How do you protect your cloud data?

In my experiences, ensuring the security of cloud data involves a multifaceted approach. It begins with robust authentication, incorporating multi-factor verification and encryption for data in transit and at rest. Establishing strict access controls, regular backups, and clear security policies are fundamental. Staying vigilant with software updates and implementing monitoring systems for threat detection are equally critical. Data classification by sensitivity, employee training in security best practices, and assessing the security of cloud service providers are essential steps. Maintaining an incident response plan and conducting routine security audits contribute to an ongoing and comprehensive cloud data protection strategy.

Cloud Data Security should not be an afterthought. Ensuring security involves a multifaceted approach. Each cloud provider adopts best practices in ensuring security. The key areas that need to be monitored, controlled and enforced are – who has access, what they access and when they access. When it comes to securing data, both data-at-rest and data-in-motion need to be considered. Implementing a robust monitoring and incident management system to identify the exposure, possible exploitations and remediating before any exploitation happens. Not just post implementation, security should be ensured as part of the entire software supply chain starting from development to deployment ensuring a comprehensive cloud data security strategy.

Make sure you understand how the particular provider's service are used. It is not enough to think of security measures. Familiarity of the platform should be key. You can't protect something you don't understand.

My view is that you may choose any cloud provider but all you need to ensure is how the access to data is controlled, who has access to data, who owns the encryption keys, what are the data recovery mechanisms in place ? are a few of the questions which need to be documented and referenced wherever required. Risk should be properly assessed and documented clearly which will help the technical teams to build a secure design in the cloud.

You have to first understand your company's needs. You have to review what laws and regulations your company has to be compliant with and then start looking into cloud offerings. Only then can you present your needs and compare them with the cloud service providers' offerings. It will keep you compliant and may also save you money by not getting into an offering that you do not really need.

The root cause of many critical vulnerabilities is clear: the complex design of corporate infrastructure that carries into their cloud strategy. CISA acknowledges the importance of network design in shrinking the exploitable attack surface and fighting back against attackers while advocating for the implementation of “secure-by-design” principles. Zero Trust is not enough. I recommend Zero-knowledge networking. Robust connections to resources without exposing your IP address, without inbound firewall ports, where neither the entry point nor the resource they are trying to reach has knowledge of one another. This is a true paradigm shift in hybrid-cloud infrastructure.

Customer-Managed Keys (CMKs), a.k.a. Customer-Managed Encryption Keys (CMEKs), are one of the best means to take back control of your data in the cloud. With CMKs, you have the most control over the keys compared to other Cloud Service Provider (CSP) options, including establishing and maintaining their key policies, user/role/service permissions and grants, enabling and disabling them, rotating their cryptographic material, adding tags, and scheduling the keys for deletion. Cloud Service Provider (CSP) keys such as the "KMS AWS owned key" are shared among many customers.

Data should be encrypted by default by your CSP. It shouldn't even be an option not to encrypt it. Assuming that is the case (I know Oracle Cloud Infrastructure encrypt all data by default), then the next question is how you want to manage the keys, and whether you want to leave the CSP to manage them or you want to manage them yourself. If the latter, then all CSPs (as far as i know) offer Vault services to securely store and manage those keys. The exact details of these services vary across CSPs from cloud-based vault services to BYOK and HYOK. Unencrypted data should not even be an option.

I call on all software companies, not just Cloud Providers, to prioritize sane security defaults. The responsibility for security misconfigurations lies more with vendors who set the defaults. In various roles, I've built internal libraries (Terraform, Chef, Ansible, etc.) to sensibly reconfigure provider defaults, which vendors should be giving us. Though it demands extra upfront work, it benefits customers. If you must offer a `--insecure` option for local development, we can always add CI scans to prevent it from being introduced into production, which is the only place it matters. There are entire companies dedicated to this failure, and I find it ridiculous that we must pay another vendor because security was not a core requirement.

The first step is robust access control in which 3 key areas are considered – who has access, what they access and when they access. To ensure legitimate users have access, least privilege or default-deny security policy needs to be implemented. For what they access, role or action based access control needs to be enforced and it should be tied with a robust monitoring system to check data accessed, sensitivity of data and anomalous access patterns. To strengthen further, when they access is controlled as anomalous access patterns could lead to serious data breaches. Hence, the perimeter of data access needs to be enforced so that any data accessed stays within the boundary and least privileges control the data sharing outside the boundary.

Often, when implementing access control the focus is solely on authenticating users. In a native agile cloud environment permissions of functions (i.e. lambda, Azure functions), applications and data storage is commonly overlooked. Strong user authentication is imperative, but overly permissive non-user roles is equally or more important. The least privileged access model applies user and non-user roles in a cloud environment. A CIEM (Cloud Infrastructure Entitlement Management) tool that is integrated with a CNAPP (Cloud Native Application Protection Platform) can identify and remediate overly permissive roles in your cloud environment.

Access control should start with Identity (and leverage a single "source of truth" as much as possible) but cannot end there. Device Posture, contextual attributes (time, location, etc.), risky behaviors should also be taken into account. Assessment should be dynamic and consistent to provide great security with no compromise on the user experience.

I strongly agree with the statement that access control is crucial for network security in the cloud. It ensures that only authorised individuals can access sensitive data and limits their actions based on their role. Implementing the principle of least privilege minimises the risk of unauthorised access. Additionally, using strong authentication methods adds an extra layer of security by verifying the identity of users. Overall, these measures are essential for maintaining the confidentiality and integrity of data in the cloud

i belive to have a robust cloud security posture we need to have a robust and strong access control policies , make sure the endpoints, NACL and Security groups are configured proparly to restrict unauthorised acccess

Network security monitoring (NSM) will provide traffic capture, network-based and host-based intrusion detection, and alerts. An example of such a system is Security Onion that runs on Ubuntu Linux and is partially maintained by Cisco. Detection tools should capture data from HTTP, DNS, TCP transactions, syslog, host logs and server logs. This data should ideally feed into a log collection or SIEM such as Splunk or IBM Q-Radar. A SIEM can aggregate data from multiple locations and make correlations that can identify potential threats. It can also send out alerts and assign criticality such as high or low. This will allow network security analyst to triage events in order of importance.

Effective network monitoring is essential for protecting your cloud infrastructure. By consistently observing the behavior of your resources, you not only optimize costs but also enhance your ability to effectively detect and respond to abnormal activities. This proactive approach enables you to identify potential threats, such as DDoS attacks or account hijackings, and to implement necessary countermeasures to safeguard your network. Many cloud providers offer native monitoring services, such as AWS CloudWatch and Azure Monitor, which can be utilized based on your specific needs and budget. Additionally, Cloud Infrastructure Entitlement Management (CIEM) solutions can be employed to further enhance your monitoring capabilities.

In my experiences, monitoring network of a worldwide application is one of the most important tasks that needs 7*24 support. Define triggers for abnormal traffics or using services to detect DDOS attacks and other malicious behaviors can be the key feature of this subject. But my idea is, developers must put basic rules to prevent some normal attacks like XSS, replay attacks and other basic attacks with throttling and ...

One, often overlooked, aspect is to create a baseline of your network activity. An organization has to understand what "right" looks like before they can sniff out the wrongs. Creating or observing a baseline over time will allow the organization to capture those normal nuances that could possibly be flagged by a security tool as problematic.

monitor network activity in the cloud, to detect unusual or potentially malicious network activity, such as unauthorized access attempts or data breaches. you should use various tools and services provided by the cloud provider or third-party monitoring solutions. These tools can provide insights into metrics like network bandwidth, data transfer rates, packet loss, and more.and by monitoring your network activity effectively, you can ensure the reliability, security, and even cost-efficiency of your cloud-hosted applications and services, automation and effective tools is important for keeping your cloud save

Updating software is best achieved by making it a part of the CI/CD pipeline. It begins with software composition analysis to identify any open source, third-party components for security vulnerabilities in the development phase. In the integration phase, scan the build artifacts (container images, IaC files) for known vulnerabilities in the OS packages and software dependencies in use. These scanners (Trivy, Grype etc.,) can be tied up with National Vulnerability Database to get the list of CVEs that need patching. Get the latest updates from the OS distribution on a regular basis. This process will enable attack surface evaluation and monitoring as the builds(software) get deployed into the staging environment.

To protect your cloud data from cyberattacks, it's crucial to incorporate a security-first mindset into your SDLC processes. This involves your developers prioritize security at every stage of application development. Automating software updates, using centralized management, prioritizing critical patches, and following guidelines are all essential practices. By fostering a security-first mindset among developers, you can enhance the security of your cloud data and minimize the risk of cyberattacks.

I’ve experienced first hand as a cyber security incident responder the impact of improper life-cycle management, everything from one version out of support to years of end-of-life, vendors implement patches for a variety of reasons but when it comes to security related patches there is no compromise. Threat actors regularly scan and target devices that use software that have published and easily patched CVE’s, automatic updates and a regular review of your attack surface will lift your security posture tenfold with little effort.

One aspect to bear in mind here is that “software “ doesn’t necessarily mean only your application, it can also infer the methods used to automate the building of your cloud architecture, as well as the permissions used to communicate with the cloud services provider. Excessive permissions is quite a common issue in this space, and that entry point is all that required for an intruder to gain a foothold in your cloud deployment.

Regular reviews and updates keep the patch management process in sync with emerging threats and lessons learned from previous experiences. This organized approach ensures that systems stay fortified against vulnerabilities, guaranteeing a secure and efficient operating environment.

Always the weakest link in the chain, human security is always so under-rated and needs more focus. It doesn't matter how strong your security controls are if your staff let you down.

In addition to trainings, we've found it very useful to actually run internally controlled phishing (and more.. I've had multiple internal smishing and social engineering attempts, too) campaigns on our employee base to find where the holes are. And there's no punishment... just room for targeted improvement - the best kind!

Cybersecurity can be likened to the immune system in our bodies. Despite having a strong immune system, introducing bacteria or viruses can lead to illness. Similarly, even with top-notch preventive measures, if our colleagues allow intruders in, the entire security system becomes compromised. As intruders, threats, and attacks continually evolve and grow more sophisticated, it is crucial to stay updated on the latest security trends. This is where awareness training plays a vital role in enhancing our defenses. By educating ourselves and our teams about emerging threats, we can effectively strengthen our overall security posture. Constant learning and awareness are essential to staying ahead in the ever-changing landscape of cybersecurity.

On top of education and raising awareness, cultivating a paranoid, blame-free culture internally is another Best Practice I've had the chance to observe. The objective being to report suspicions early and often: "See something, say something". The capacity to detect attacks early far outweighs benign reports and genuine mistakes.

Implement a comprehensive security awareness training program. Educate employees on phishing threats, social engineering tactics, and the importance of strong password practices. Foster a security-conscious culture to minimize the human factor as a vulnerability.

One of the first things to implement in the cloud from a security and assurance perspective should be the CIS standard, good asset management strategy and data labelling. These are foundational best practices to achieving and ongoing positive security posture in the cloud.

1. Strong Authentication 2. Encryption 3. Access Control 4. Regular Backups 5. Security Updates 6. Security Monitoring 7. Compliance 8. Employee Training 9. Vendor Security 10. Incident Response Plan

No matter how well you define and implement technical and organizational security there is always a risk that things go wrong and you end up with a system or data that is corrupt or unusable. In that case you will end up wishing that you were better prepared. The best preparation is to have contingency and disaster recovery plans - and to test them regularly!

Any IT process starts with asset management - what do you have? Once you know what you have, you can categorise and evaluate these for security requirements. The security requirements will drive the actions you take with the service/application including many of those previously listed here: - IDM/authentication/MFA - access control - application surface security mapping - data categorisation - business continuity - CWP and CASB And so on. All these actions in combination constitute a robust cloud security plan for data protection.

How can you protect your cloud data if you don't know where and what they are? Data scanning and classification is crucial to ensure effectiveness of such efforts. Many organizations I help with cloud data security are very surprised when they see results of data scanning and data sensitivity identification. Data in previously unknown locations and higher than expected amount of sensitive type of data are the most frequent realizations.