Multi-cloud environments are quickly becoming a common deployment model for many organizations. However, from a security point of view, they introduce additional complexity.
A major source of this complexity is the expansion of both the threat surface and of the skills and knowledge required to handle the various tools, services, software objects and security policies of each cloud service provider (CSP). As a result, organizations struggle with the following main multi-cloud security challenges:
Let’s dig deeper into each challenge and then look at best practices to help solve them.
Multi-cloud security challenges
In addition to existing cloud security challenges, an organization’s security team should consider the following multi-cloud security challenges.
1. Configuration Management
Configuration management is one of the most common problems faced by organizations and given the speed of changes and updates in cloud environments, it is one that is repeated.
The scale and complexity of the services and objects available in a single cloud environment can lead to misconfiguration. That range and complexity only comes with each additional cloud in multi-cloud deployments.
Common configuration issues—such as using outdated server and container components and images, accidentally exposing storage nodes to the Internet, or improperly implementing and aligning identity and access management policies—can lead to security vulnerabilities and potential exposure in the cloud.
2. Consistent visibility across all cloud environments
Logging and monitoring is relatively straightforward in leading IaaS and PaaS clouds, but many organizations struggle with the volume of cloud-related events generated. It becomes even more difficult when multiple clouds are involved.
Many organizations also often do not understand how to coordinate and contextualize playbooks for monitoring and alerting across different service environments, leading to further complexity.
3. Incident detection and response
Incident detection and response is often a struggle for organizations with multi-cloud deployments. This requires preparing forensic and response tools and services ahead of time in each cloud, as well as specific workflows and playbooks that cover all cloud environments. Workflows and playbooks can become more complex when using hybrid cloud architectures. Furthermore, incident responders often lack the appropriate skills to respond to incidents in each specific cloud environment.
4. Compliance and regulatory requirements
Meeting compliance and regulatory requirements across a diverse set of cloud environments can be difficult, depending on an organization’s industry. Most larger cloud providers have SOC, ISO, and other compliance-specific reports available to attest to the state of controls and processes on their side of the shared responsibility model. However, customer control status and reporting still needs to be collected and aggregated.
Multi-cloud security best practices
The following industry best practices and security tools and processes can help organizations meet multi-cloud security challenges:
Adopt cloud security posture management. A cloud security posture management (CSPM) platform may be overkill for a single cloud deployment, but it’s almost a necessity to monitor and report on configuration and vulnerability statuses across multiple clouds. CSPM platforms also help with compliance and regulatory reporting in many cases. Deploy cloud-native SIEM. Exporting and streaming cloud logs and other event data to SIEM systems is already possible, but security teams can increase their visibility – and therefore detection and response capabilities – through the built-in and flexible monitoring, alerting and detection playbooks in cloud-native SIEM platforms . Implement cloud-native security rails. Many leading CSPs offer security services and tools that help with visibility, reporting, and threat detection and response. Google Cloud Security Command Center, Microsoft Azure Security Center, and Amazon GuardDuty are native tools that can provide additional security monitoring and controls. Use tools that work across multiple cloud providers. Many endpoint detection and response, extended detection and response, and cloud-native application protection platforms provide security telemetry and threat detection across both IaaS and PaaS deployments. These tools have come a long way in recent years; using one that operates in a multi-cloud environment can help reduce operational overhead.
Dave Shackleford is founder and principal consultant at Voodoo Security; SANS Analyst, Instructor and Course Writer; and GIAC technical director.
Disclaimer for Uncirculars, with a Touch of Personality:
While we love diving into the exciting world of crypto here at Uncirculars, remember that this post, and all our content, is purely for your information and exploration. Think of it as your crypto compass, pointing you in the right direction to do your own research and make informed decisions.
No legal, tax, investment, or financial advice should be inferred from these pixels. We’re not fortune tellers or stockbrokers, just passionate crypto enthusiasts sharing our knowledge.
And just like that rollercoaster ride in your favorite DeFi protocol, past performance isn’t a guarantee of future thrills. The value of crypto assets can be as unpredictable as a moon landing, so buckle up and do your due diligence before taking the plunge.
Ultimately, any crypto adventure you embark on is yours alone. We’re just happy to be your crypto companion, cheering you on from the sidelines (and maybe sharing some snacks along the way). So research, explore, and remember, with a little knowledge and a lot of curiosity, you can navigate the crypto cosmos like a pro!
UnCirculars – Cutting through the noise, delivering unbiased crypto news
