The key to cloud security starts with an understanding of the components of your cloud stack. Its various layers – services, identity, app edge, load balancer, compute and storage – create potential targets and represent areas within the cloud environment you need to secure.
Figure: Layers of a cloud stack
5 Tips to Lock Down Identity Management
Identity and access management determines which parts of the cloud stack users have access to, as well as what they have permission to do when they’re there. If a bad actor can gain access to systems using legitimate credentials, compromise is nearly certain.
To lock down identity management, consider the first five tips that follow.
1. Require Secure Passwords
Use the longest password or passphrase allowed by the system, or use a complex password that includes a mix of letters, numbers and symbols.
2. Implement Multifactor Authentication (MFA) Everywhere
Having a strong password isn’t enough. Organizations need multiple layers of protection. Using a second validation or authentication method provides another layer of protection for user logins.
3. Create Least Privilege Roles
Give users access to the fewest number of accounts and systems that allow them to be productive. This limits the damage that can result from a mistake or if a bad actor gains access to an account.
4. Disable Inactive Accounts
When employees leave an organization, their access to all systems, as well as their access keys, should immediately be disabled. Inactive accounts leave more endpoints vulnerable, and inactive accounts aren’t usually monitored as rigorously as active accounts, which opens the possibility for inactive account activity to go unnoticed for a period.
5. Monitor for Suspicious User Behavior or Compromised Credentials
Use real-time monitoring that leverages machine learning and analytics to identify suspicious activity and compromised account credentials.
Secure the Compute Layer
Organizations should take steps to secure the compute layer to ensure availability of systems and data, and to keep bad actors from using their compute power to spread malware across the business and internet.
Use these next five tips to fortify compute layer security.
6. Harden the Operating System
Remove unnecessary programs that only serve to broaden the attack surface. Make every effort to stay up to date on service packs and patches.
7. Continuously Check for Misconfigurations and Anomalies
Use automated tools to detect changes across the environment as well as anomalous behavior.
8. Enable Secure Login
Issue secure shell (SSH) keys to individuals. SSH keys will keep assets protected when moving across unsecured networks.
9. Implement Inbound and Outbound Firewall Rules
Set definitive rules about what, how much and who can send, receive and access inbound and outbound data.
Many organizations are reluctant to set up outbound rules, but because attackers will attempt to steal (exfiltrate) sensitive data and intellectual property, it’s important to ensure outbound rules are explicitly defined.
Firewall rules need to be created at the application layer rather than the transport or network layer (IP and port information). This practice will prevent attackers from piggybacking off open ports (such as the domain name system [DNS] on port 53).
10. Use Only Trusted Images
Build images from scratch or get them from trusted sources, such as AWS or Microsoft Azure. Don’t use images from Stack Overflow or random message boards and user communities.
Secure Storage
If attackers get access to the storage layer, they can potentially delete or expose entire buckets or blobs of data.
Use the following six cloud security tips to secure your storage.
11. Manage Data Access
Identity and access management (IAM) policies and access control lists (ACLs) help you centralize the control of permissions to storage. Security policies allow organizations to enable or deny permissions by accounts, users or based on certain conditions – such as date, IP address or whether the request was over a Secure Sockets Layer (SSL) encrypted session.
12. Classify Data
Automatically classify data to understand what type of data is stored and where. Data classification policies should match security policies, and any violations should be flagged or automatically remediated.
13. Encrypt, Encrypt, Encrypt!
Encrypt data in transit and at rest. Note that the metadata is often not encrypted, so organizations shouldn’t store sensitive information in cloud storage metadata.
14. Enable Versioning and Logging
Versioning allows organizations to preserve, retrieve and restore data if something goes wrong. With versioning turned on, businesses can restore data from an older version if a threat or application failure causes data loss.
Maintaining access logs provides an audit trail if someone or something gets into your system.
15. Do Not Allow Delete Rights (or Require MFA for Delete)
Organizations should set up roles in their cloud infrastructure that do not allow users to delete data. Many cloud storage solutions enable a feature that requires MFA to delete any version of data stored in the storage layer.
16. Continuously Check for Misconfigurations and Anomalies
Use automated tools to detect misconfigured storage and permissions settings as well as anomalous file access behavior.
Protect Your Cloud Services
After you’ve secured the perimeter and enforced smart policies, you need to focus on security specifically for your services in the cloud.
17. Use Source Control
Use source control to secure versions, access to builds and deployment instances. This practice will reduce the surface area of your code and limit the potential for attacks across your network.
