Of course, you care about security! We all care about security these days. Even people who still try to get away with using ‘password!’ as a password care about security — they care whether they can access their account, but not about who else can access their account.
As technology evolves and users demand cloud and web-based applications, companies can get caught up in modernizing and migrating and overlook perilous gaps in security. The individuals at these organizations aren’t fully to blame because guidelines for security have not evolved at the same rate as technology. Thinking of security in a traditional, technological sense and trying to change old guidelines to fit the cloud just won’t work because things are just too different now (which is a crazy thought given how little time has passed). If your application is cloud-native, but you’re still thinking about its security in the traditional sense — you’re in the danger zone.
You need to shift to thinking through a lens of cloud-native security which begs the question, “What is cloud-native security?”
People around the world are so thrilled about cloud-native security Linux hosts and celebrates “Cloud Native Security Day.” Put on your party hats!
Let’s momentarily back up away from the thrilling idea of constantly patched infrastructure and ask “What is cloud-native?” Luckily, this is straightforward.
“Designed and Built on the cloud.” If the application wasn’t designed and built especially for the cloud, then it is simply not a cloud-native application. The organization and application could undergo a Digital Transformation and be re-designed and re-built for the cloud, but then and only then would it be a cloud-native application. Harnessing and leveraging the auto-management, continuous deployment, and auto-scaling of the cloud will allow developers to deliver fast and frequently “without sacrificing reliability” and put an operations team’s minds at ease with “automatic management and massive economic gain in resource consumption.”
But you can’t re-design and re-build for the cloud and then not re-think security. A traditional security model won’t cut it. It would be like completely remodeling a house and then leaving the original front of the house with a door that doesn’t close well. Not optimal.
We already know to shift our thinking from traditional security and start thinking about cloud-native security, but how do we implement it? “While the cloud disrupts traditional enterprise security postures and there are major concerns about risk, the cloud is actually an opportunity to radically transform security practices and improve enterprise security. It is an opportunity to redo security in this ever-changing threat landscape” (securityintelligence.com). With cloud-native security it’s important to keep three goals in mind:
When it comes to your cloud-based applications and data you want to manage user access, protect sensitive data, and observe to act immediately on malicious behavior.
When it comes to thinking about traditional vs. cloud-native security it’s ultimately about managing risk in three areas:
So there’s good news and bad news about the cloud in regards to security.
Good news: it’s thoroughly connected.
Bad news: it’s thoroughly connected.
Being thoroughly connected “facilitates the traffic for bypassing traditional perimeter defenses.” The whole ecosystem is “exposed to threats from malicious insiders, account hijacks, poor identity & credentials management, and unsafe application programming interfaces (APIs).” The key to limiting exposure to these threats is to implement “a data-centric approach. [Where] the emphasis is placed on data encryption, authorization process, multi-factor authentication and throughput security” (cloudlytics.com).
Automate all the things! Your cloud-based storage? It has automated backups, baby. Your data is safe and you’re golden. Your IT team can sleep easy knowing they don’t have to manually save a backup, nor do they have to worry as much about “physical damage” when partnering with a cloud provider with “geographically-spread, highly secure, data centers” (cloudlytics.com).
While we’re taking tasks off the IT team’s plate, let’s take another! Your cloud provider takes on the responsibility of investing in and upgrading hardware, further reducing your team’s dependency on traditional security. Obviously, nothing is ever completely and totally safe from a data breach. “However, cloud security plugs the security gaps more reliably through automation, compared to the traditional security. As security threats evolve faster every day, organizations cannot solely depend upon manual security practices. With cloud security, the CPA of organizations gets automated along with AI-driven security defenses. This frees the IT teams to focus on bigger picture strategies and innovation” (cloudlytics.com).
But as always, it’s about constant vigilance.