Multi-Cloud Security: What You Need to Know

This blog was originally published by Vulcan Cyber here.

Written by Orani Amroussi, Vulcan Cyber.

The multi-cloud approach is becoming increasingly popular among companies looking to take advantage of its agility, innovation, potential cost savings, and the flexibility to choose the best of what each cloud provider has to offer based on your needs. According to Gartner’s 2020 survey, 81% of public cloud users reported they were using the services of multiple cloud vendors. But, with security the number one challenge for enterprises using cloud – and more and more organizations choosing to work with multiple cloud vendors – multi-cloud security has become a top concern.

Despite the many advantages multi-cloud offers, working in interoperable, diversified environments has its drawbacks:

• Requires individuals skilled in managing multi-cloud environments.
• Integrating multiple cross platforms can be challenging, even with the help of APIs, since cloud vendors employ different technologies in order to gain a competitive advantage.
• Expanded attack surface as a result of integration of multiple cloud vendors into the environment, making it more difficult to manage and secure the environment.
• Latencies due to data transfers between cross platforms could lead to performance and reliability issues—availability is a key element of security.

In this blog, we focus on how to manage the security of multi-cloud environments while mitigating the challenges.

Why multi-cloud?

With the booming demand for cloud services, cloud vendors are making every effort to evolve with the trends and build a presence in their niche markets in order to gain a competitive edge. Cloud giants AWS, Azure, and GCP all offer a wide range of pricing models, functionalities, features, configurations, and security solutions.

A multi-cloud strategy offers a number of benefits, among them:

• Avoiding vendor lock-in: Enables organizations to avoid vendor lock-in, so they are not restricted to a single cloud provider and have the freedom to use multiple technological stacks from competitive cloud providers.
• Cost savings: Multi-cloud offers the flexibility to choose services from various cloud vendors. The ability to select the cloud provider offering the best price for the specific functionalities your business needs can lead to major cost savings. For example, a company may use GCP for its data analytics capabilities, Amazon EC2 for infrastructure, and Azure for database management.
• Decreased risk of downtime: While the majority of providers maintain a 99% availability SLA, there is still a chance of downtime. But the chances of two public cloud providers going offline is highly unlikely.
• Meeting compliance regulations: As your company’s cloud footprint grows and business lines expand geographically, compliance regulations may require you to store your data on particular continents. Having multiple cloud providers will allow you to choose the best data center based on the geographic location.

There is a misconception that adopting cloud transfers the security responsibilities to the cloud provider. This, however, is not the case. Depending on the cloud service model, the shared responsibilities change. Even if you use IaaS, SaaS, or PaaS, your organization will be fully responsible for your data, accounts, and access management. Thus, responsibility cannot be transferred to the cloud provider completely, and multi-cloud strategies will not reduce the security responsibilities associated with certain cloud components.

Multi-cloud security management

With a multi-cloud approach, it is imperative to learn how to manage and protect security, which consists of three key elements:

• Availability
• Integrity
• Confidentiality

While cross-platform security and configuration come with their challenges, you can enhance multi-cloud security by:

• Ensuring proper asset identification—unidentified assets pose a much greater security risk.
• Identifying risks early on.
• Prioritizing risks.

1. Cloud Security Posture Management (CSPM)

In the complex, interconnected multi-cloud environment, clear visibility across the different platforms is essential for security management. While you can configure security in the cloud using each provider’s native tools, this does not guarantee security across different cloud platforms.

Because the cloud does not provide all the essential security configurations, you will need to enable or purchase the necessary built-in tools and services. Google Cloud Security Command Center and Azure Security Center are two such vendor-specific CSPM solutions. Both solutions notify of any misconfigurations and compliance violations and perform continuous status checks.

But having a separate CSPM solution will also not solve your multi-cloud strategy management issues. Though these service offerings feature multi-cloud integrations, they still have limitations when it comes to operating with multiple clouds. Rather, this requires specialized tools for end-to-end security of the application stack.

2. Asset visibility

Risks are estimated based on threats, and threats can be found in vulnerable assets. Identifying the assets within the scope is therefore the first step towards identifying risks.

Since cloud services offer plenty of flexibility, especially with IaaS, it’s not uncommon to see employees creating test environments and then leaving them without proper decommissioning. Cloud sprawl is an unfortunate reality. In larger organizations with different teams managing different cloud providers, the processes and procedures don’t always align with each of the team’s priorities, or they may simply be neglected.

Without visibility of all teams to see whether they are following the same protocols and keeping the environment clean, the attack surface could easily grow due to unattended resources such as VMs or containers that were not even recognized as active assets.

Centralized risk management, therefore, requires consolidating these resources, standardizing, establishing baseline security measures, and ensuring control over assets—from configurations to access management, and more. Proper visibility of your assets will ensure uninterrupted communication between resources across different clouds and allow you to maintain availability of cross-resource utilization within your organization.

3. Prioritizing risks

Native tools and the service offerings provided by cloud vendors can help identify potential security risks in the environment, but teams often face challenges when it comes to prioritizing that information. This may be due to lack of manpower and skilled personnel or because of time constraints. Of course, not all findings can be remediated simultaneously, and so the focus must be on the high priority risks. Using prioritization tools to classify risk findings based on severity, criticality, and more can greatly simplify this process.

4. Managing remediation

After risks are identified, they need to be remediated and tracked, a crucial element of managing multiple environments. Automation and orchestration of security risk management takes the remediation process to a whole new level. It allows you to save time and avoid misconfigurations that could potentially lead to risks in the system. All identified risks must be remediated and the process closely tracked to ensure optimal cross-team collaboration. Built-in playbooks can help to automate the remediation process so that your team doesn’t need to deal with each and every alert.

5. Reporting

While the built-in security tools offered by AWS, Azure, and GCP can help you identify the risks in the cloud environment, there are frequently blind spots in multi-cloud environments these tools miss. This is where reporting and deep insights are so critical, as they allow management to make the right business decisions and adjust their security posture as needed. To this end, having a single cyber risk management platform capable of collecting and displaying all risk information from multiple cloud sources is essential for securing the multi-cloud environment.

---

About the Author

Orani has years of experience in marketing and content creation. He works to help security professionals learn about best practices for defending their enterprises in a rapidly evolving cybersecurity landscape.