Specific Security Risks in the Hybrid Cloud Environment
Companies working in hybrid cloud environments must consider many types of security risks and governance considerations. Understanding security is a moving target. Education is key to ensuring that everyone in the organization understands his or her security roles and responsibilities.
Computer system security risks
According to the National Institute of Standards and Technology (NIST), a government standards body, computer systems are subject to many threats, ranging from data loss to loss of a whole computing facility because of fire or natural disaster. These losses can come from trusted employees or from hackers.
NIST divides these risks into the following categories:
Errors and omissions, including data errors or programming errors
Fraud and theft
Loss of physical infrastructure support
Threats to individual personal privacy
Hybrid cloud security risks
Many of the same security risks that companies face when dealing with their own computer systems are found in the cloud, but there are some important twists. The Cloud Security Alliance (CSA), an organization dedicated to ensuring security best practices in the cloud, noted in its recent publication, Security Guidance for Critical Areas of Focus in Cloud Computing, that significant areas of operational security risk in the cloud include the following:
Traditional security: A hybrid cloud environment changes traditional security because you’re no longer totally in control. Some of the computing assets you’re using aren’t on your premises. Now you must ensure that strong traditional security measures are being followed by your cloud provider.
Physical security covers security of IT equipment, network assets, and telecommunications infrastructure. CSA recommends both active and passive defenses for physical security.
Human resource security deals with the people side of the equation — ensuring background checks, confidentiality, and segregation of duties (that is, those who develop applications don’t operate them).
Business continuity plans need to be part of any service level agreement to ensure that the provider meets its service level agreement for continuous operation with you.
Disaster recovery plans must ensure that your assets (for example, data and applications) are protected.
Incident handling: A hybrid cloud environment changes incident handling in at least two ways. First, whereas you may have control over your own data center, if an incident occurs, you’ll need to work with your service provider because the service provider controls at least part of the infrastructure.
Second, the multi-tenant nature of the cloud often makes investigating an incident more complicated. For example, because information may be commingled, log analysis may be difficult, since your service provider is trying to maintain privacy. You need to find out how your service provider defines an incident and make sure you can negotiate how you’ll work with the provider to ensure that everyone is satisfied.
Application security: When an application is in the cloud, it’s exposed to every sort of security threat. The CSA divides application security into different areas, including securing the software development lifecycle in the cloud; authentication, authorization, and compliance; identity management, application authorization management, application monitoring, application penetration testing, and risk management.
Encryption and key management: Data encryption refers to a set of algorithms that can transform text into a form called cyphertext, which is an encrypted form of plain text that unauthorized parties can’t read. The recipient of an encrypted message uses a key that triggers the algorithm to decrypt the data and provide it in its original state to the authorized user. Therefore, you can encrypt data and ensure that only the intended recipient can decrypt it.
In the public cloud, some organizations may be tempted to encrypt all their information because they’re concerned about its movement to the cloud and how safe it is once it’s in the cloud. Recently, experts in the field have begun to consider other security measures besides encryption that can be used in the cloud.
Identity and access management: Identity management is a very broad topic that applies to many areas of the data center. The goal of identity management is to control access to computer resources, applications, data, and services.
Identity management changes significantly in the cloud. In a traditional data center, you might use a directory service for authentication and then deploy the application in a firewall safe zone. The cloud often requires multiple forms of identity to ensure that access to resources is secure.
With the increasing use of cloud computing, wireless technology, and mobile devices, you no longer have well-defined boundaries regarding what is internal and what is external to your systems. You must assess whether holes or vulnerabilities exist across servers, network, infrastructure components, and endpoints, and then continuously monitor them. In other words, you need to be able to trust your own infrastructure as well as a cloud provider’s infrastructure.