Regarding security in cloud environments, what concepts, tools, frameworks, and methodologies can be followed to avoid falling victim to hacks or internal errors that result in unfortunate expenses from the project budget?
Current situation, methodologies and risks
One of the most important and noteworthy aspects of the cloud is its flexibility in terms of scalability and integration capabilities, thanks to the use of APIs to manage everything that happens within its environment. We can say that everything that occurs on cloud platforms is the result of function calls that allow the creation of virtual machines, the launching of services, the execution of queries, and so on.
This is why we have the ability to generate many audits on everything that happens in cloud projects, since by capturing the different logs resulting from the executions of the APIs we can build different monitoring and consumption services for applications and services, as well as constantly evaluate billing quotas and implement powerful protocols to monitor security.
Example Dashboard built by Zenta which shows high-level metrics on the total number of queries executed in BigQuery, the total estimated costs of all queries for the specified time period, the volume of data processed, and the average time the query took.
It is also important not to lose sight of the concept of the shared responsibility model between the cloud provider and the client when using cloud services. In short, this model indicates the following: Security is the client's responsibility in everything that is not specifically provided by the cloud provider. For this reason, it is critical to be able to define security controls to prevent criminal attacks or internal accidents.
According to a Gartner report: It is expected that in the next 5 years at least 95% of security failures in cloud environments will be due to customer error.
Among the most common errors are: Data access, unscheduled consumption, services not enabled or enabled but not in use, etc.
Like any technology, the cloud has its own particular risks that must be well managed and understood by customers. For example, since these services are consumed over the internet, the traditional risks of consuming services this way must be taken into account. The good news is that these risks are already well known, and there are various reports and methodologies that serve as a guide to minimize them and thus exploit the countless benefits that cloud technologies deliver.
Among these reports, we cite the ENISA Computing Risk Assessment, which contains a series of guidelines to define the type of cloud risk, tailored to specific types of businesses and companies. (https://www.enisa.europa.eu/publications/cloud-computing-risk-assessment)
Example of a risk analysis of user privilege abuse. Source: ENISA
In addition to that methodology, other methods such as Magerit can also be followed, which maturely defines the analysis and management of risks for information systems.
To further explore this topic, it is important to provide a summary of the risks that we at Zenta have been able to analyze thanks to the methodologies already mentioned and based on our experience helping our clients migrate to the cloud and live there in the most secure way possible:
Insecure APIs: Using APIs makes life easier for developers, but we must ensure that the ones we consume, click on, or execute are from recognized providers, clients, and services. Therefore, there must be a process for evaluating them, as well as internal security controls that prevent, for example, giving API access keys to third parties without putting controls in place to block or monitor actions.
Service accounts: Lack of proper management of the client's cloud project service accounts, preventing actions that harm the cloud infrastructure and the organization's operation.
Data protection and compliance: Cloud environments are very secure in terms of encryption and data protection. Providers make a great effort to ensure that this vital resource for their clients is as protected as possible, but the management and processing of data is the client's responsibility. Without adequate controls regarding access, backups, etc., data leaks, data loss, and other issues can occur.
Misuse of cloud services, whether by mistake or intentionally: The cloud itself is very powerful, with a high scalability capacity, making it a target for cybercriminals whose sole purpose is to seize cloud resources for cryptojacking. Alternatively, a lack of controls can lead to unnecessary expenses in the cloud environment for an organization's user.
Security Strategies
As a result of Zenta's experience, when one of our clients is about to migrate to the cloud, we guide them in implementing security protocols similar to those they have (or should have) in their on-premises environments. If there are no acceptable protocols to replicate during the migration, we focus on building a cloud-based work model with security as a fundamental principle, leveraging the wide variety of tools provided by cloud vendors to establish baseline security protocols and measures.
We create secure yet agile environments by implementing CI/CD standards so that both the business and its developers can benefit from cloud-native security, enabling them to evolve faster as their environments grow and projects, products, and services are deployed. Leveraging the power of the cloud, we simplify the lives of developers, architects, and the business itself.
It's important to clarify that a sound cloud security strategy relies heavily on the development and evaluation of a threat analysis and risk management system. This will enable the development of appropriate security controls and policies for each client. With this information readily available, it's highly recommended to develop internal protocols that allow for measuring the organization's security health based on established processes, identified risks, and detected threats.
When we at Zenta guide our clients in migrating to the cloud, we help them understand that architecture design and implementation should no longer be approached in the same way as before. With the advantages offered by cloud providers, it's best to leverage native services to establish architectures and platforms properly adapted to the new reality. We always ensure that these native services meet the specific needs of each client.
Finally, I would like to mention another very important tool for ensuring security in cloud environments: the NIST Cyber Strategy Framework. This tool wasn't developed solely for cloud environments, but it can be used to assess a company's cybersecurity maturity. It provides controls that can and should be developed based on the needs of each business, and it indicates that for each control, a description and a reference architecture should be developed and associated with the organization's control repositories.
Framework Core Structure (National Institute of Standards and Technology). SourceNIST
Final Note
In this article, we wanted to share our experience in cloud administration, migration, and secure development. At Zenta, we believe it's important to be prepared given the current situation regarding cyberattacks and cybercrimes. We believe the cloud is a fantastic enabler for our clients' development, and while, as with all technologies, risks exist, there are also various methodologies, tools, and controls that allow them to get the most out of their environments.
Are you worried about security in your business? Don't worry, at Zenta we are ready to guide you and help you achieve the best performance through quality security.