The fact is, as commonplace as cloud adoption has become, many companies go into it without a clear strategy to guide them through the process in a secure manner. If you don’t plan your security precautions in advance, you risk putting everything from data and applications to servers and networks in harm’s way. That lack of preparation can also lead some to believe that cloud is inherently less secure than on-premises servers – when in reality it’s all down to the way the migration is conducted.
It is time to review your current security strategy and architecture to check that it is fit for purpose with the adoption of new cloud services. Once you have your security strategy in place, it will form the basis of your secuity requirements for implementation in the cloud.
A comprehensive, preplanned security strategy is central to any cloud migration. It protects the company from both external and internal attack, and will help encourage the buy-in needed from company leadership.
Thorough preparation is key
Yet, when a high-profile data breach occurs it is often the cloud platform of the business that receives the lion’s share of the blame. More often than not, the real problem lies in the company’s failure to prepare adequately for the cloud, whether technically, culturally or procedurally.
Many organisations take a surprisingly devil-may-care approach to cloud adoption. Their security strategies are not fit for purpose, and they move onto the cloud in the hope that they can iron out any difficulties as they appear. Instead, organisations should ensure systems are cloud-ready before shifting their data, services and applications across.
The cloud is not a panacea for existing security weaknesses – it requires a security architecture and strong internal security policies to achieve its potential of a more secure processing environment. Implementers should first plan out the full cloud infrastructure, which will tell them what is needed from a security perspective. They will have to decide where their data is stored, where their applications are run and what is needed to protect them. A complete security design is needed from the very beginning.
Before the migration begins, you must ensure all cloud accounts and user permissions are in place. The public cloud can be accessed by anyone with an internet connection or VPN, so the correct authorisations should be set up to prevent your crucial data being compromised or your services disrupted by any bad actors.
Remember also that you cannot simply migrate your existing anti-virus or firewall to the cloud. They are unlikely to have been designed for the cloud or their licenses will not be cloud-friendly. Updating or replacing them will require product and device selection, but it is essential to maintaining a strong perimeter. However, you may also choose to boost your response to security incidents and events by going down the increasingly popular route of outsourcing your security incident and event management to (SIEM) providers
Cloud: not pie in the sky
Most cloud migrations will require some level of challenging the status quo. Readying the business for the cloud may cause existing spending plans to change. Yet, when done properly, the process is never confrontational.
Not every challenge will be technical – in fact, the hard, technology aspects of migration are often the easy ones. Instead, the challenges are often cultural and perceptions. Situations that people do not understand are often viewed as threats and generate opposition. Change its self often creates opposition you may find opposition from the company’s business and financial decision-makers as well as the incumbent security team. Most stakeholders will not have undertaken a cloud migration before, and we all fear the unknown. Ultimately, it is down to cloud advocates to defuse conflicts by acting as educators and guiding the rest of the business through the implementation.
The process of migration should be measured, gradual and always iterative. Many organisations set themselves up for failure by lacking the capabilities to properly test their applications in the cloud. Testing is an invaluable way of uncovering issues before they can harm you in deployment. The pressure will be on to migrate as quickly as possible, but implementers should always take the time to test before deployment.
You get out of cloud migrations what you put into them. You can’t expect to benefit from the scale and availability of cloud if you don’t also put in the work to ensure it’s secure first. The best time to do that is during the migration phase. If you’re in charge of implementation, put security at the heart of the matter. It could be the difference between success and dangerous failure.
