Why a Cloud First Strategy Leaves the Door Open to Hackers

Kicking off a cloud-first strategy without considering security measures can cloud your judgement

• By Robert Huber
• Jun 19, 2018

"Cloud first" has been the mantra of the better part of the last decade for many businesses. The argument, as it goes, is that the only way forward is to focus on building your business with cloud computing at the forefront of your efforts. And while the cloud may be paramount in offering previously unavailable efficiencies and capabilities, kicking off a cloud-first strategy without considering security measures can cloud your judgement.

Many companies operate with a tunnel vision, quickly jumping to adopt cloud technologies without understanding the nuances and implications. Saving on equipment and administration costs are tempting features for any business' bottom line, but with eyes on this prize, they often gloss over a critical aspect: security. For a business that has never been hacked, existing security protocols seem sufficient, but moving to the cloud presents a new range of security challenges. Companies that opt for a cloud-first strategy risk leaving themselves exposed.

Before making the leap to the cloud, there are several facets of cloud technologies that companies need to understand so that the benefits—reduced costs, ease of use, lower IT overhead, easy scalability and more—are not realized at the peril of potentially business-ending breaches.

From the Ground Up

Businesses don’t need to reinvent the wheel by forging their own cloud computing environment. They just need a firm understanding around today’s technology. The cloud is named such because it spreads data over many servers housed in different locations, like water droplets in a cloud. The ones and zeros that make up your spreadsheets, intellectual property and compute live in various places in massive, climate-controlled server farms. Whether you are using Infrastructure-as-a-Service (IaaS), like cloud storage and compute, or Software-as-a-Service (SaaS), such as productivity apps, these server farms communicate through networks, responding to requests for compute resources, data, sharing and storage. Because these server farms use networks, vulnerabilities inherently exist.

While cloud technology companies have gone to great lengths to secure data and connections, there is an ongoing battle against hackers. Some cloud security risks are due to a provider's mistake, like last year's $30 million Ethereum theft, while others are not a provider’s fault with the onus elsewhere, like the recently discovered Meltdown and Spectre bugs in processor chips. And then there are the many connections between users and data that can be compromised, exacerbated by a roaming workforce, mobile devices and malware that arrives through email, web or other routes. These alternative entry points don't require hacking into networks because users can unwittingly open the door for them through infected email attachments.

Security First

Cloud providers often market their products as upgrades from the vulnerability and intense labor of in-house servers and this is true to a great extent. But, they openly warn users of these services that cloud services, of any type, is a shared responsibility model for security and compliance. The service provider is responsible for the security of their platform, but not the security of your information, guest operating systems and instances that reside on their platform. That is your responsibility!

As many businesses are undergoing digital transformations, a growing number of professionals are turning to specialized certifications in cloud security. Organizations like the Cloud Security Alliance and others offer trainings and up to date news on pressing cloud security issues as well as techniques to protect cloud environments. Cloud security pro's need to understand technologies such as virtual private clouds, security groups, administrative APIs, micro-segmentation, serverless apps,  microservices, instance and formation templates, CloudTrail and Stackdriver to name a few.

Whether your company hires or contracts out, it is important that any cloud security personnel you bring on board has the right credentials and has studied the unique challenges that your digital changes present. A proper cloud security strategy should correspond to your company’s actions, risk tolerance, and take into account the benefits offered by any of your cloud providers. Then this strategy should be supplemented with a layered approach involving in-house and SaaS solutions dedicated to maintaining the integrity and safety of your data and information.

Visibility Driven Cloud Security

The most important step in moving anything to the cloud is to prioritize security in tandem with a migration. The cloud environment requires constant visibility, monitoring and vigilance. Breaches can come from anywhere at any time. For example, the Sony breach came from an employee pulling an email out of their junk folder and opening the infected attachment. And the Target breach came from a subcontractor's connection to the payroll system. More recently, organizations are suffering from data exposure in the cloud due to open shares, such as the Verizon partner incident. Adversaries have taken note as well, adopting cloud infrastructure providers as their C2 nodes, cloud storage providers as their exfil location, and microservices and serverless apps to perform actions that are difficult at best to perform incident response and forensics against.

With the cloud spreading data over a wide range of providers, solutions that look only at one aspect of a system are of little value providing limited visibility and creating a security gap. Effective monitoring looks at all the connections via network monitoring, computing resources via logs and the data itself. Breach analytics solutions that monitor the perimeter (north/south), the traffic within your infrastructure (east/west), your workforce, whether they are in or out of the office, as well as the application provider layer is the only standard going forward and needs to be put in place to digitally transform securely.

Cloud First Missing Security

A cloud first strategy is understandable, but it isn’t smart. Making the most of the cloud’s cutting edge technologies can save money and time, but jumping in without first laying the proper groundwork for security leaves businesses vulnerable to breaches and data loss. Instead, prioritize security by arming yourself with information about the cloud and its vulnerabilities then take measures to keep your data secure through ongoing monitoring.