Securing the Hybrid Cloud: Data breaches, ransomware, phishing and more

As businesses continue to embrace the power and flexibility of the hybrid cloud, ensuring these networks are secure is paramount.

Used to securing siloed data, and managing secure logins for applications, CTOs and their teams have had to embrace a brave new world where applications and the sensitive data they often use can be outside of their enterprise’s firewalls.

The hybrid cloud doesn’t necessarily bring with it a new set of security issues that need to be mitigated and defended against. Data breaches, ransomware, phishing attacks and BEC scams are a present danger to traditional networks. Moving to a cloud environment may potentially amplify the attacks, but it’s a mistake to think that the hybrid cloud necessarily brings new threats.

Also, enterprises often believe that once a hybrid cloud is set-up, the responsibility for its security shifts to the vendor or service provider. Research contained in the report ‘Cloud and hybrid environments: The state of security from Algose concluded 58% of respondents use the cloud provider’s native security controls to secure their cloud deployments while 44% said they also use third-party firewalls deployed in their cloud environment.

These included Cisco Adaptive Security Virtual Appliance, Palo Alto Networks VM Series, Check Point vSEC, Fortinet FortiGate-VM and Juniper vSRX, thereby creating a mixed estate of traditional and virtualized firewalls, and cloud security controls.

The reality is that a close partnership with cloud services vendors must be developed to ensure network-wide security is maintained. Often, this will mean a symbiotic relationship developing that ensures your business understands which components of the hybrid cloud security you must maintain.

Dave Klein, Senior Director of engineering and architecture at GuardiCore, told Silicon: “In essence, every established enterprise has to contend with bare metal, hypervisors, premises, clouds, containers and serverless. They all have critical applications running on legacy operating systems – some end of life.  Traditional segmentation techniques like VLANs, ACLs and firewalls aren’t working well since they are static and only work within portions of their environments.”

Securing sensitive data is, of course, a core component of any comprehensive security policy. It’s interesting that in the wake of GDPR, security in a hybrid cloud environment has had to become more comprehensive.

Tim Mackey, Principal Security Strategist at the Synopsys CyRC, explained: “The role of general-purpose privacy regulations like GDPR introduces complexities into any digital transformation effort. While industry regulations like HIPAA or PCI deal with a class of data inherent to a business’s core operations, GDPR deals with the residency of current and prospective customers to a business and then applies data governance rules to the interaction.

Mackey concluded: “If a hybrid cloud strategy is being considered to address the requirements of GDPR, then the overall privacy landscape should be reviewed as part of the initiative. For example, while it may be desirable to host data on EU residents on cloud infrastructure within the EEA, the application must be able to recognize that EU residents may travel outside of the EEA and that while outside of the EEA, their data privacy rights remain the same as if they were accessing the web site from their home.”

Securing the hybrid cloud needs, therefore, a multifaceted and comprehensive approach that simultaneously delivers strong general perimeter security and more focused data or application-based security protocols.

NEXT: Managing Risk