The Challenges and Benefits of Securing Hybrid Clouds

A solid majority of enterprises (58 percent) currently have a hybrid cloud strategy, up from 51 percent in 2018. This number is sure to grow as more organizations discover the benefits of combining the easy customization and administrative control of private clouds with the convenience and scalability of public clouds.

Despite the appeal of the hybrid approach, hybrid cloud security is a major challenge. Hybrid cloud security focuses on protecting all components – data, applications, workloads and infrastructure – while taking into account the movement of workloads across public and private infrastructures.

Hybrid cloud environments can get fairly complex. Different providers approach security differently, and security levels between public and private clouds also vary. Properly protecting data, no matter its location, requires a solid understanding of the security controls and protocols in place for each component.

Effective security also requires understanding risk so organizations can determine which data and applications require how much security. Tighter controls should be placed around the data that is most sensitive – and that would cause the most damage if breached or stolen. Hackers typically zero in on sensitive data, such as personnel and health records and intellectual property, because they can sell it. “Financial gain is still the most common motive behind data breaches,” according to Verizon’s 2019 Data Breach Investigations Report (DBIR). And as more organizations move to the cloud, so do cybercriminals. The 2019 DBIR shows that adversaries have adapted their “old ways” to more effectively attack data in the cloud.

Develop a Security Strategy

Hybrid clouds give organizations the choice and flexibility of placing workload and applications where it makes the most sense. For instance, highly sensitive data is best handled in a private cloud with reinforced security, while lower-priority data can stay in public clouds. Hybrid environments also let you dial capacity up or down as needed.

But with those benefits come some challenges, primarily around management and security. Visibility and monitoring are essential to a well-run environment. If you can’t see something, it’s impossible to properly manage or secure it.

Therefore, a management solution with visibility into the complete environment is an absolute must. This is complicated in a hybrid environment by differences in security protocols from one cloud to another, but it isn’t impossible. Just as you would secure components from different vendors in an internal network, now you’re doing it across different infrastructures. You still need to implement all the layers of security you normally would have in place while also making sure to protect data in motion.

Effective security includes clearly defined data access protocols, preferably with multifactor authentication and least-privilege rules. Users should have access only to the data they need to do their jobs; the fewer people you allow to access sensitive data, the better. To further protect the most valuable assets, minimize the links between them and other components in the environment. For instance, systems housing intellectual property don’t need to be connected to your website or customer relationship management (CRM) application.

A secure environment also requires content filters, firewalls patch management, data back up and recovery, and encryption for data traveling back and forth between clouds and on-premise infrastructure. And don’t forget endpoint security; endpoints remain among the most common attack targets.

As you develop your hybrid cloud security strategy, keep in mind many security threats don’t target specific clouds, whether public or private. Credential theft, malware and Distributed Denial of Service (DDoS) attacks are a risk to any IT environment and, as such, require a uniform approach across the entire infrastructure.

Manage Risk

Protecting your hybrid cloud environment is crucial because cyber attackers are relentless. Cybercrime is now a $2 trillion industry, with attackers constantly introducing malware variants and finding new vulnerabilities that provide an entry point into computing environments, and refining methods to target victims through phishing, social engineering and other methods. The result is that an organization diligent in implementing security and managing risks as no environment can be 100 percent secure at any given time.

This is why organizations increasingly are taking a risk-based approach to security, much as they do with other business risks. This requires performing a comprehensive assessment of the risks facing the organization so that you can determine which types of data are most vulnerable and need the most protection.

Visibility is key in implementing a risk-based strategy because you need to monitor all movement in, out of, and within your environment. That means having a 360-degree view into the environment 24/7 so you can respond swiftly and decisively to threats and anomalies coming from a wide variety of vectors.

User privileges also play a role in security risk management. Restricting data access to a minimum number of users is advisable, as already mentioned, but even those with privileged access must be subject to programmatic and continuous monitoring. Companies sometimes are too liberal with user privileges or fail to revoke access to sensitive data for users who move on to other jobs, creating added risk.

Understand Your Responsibility

When it comes to securing hybrid clouds, organizations share the responsibility with the cloud providers. Protocols such as authentication and access privileges are up to you, while the provider has responsibility for protecting data within their environments.

Before contracting with any cloud provider, do your homework about their security practices and controls, and find out if they are updating their technologies as needed to keep up with the latest threats. There’s never a finish line with cloud security because data-handling requirements are dynamic and threats are always evolving, so you should review your security posture periodically to ensure maximum effectiveness and properly manage risk.

Find out how Verizon Enterprise Solutions can help you build a hybrid cloud security strategy. And to learn more about the threats enterprises are facing, get actionable insights to help mitigate them in our 2019 Data Breach Investigations Report.