As companies increasingly adopt a multi-cloud approach, securing the network and devices must be, if not already, a cornerstone for planning and deployment. CISOs and CIOs need to be aware of the potential threats and take appropriate steps to counter them. It is easy to be lulled into a sense of false security – especially if you were to believe these 5 myths of Multi-cloud security:
- IaaS provider security solutions will secure my network While the public cloud providers do augment their security offerings regularly, they simply can not provide a comprehensive security solution that a pure-play security vendor can provide. An integrated, well designed secure network will include components of the IaaS provider augmented by the multi-cloud, Threat-Aware capabilities of a vendor such as Juniper Networks.
- My on-prem security will work across multiple clouds If you think that your on-prem security vendor’s hardware devices will have a similar software offering that works in the cloud, think again. Not every security vendor will have equivalent offerings of their hardware, in software available in the public cloud. The complexities of managing different architectures, not just in Networking, but also in the Security deployments across multiple clouds will spiral operational costs. The flip side – headache will come for free.
- Threats anywhere are the same – on-prem/ private/ public cloud A common fallacy: virus and ransomware can infect hosts running the same OS irrespective of the location of the host, so the threats in all deployments are the same. The TTP for compromising a S3 bucket are not the same as that for compromising a datastore on-prem. Therefore your technique to safeguard these attacks also needs to stay in sync with the techniques of attacks.
- Securing the perimeter and connectivity between the clouds is sufficient True, if we are living in 2012. Perimeter security works in gated communities, not in the virtual world, in organisations. Times have changed and with server less compute, proliferation of BYOD in companies, the attack surface for bad agents has increased. Threats know no boundaries, so the security solutions must safeguard all connected points in the network.
- A multi-cloud security solution deployment is a one-time activity Nothing remains the same; neither requirements, nor the design. Just when you think you have secured and locked everything down, out will spring a leak that will need to be addressed. Logging, monitoring, auditing and enhancing the security posture is a never-ending activity. Treat securing the network as a marathon-like activity. Longevity and discipline is key.
Ultimately, remember, security is all about taking adequate precautions and having sufficient processes and fallback mechanisms in place to tackle the threat when it arises. It is the only way to tackle the biggest, universal myth of them all – Nothing bad will happen to me/ my network.
Any other myths that you have heard in multi-cloud security deployments?
Mithun's Musings 