How Do You Secure Your Cloud Services?

This blog was originally published by Alert Logic here.

In a previous post – What are the Most Common Cloud Computing Service Delivery Models? – we broke down the benefits of each:

• Software as a Service (SaaS)
• Infrastructure as a Service (IaaS)
• Platform as a Service (PaaS)

Considering the benefits, we also discussed how to determine which is best suited to meet your organization’s needs.

Now, let’s look at what happens after you select SaaS, PaaS, or IaaS – securing the cloud service.

Regardless of the one you choose, you’ll need a robust cloud security strategy to protect your assets. Unfortunately, there isn’t a one-size-fits-all security approach for cloud services. Each model functions differently, and you need to be mindful of that when implementing a security strategy.

Security for SaaS

SaaS providers are responsible for ensuring the security of their cloud services. This means you don’t have to worry about finding and correcting security vulnerabilities within the SaaS application––your provider will handle that.

But that doesn’t mean you don’t have to factor SaaS into your security strategy. You could still fall victim to a data breach if an unauthorized party accessed your account. Here are some best SaaS security practices to minimize your threat risk:

• Implement Single Sign-on capabilities (SSO) so you can easily authorize and revoke employee accounts when needed.
• Ensure employees only have access to resources they need to complete their jobs, and revoke access when they no longer need those privileges.
• Make sure your SaaS providers have a good track record with security, follow applicable compliance regulations, and include end-to-end encryption in their services.

SaaS security starts with you. Make sure your organization has systems and policies in place to promote good security practices. Things like multi-factor authentication and a strong password policy can go a long way in protecting your data from cyberattacks.

Security for IaaS

IaaS follows the shared responsibility model. This model requires the cloud service provider to secure the cloud infrastructure and the customer secures everything built on top of that infrastructure.

Here are some best security practices for IaaS:

• Maintain up-to-date systems to keep your cloud infrastructure protected against security threats.
• Conduct privilege audits to ensure everyone has access to what they need to complete their tasks––and nothing more.
• Actively scan for security vulnerabilities that malicious parties could exploit.
• Identity and correct threats using deep packet detection or intrusion detection systems.

One of the most important parts of securing IaaS is fixing misconfigurations. According to the McAfee Cloud Adoption and Risk Report, the average company has 14 or more IaaS misconfigurations running at a time. As the customer, it’s your responsibility to detect those misconfigurations and prevent them from growing into bigger problems.

Security for PaaS

PaaS also follows the shared responsibility model. This means you’re responsible for ensuring the security within your cloud software applications –– not your service provider.

Some PaaS security best practices include:

• Using real-time protection solutions that can detect and block attacks. Most PaaS platforms come with a range of native security tools and add-ons you can use to protect your cloud applications.
• Routinely scanning your applications and libraries for vulnerabilities and threats.
• During your development lifecycle, you should consistently analyze your code for potential vulnerabilities.
• Strengthen your security posture and regulatory compliance by using a tool for collecting and analyzing logs.

Because you use PaaS to develop software, it’s important that you have security baked into your development process. Teams must always consider security and compliance implications when developing and launching software.

Finding the Right Cloud Service for Your Organization

A key takeaway here is that migrating to the cloud does not mean your systems are inherently more secure – it just requires a different approach to security than for on-premises systems. As you evaluate options for SaaS, IaaS, and PaaS consider how much responsibility your team is prepared to take on, and how your policies and procedures may need to evolve to accommodate the change.

---

Author bio:

Angelica Torres-Corral is a product marketing expert at Alert Logic. She brings over 15 years’ experience in security, ranging from data loss prevention and user and behavioral analytics to cloud technologies. She holds an MBA from California State University, Fresno and a bachelor’s degree from University of Chicago.