Private cloud is infrastructure only accessible to the users of the organization, offering more control over all aspects of operations, but at greater cost and complexity. Public cloud services such as those provided by Amazon Web Services (AWS), Microsoft Azure, or Google Cloud (GCP) provide resources from their data center facilities to multiple customers on a shared basis. Public cloud service providers are responsible for the availability of the underlying infrastructure as well as some services running upon it, while the customer is responsible for selecting services appropriate to them and maintaining security of everything running on the underlying infrastructure.
The hybrid cloud model often sees deployment decisions being made based on data or service sensitivity, as well as regulatory frameworks. More sensitive data and systems may be hosted in private cloud, with less sensitive services hosted in public cloud. A good hybrid-cloud security strategy seeks to protect the data, applications, and infrastructure regardless of where they are hosted. This protection covers processes, workloads, and management using holistic services that provide a consistent and comprehensive security posture across locations.
Hybrid-Cloud Security Challenges
Securing hybrid-cloud environments requires skill sets associated with on-premises data center management, cloud platform management, as well as tools capable of orchestration services between the two that can provide a unified experience for technical staff. The difficulties associated with the management of hybrid-cloud infrastructure are increased in regulated environments, as well as complicated by the need to compensate for legacy processes.
Common hybrid-cloud security challenges include:
The Shared Responsibility Model: It is important to understand where your responsibilities lie in both public and private cloud models. If your organization is using a third-party to provide both, the line of demarcation may be similar, whereas if the organization operates the data center it could be very different. In either event, to build a consistent security posture it is important to ensure processes and tooling are aligned.
Incident Management: In the event of a public-cloud security incident, incident management procedure must include engagement with the third party responsible for management, as well as being mindful of any SLAs associated with security events. Sensitivity of data, of log information, and potentially the clearance levels of support staff, can impact upon both recovery time and subsequent analysis. Private-cloud environments usually see more direct organizational control, and such difficulties become less likely.
Fractured Application Security: It is common for the broad spectrum of security threats faced by cloud-based applications to be met by a large number of individual solutions built to address each stage. From the development pipeline to monitoring, and authentication to compliance, each having its own dashboards and alerts. Finding solutions that cover as many bases as possible as well as covering private-cloud deployments greatly simplifies this.
IAM: Controlling resource access with Identity and Access Management is more challenging in hybrid environments, with different directory services and risk profiles resulting in a need for different controls. Maintaining consistency across platforms makes for a robust security posture, as well as a good user experience
Components of Hybrid-Cloud Security
Successful hybrid-cloud security calls for a rethink of the approach an organization takes to technology, as well as the management processes around it.
Some of the key hybrid-cloud security components are:
Configuration Management: Maintaining a consistent baseline across environments is imperative to security in hybrid-cloud deployments. Configuration management can help track that baseline, identifying and remediating any deviation from it.
Workload Security: Using a solution capable of protecting all workloads whether application, service, server, virtual server, serverless, or container regardless of location establishes a host security standard.
Vulnerability Scanning: Identifying anomalies, lateral movement, and other potential precursors to security events becomes even more important in hybrid-cloud.
Visibility: With internal and external users accessing systems and services across locations, visibility becomes more important. A single security dashboard for all locations greatly simplifies operations.
Benefits of Hybrid-Cloud Security
Hybrid-cloud offers significant benefits to some organizations where less sensitive and/or more publicly accessible resources can be hosted in public cloud to take advantage of the cost savings, scaling, and higher availability available. At the same time, more sensitive use cases or legacy systems not immediately suitable for cloud deployment can be hosted in private facilities designed for and dedicated to their purpose.
Hybrid-cloud security can improve overall security posture by:
Offering resilience: Building a technology capability in multiple locations brings safety and availability to digital assets. Applications, services, and data spread across multiple technology platforms results in improved business continuity and disaster tolerance.
Meeting Regulatory Requirements: Hybrid-cloud allows you to store data in locations that meet the stipulations of regulatory frameworks such as GDPR, HIPAA, and PCI-DSS, as well as offering provision for the organization to store its most sensitive data on corporate-owned systems.
Achieving Least-Privilege: Using the cloud to provide access to applications and services leads to new opportunities, but also introduces risk. By leveraging the hybrid-cloud model to store high-traffic / low-sensitivity services in the public cloud while retaining greater control of higher value assets, users can be offered the right access in the right governance framework.
Managing Security Risk: Hybrid-cloud provides for the full spectrum of risk appetites by offering both public and private cloud hosting options. Personal or commercially sensitive data can be locked down using private infrastructure completely in the control of the organization, and publicly available systems and services can be hosted in the public cloud for maximum connectivity and availability.
Hybrid-Cloud Security Best Practices
A successful hybrid-cloud deployment can mean different things to different organizations and industries, but the basic tenets of good hybrid-cloud security remain constant. Building on the foundations of cloud security best practice, the following best practices will help guide you to a solid hybrid-cloud security posture:
Establish a Baseline: Build a consistent security policy and enforce it using a configuration management solution designed for hybrid-cloud. Automate the return of any deviations back to baseline.
Build a single view: Multiple tools for public and private cloud make for a complicated landscape to manage. Having all logging, monitoring, and alert data in one place makes analysis easier, corrective action faster, and overall security posture clear to everyone.
Have a Recovery Plan: No matter how good your security position, be sure to plan for failure in public or private cloud. Having more than one platform is a fantastic position to be in, but it is all too common for recovery scenarios to only be tested in one direction.
Think Cloud First: With private-cloud extended to the Internet-connected public-cloud, it is important to understand that the unknowns of the Internet have gotten closer to your private-cloud systems, including on-prem virtual platforms such as VMware vSphere hybrid-cloud. Manage links carefully, ensuring traffic from the cloud is limited as well as thoroughly inspected.
Prioritize Endpoint Security: Endpoints are the weakest link in your security chain, and it is critical to protect your data between those endpoints whether they are on-prem, virtual, end user devices, IoT, containers, serverless, or database services.
When you’re comparing cloud security partners, be sure to prioritize those who seamlessly integrate on-prem and public cloud componentry into common policies, processes, and management views. Ensure a robust and consistent hybrid-cloud security posture by choosing a security product designed for hybrid-cloud. Learn how Wiz can support your transition to secure hybrid-cloud by booking a demo.
