes of data from more than 3,800 customers to quantify and categorize security incidents. During that time, it identified more than 2.2 million true positive security incidents. Key findings include:

• Hybrid cloud environments experienced the highest average number of incidents per customer at 977, followed by hosted private cloud (684), on-premises data center (612), and public cloud (405).
• By far, the most common type of incident was a web application attack (75 percent), followed by brute force attack (16 percent), recon (5 percent), and server-side ransomware (2 percent).
• The most common vectors for web application attacks were SQL (47.74 percent), Joomla (26.11 percent), Apache Struts (10.11 percent), and Magento (6.98 percent).
• Wordpress was the most common brute force target at 41 percent, followed by MS SQL at 19 percent.

Whether it’s a public, private or hybrid cloud environment, web application threats are dominant. What’s different among them is the level of risk you face. “As defenders, at Alert Logic our ability to effectively protect public cloud is higher as well, because we see a better signal-to-noise ratio and chase fewer noisy attacks,” says Misha Govshteyn, co-founder of Alert Logic. “When we see security incidents in public cloud environments, we know we have to pay attention, because they are generally quieter.” 

The data shows that some platforms are more vulnerable than others. “This increases your attack surface despite your best efforts,” says Govshteyn. As an example he notes that “despite popular belief,” the LAMP stack has been much more vulnerable than the Microsoft-based application stack. He also sees PHP applications as a hotspot.

“Content management systems, especially Wordpress, Joomla and Django, are used as platforms for web applications far more than most people realize and have numerous vulnerabilities,” says Govshteyn. “It’s possible to keep these systems secure, but only if you understand what web frameworks and platforms your development teams tend to use. Most security people barely pay attention to these details, and make decisions based on bad assumptions.”

To minimize the impact from cloud threats, Alert Logic has three primary recommendations:

• Rely on application whitelisting and block access to unknown programs. This includes doing risk vs. value assessments for each app used in the organization.
• Understand your own patching process and prioritize deployment of patches.
• Restrict administrative and access privileges based on current user duties. This will require keeping privileges for both applications and operating systems up to date.

How to secure the cloud

According to a survey by market researcher VansonBourne and sponsored by network monitoring solutions provider Gigamon, 73 percent of respondents expect the majority of their application workloads to be in the public or private cloud. Yet, 35 percent of those respondents expect to handle network security in “exactly the same manner” as they do for their on-premises operations. The remainder, while reluctant to change, believe they have no choice but to change their security strategy for the cloud.

Granted, not every company is migrating sensitive or critical data to the cloud, so for them there is less reason to change strategy. However, most companies are migrating critical and proprietary company information (56 percent) or marketing assets (53 percent). Forty-seven percent expect to have personally identifiable information in the cloud, which has implications due to new privacy regulations such as the EU’s GDPR.

Companies should focus on three main areas for their cloud security strategy, according to Govshteyn:

1. Tools. The security tools you deploy in cloud environments must be native to the cloud and able to protect web applications and cloud workloads. “Security technologies formulated for endpoint protection are focused on a set of attack vectors not commonly seen in the cloud, and are ill equipped to deal with OWASP Top 10 threats, which constitute 75 percent of all cloud attacks,” says Govshteyn. He notes that endpoint threats target web browsers and client software, while infrastructure threats target servers and application frameworks.
2. Architecture. Define your architecture around the security and management benefits offered by the cloud, not the same architecture you use in your traditional data centers. “We now have data showing that pure public environments allow enterprises to experience lower incident rates, but this is only achievable if you use cloud capabilities to design more secure infrastructure,” says Govshteyn. He recommends that you isolate each application or micro-service in its own virtual private cloud, which reduces the blast radius of any intrusion. “Major breaches such as Yahoo began with trivial web applications as the initial entry vector, so the least important applications often become your biggest problem.” Also, don’t patch vulnerabilities in your cloud deployments. Instead, deploy new cloud infrastructure running the most recent code and decommission your old infrastructure. “You can only do this if you automate your deployments, but you will gain the level of control over your infrastructure you could never achieve in traditional data centers,” says Govshteyn.
3. Connection points. Identify points where your cloud deployments are interconnected to traditional data centers running legacy code. “Those are likely to be your biggest source of problems, as we see a clear trend that hybrid cloud deployments tend to see most security incidents,” he says.

Not everything about a company’s existing security strategy has to change for the cloud. “Using the same security strategy--for example, deep content inspection for forensics and threat detection--for cloud as on-premises is not a bad idea by itself. Companies pursuing this are typically looking for consistency between their security architectures to limit gaps in their security posture,” says Tom Clavel, senior manager of product marketing at Gigamon.

“The challenge is how they get access to the network traffic for this kind of inspection,” Clavel adds. “While this data is readily available on-premise using a variety of ways, it is unavailable in the cloud. Plus, even if they get access to the traffic, backhauling the firehose of information to the on-premise tools for inspection, without the intelligence is extremely expensive and counter-productive.”

The cloud’s visibility issues

One complaint that the VansonBourne respondents had was that the cloud can create blindspots within the security landscape. Overall, half said the cloud can “hide” information that enables them to identify threats. They also said that with the cloud, they are also missing information on what is being encrypted (48 percent), insecure applications or traffic (47 percent), or SSL/TLS certificate validity (35 percent).

A hybrid cloud environment can hamper visibility even more, as it can prevent security teams from seeing where the data is actually stored, according to 49 percent of the survey respondents. Siloed data, some held by security operations and some by network operations, can make finding data even worse, 78 percent of the respondents claimed.

It’s not just data that security teams have limited visibility into. Sixty-seven percent of the VansonBourne respondents said that network blindspots were a hindrance to them protecting their organization. To gain better visibility, Clavel recommends that you first identify how you want to organize and implement your security posture. “Is it all within the cloud or extended from on-premises to the cloud? In both cases, make sure pervasive visibility to your application’s network traffic is central to your security strategy. The more you see, the more you can secure,” he says.

“To address the visibility needs, identify a way to acquire, aggregate and optimize the network traffic to your security tools, whether they are an intrusion detection system (IDS), security information and event management (SIEM), forensics, data loss prevention (DLP), advanced threat detection (ATD), or to all of them concurrently,” Clavel adds. “Finally, add SecOps procedures to automate visibility and security against detected threats even as your cloud footprint grows.”

These blindspots and low information visibility could create GDPR compliance issues. Sixty-six percent of respondents say lack of visibility will make GDPR compliance difficult. Only 59 percent believe their organizations will be ready for GDPR by the May 2018 deadline.

Security policies and practices not keeping pace with cloud adoption

According to the Oracle and KPMG Cloud Threat Report 2018, 87 percent of companies now have a cloud-first strategy, and 90 percent of companies say half the data they have in the cloud is sensitive. While those companies have taken an aggressive approach to adopt the cloud, security practices and policies don’t seem to have caught up, as data from that same report shows.

Oracle/KPMG

The data in the Oracle/KPMG report is from a survey of 450 cybersecurity and it professionals from around the world. Respondents were clearly worried about cloud security, most have not taken some obvious measures to mitigate the risk of having sensitive data in the cloud.

• Eight-two percent think their employees do not follow cloud security procedures, yet 86 percent are unable to collect and analyze the majority of their security event data:
• Only 38 percent of the respondents said that detecting and responding to cloud security incidents is their number one cybersecurity challenge.  
• Only 41 percent have a dedicated cloud security architect.

There are some signs that companies will take cloud security more seriously in the near future. Most respondents (84 percent) expect to increase their level of security automation, and 89 percent expect to increase their cybersecurity budgets in the coming year.

Will machine learning help?

Cloud service providers are working to improve customers' ability to identify and address potential threats. Amazon Web Services (AWS), for example, announced two services in 2017 that rely on machine learning to protect customer assets. 

In August, AWS announced its Macie service, focused mainly on PCI, HIPAA, and GDPR compliance. It trains on the users' content in Amazon S3 buckets and alerts customers when it detects suspicious activity. AWS GuardDuty, announced in November, uses machine learning to analyze AWS CloudTrail, VPC Flow Logs, and AWS DNS logs. Like Macie, GuardDuty focuses on anomaly detection to alert customers to suspicious activity.

The effectiveness of machine learning depends on models, which consist of an algorithm and training data. The model is only as good as the data it's trained on; any event that falls outside the data in the model will likely not be detected by a service like Macie or GuardDuty. 

That said, a cloud security provider like AWS will have a much richer data set to work with than any individual customer would. AWS has visibility across its entire network, making it much easier to train its machine learning model on what is normal and what might be malicious. However, customers need to understand that machine learning will not detect threats that fall outside the training data in the machine learning model. They cannot rely on service like Macie and GuardDuty alone. 

Who owns cloud security?

Given what’s at stake, it’s no surprise that 62 percent of respondents expressed a desire for their security operations centers (SOCs) to control network traffic and data to ensure adequate protection in a cloud environment. Half of them would settle for awareness of network traffic and data.

Gaining control or even full visibility might be a challenge for many organizations due to the structure of the groups that manage the cloud environment. While security operations are responsible for cloud security at 69 percent of the respondents’ organizations, cloud operations (54 percent) or network operations are also involved. This has resulted in confusion over who is taking the lead for cloud security and how teams should collaborate. In fact, 48 percent of respondents said that lack of collaboration among teams is the biggest roadblock to identifying and reporting a breach.

“Often, companies split responsibilities among the network, security and cloud,” says Clavel. “Each have distinct budgets, distinct ownership, and even distinct tools to manage these areas. Gaining visibility into the cloud to secure it requires breaking down the communication walls among these three organizations. The same security tools that are deployed on-premise will be able to also secure the cloud – so cloud and security teams need to communicate.” 

What type of person should take point on the organization’s cloud security? It will need to be someone or a team with the right skills and ability to commit long term. “Find the person or the team able to move toward the new cloud security paradigms fastest, and allow them to build your security strategy for the next three to five years,” says Govshteyn.

“In the last few years, this tends to be the IT operations team or an enterprise security team, but there is always an architect-level individual contributor or dedicated cloud security team at the core of this effort. This new breed of security professional can write code, spend more than 80 percent of their time automating their jobs, and view the development teams as their peers, rather than adversaries,” says Govshteyn, adding that at technology companies security is sometimes a function of the engineering team.

Although boards of directors are taking great interest in security these days, they won’t help at the ground level. “In reality, much of the critical decision making when it comes to cloud security today comes from technologists able to keep up with rapid pace of change in public cloud,” he says.

Further complicating the task of securing the cloud for more than half (53 percent) of the respondents is the fact that their organizations have not implemented a cloud strategy or framework. While nearly all those organizations plan to do so in the future, it’s not clear who is leading that initiative.

“Security and monitoring tools will also be able to leverage the same security delivery platform for more flexibility – so network, security and cloud need to also agree to share the responsibility of the security delivery platform,” says Clavel. “Companies that consolidate their security and monitoring activities – as part of the SOC – or at least to establish common budgets and shared ownership of a security delivery platform, are rewarded with better flexibility, faster decision making, and consistent security across on-premises and cloud deployments.”