A Holistic Cloud Security Strategy: The Big Cloud 5

Whether it’s the rapid pace of cloud provider innovation, the fluid shared responsibility model or even the constantly evolving compliance mandates, cloud security appears challenging for a lot of organizations.

But what happens puts many organizations in harm’s way? (Hint: it isn't lack of security tools.) It isn't getting a definite security technique for public cloud. According to our use countless clients, we developed The Large Cloud 5. Whilst not intended to be exhaustive, when resourced appropriately, it can help your team form an all natural cloud security strategy.

1. Gain awareness and deep cloud visibility.

The initial step for making cloud security and compliance simpler would be to know how your developers and business teams are utilizing cloud today. This is when you are making shadow IT your friend. Rather to be the bane of the existence, shadow It might be the critical insight needed to maneuver beyond conjecture to data-driven decision-making. Where’s a good option to consider these details? Firewall and proxy logs. While cloud usage via shadow It's the first degree of needed detail, it’s essential to go much deeper. Following a 80/20 rule allows your team to understand which cloud platform to pay attention to first. However, security teams must realize not just which cloud platforms have been in use but additionally what’s running included. This is when cloud provider APIs arrived at the save.

APIs are among the key technologies which make cloud not the same as most on-premise environments. This really is about getting and looking after situational understanding of what’s happening inside your cloud environments. Consider understanding not just what cloud apps your business is applying but leveraging cloud provider APIs to constantly track changes lower towards the metadata layer. This isn't a 1-time event but something that needs to be constantly reviewed and monitored. Awareness becomes intrinsically harder unless of course your team uses cloud provider APIs. Consider it: developers are coding towards the cloud providers APIs every day, but most security teams don't leverage them. What this means is there's a significant gap when it comes to visibility and control. Make certain a main tenet of the cloud security program entails harnessing the cloud provider APIs.

2. Set guardrails to instantly avoid the most serious of cloud misconfigurations.

Think about, do you know the configurations (misconfigurations or antipatterns) which should never appear in our atmosphere? Consider these as the dirty dozen. A good example will be a database receiving direct traffic from the web. Regardless of this as being a “worst practice,” Unit 42 threat studies have proven this happening in 28% of cloud environments. An excellent place to begin building your list could be Unit 42’s Cloud Security Trends report. Build up your initial list and expand these as the cloud security program matures with time. Two important caveats: whenever protections are automated, it's strongly encouraged to begin with small experiments to make sure there aren’t unintended effects (e.g., a self-inflicted denial and services information). Another area is working carefully together with your development teams. Don't attempt to place automated protections in position without gaining buy-in out of your development teams. Use development teams from the first day, begin small and ramp rapidly.

3. Standards would be the precursor to automation.

It’s very hard to automate that which you haven’t standardized upon. Do not begin on your own. The Middle for Internet Security Software, or CIS, has benchmarks for those major cloud platforms. Many teams discuss automation without getting a burglar standard in position. A great goal would be to target automating 80% of those with time. As the program settles on standards, the automation part will end up more straightforward. Don’t be prepared to move from no automation to full automation in 3 months unless of course you're a startup. This method often takes enterprise organizations a minimum of nine several weeks before they hit their stride. One factor to notice: automating your standards is tough to attain should you not have security engineers who understand how to code.

4. Train and hire security engineers who code.

Unlike most traditional data centers, public cloud environments are impelled by APIs. Effective risk management within the cloud mandates that security teams leverage APIs. APIs take time and effort to make use of without getting engineers in your security team who understand how to code and automate security processes. Standards are wonderful but without automation continuously enforcing them via policy they become one-time checks.

With respect to the size your business, begin with an exam from the skills that already exist today. Do you have team people who understand how to code just like Python or Ruby? If that's the case, invest heavily during these team people and align goals for your automation maturity timeline. Don’t curently have someone around the team? Then you've a number of options. Search for individuals who wish to learn and survey your team of developers for people who've proven a desire for security. Both could be trained to safeguard the developers and coding for that security engineer, if goals around training are aligned and resourced correctly.

In case your organization isn't strong in coding, this can be an excellent task for a brief-term consultant that has carried this out in lots of organizations before. If you opt to follow this path, make sure to include understanding transfer like a key deliverable within the statement of labor. You shouldn't have scripts your teams don’t understand how to modify or use. After you have this method going ahead, you’ll anticipate to fully embed peace of mind in your development pipeline.

5. Embed peace of mind in the event pipeline.

This really is about mapping the who, what, where and when of methods your business pushes code in to the cloud. Once this is accomplished, your ultimate goal ought to be to locate minimal disruptive insertion points for security processes and tools. Getting early buy-in from development teams is crucial. Your North Star with this final step would be to minimize human interaction with time. This gets to be more straightforward as the organization moves to infrastructure as code (IaC). Take into account that while you organizationally limit the amount of human hands touching what adopts your cloud atmosphere, misconfigurations naturally get minimized.

Palo Alto Networks Integrates RedLock and VM-Series With Amazon Web Services Security Hub

Palo Alto Networks helps organizations confidently move their applications and data to AWS with inline, API-based and host-based protection technologies that work together to minimize risk of data loss and business disruption. Building on native AWS security capabilities, these protection technologies integrate into the cloud application development lifecycle, making cloud security frictionless for development, security and compliance teams.

AWS Security Hub is designed to provide users with a comprehensive view of their high-priority security alerts and compliance status by aggregating, organizing and prioritizing alerts, or findings, from multiple AWS services, such as Amazon GuardDuty™, Amazon Inspector, and Amazon Macie™ as well as from other APN security offerings. The findings are then visually summarized on integrated dashboards with actionable graphs and tables. Our joint customers can use these collaborative efforts to help verify that their applications and data are secure.

• RedLock integration: RedLock by Palo Alto Networks further protects AWS deployments with cloud security analytics, advanced threat detection and compliance monitoring. RedLock continuously collects and correlates log data and configuration information from AWS Config, AWS CloudTrail®, Amazon Virtual Private Cloud (Amazon VPC®) flow logs, AWS Inspector and Amazon GuardDuty to uncover and send security and compliance alerts to the AWS Security Hub console. The RedLock integration with AWS Security Hub provides additional context and centralized visibility into cloud security risks, allowing customers to gain actionable insights, identify cloud threats, reduce risk and remediate incidents, without impeding DevOps.
• VM-Series integration: The VM-Series next-generation firewall complements AWS security groups by first reducing the attack surface through application control policies, and then preventing threats and data exfiltration within allowed traffic. The VM-Series integration with AWS Security Hub uses an AWS Lambda function to collect threat intelligence and send it to the firewall as an automatic security policy update that blocks malicious activity. As the IP address information changes, the security policy is updated without administrative intervention.

"The Palo Alto Networks product integrations help customers verify that their users, applications, and data are secure through a single pane of glass. The RedLock integration allows customers to monitor advanced threats due to common cloud misconfigurations, stolen credentials, and malicious user and network activities, while the VM-Series integration automates policies to block malicious activity," said Varun Badhwar, senior vice president of products and engineering for public cloud security at Palo Alto Networks. "With more businesses moving to the cloud, it's critical that the alert data they receive provides them with actionable insights to successfully combat cyberattacks."

About Palo Alto Networks

We are the global cybersecurity leader, known for always challenging the security status quo. Our mission is to protect our way of life in the digital age by preventing successful cyberattacks. This has given us the privilege of safely enabling tens of thousands of organizations and their customers. Our pioneering Security Operating Platform emboldens their digital transformation with continuous innovation that seizes the latest breakthroughs in security, automation, and analytics. By delivering a true platform and empowering a growing ecosystem of change-makers like us, we provide highly effective and innovative cybersecurity across clouds, networks, and mobile devices.

8 Google Cloud Security Best Practices

Google has been making some great inroads with their cloud expansion. As with AWS and Azure, developers can adopt Google Cloud Platform (GCP) easily, seeking features for use in their application stacks. Also, with the wide adoption of containers and Kubernetes, Google’s leadership in developing container technologies has earned them a reputation as a great cloud option to run these types of workloads. Finally, some organizations are choosing GCP to augment their multi-cloud strategy.

As stated in my previous AWS and Azure blog posts, no two clouds are alike. So, we must be mindful of what the basic security settings are for GCP. While there are significant differences in the details of how to secure GCP compared to other cloud platforms, one tenet remains the same: security is a shared responsibility. You can’t assume Google will secure the cloud for you. Educating yourself is key. I recommend the following resources for in-depth information on security-centric and other cloud-focused best practices to help you get the most out of Google Cloud:

• Google Security Whitepaper
• Best Practices for Enterprise Organizations
• A Security Practitioners Guide to Best Practice GCP Security (Cloud Next ’18)

With that, let’s dive into the fundamentals. The following are eight challenges and best practices to help you mitigate risk in Google Cloud.

1. Visibility

Like other clouds, GCP resources can be ephemeral, which makes it difficult to keep track of assets. According to our research, the average lifespan of a cloud resource is two hours and seven minutes. And many companies have environments that involve multiple cloud accounts and regions. This leads to decentralized visibility, and since you can’t secure what you can’t see, this makes it difficult to detect risks.

Best Practice: Use a cloud security offering that provides visibility into the volume and types of resources (virtual machines, load balancers, virtual firewalls, users, etc.) across multiple projects and regions in a single pane of glass. Having visibility and an understanding of your environment enables you to implement more granular policies and reduce risk. While GCP’s native Cloud Security Command Center works well, monitoring at scale or across clouds requires third-party visibility from platforms such as RedLock by Palo Alto Networks.

2. Resource hierarchy

One of the basic principles in GCP is the resource hierarchy. While other clouds have hierarchical resource systems, GCP’s is very flexible, allowing admins to create nodes in different ways and apply permissions accordingly. This can create sprawl very quickly and confusion when it comes to determining at which level in the hierarchy a permission was applied. To demonstrate, GCP allows the creation of Folders, Teams, Projects and Resources under an Organization.

Best Practice: Create a hierarchy that closely matches your organization’s corporate structure. Or, if you currently don’t have a well-defined corporate structure, create one that makes sense and take into account future growth and expansion.

3. Privilege and scope

GCP IAM allows you to control access by defining who has what access to which resource. The IAM resources in play are Users, Roles and Resources. Understanding how to apply policies to these resources is going to be important to implement least-privilege access in your GCP environment.

Best Practice: Instead of applying permissions directly to users, add users to well-defined Groups and assign Roles to those Groups, thereby granting permission to the appropriate resources only. Make sure to use custom roles, as built-in roles could change in scope.

4. Identity management

Lost or stolen credentials are a leading cause of cloud security incidents. It is not uncommon to find access credentials to public cloud environments exposed on the internet. Organizations need a way to detect these account compromises.

Best Practice: Strong password policies and multi-factor authentication (MFA) should always be enforced. GCP supports MFA for both Cloud Identity and corporate entities. Additionally, you can integrate Cloud Identity support with SSO for your corporate identities so that you inherit corporate MFA policies.

5. Access

It goes without saying that humans aren’t the only users of GCP resources. Development tools and applications will need to make API calls to access GCP resources.

Best Practice: Create descriptive Service Accounts, such that you know the purpose of those accounts. Also, be sure to protect service account keys with Cloud KMS and store them encrypted in Cloud Storage or some other storage repository that doesn’t have public access. Finally, ensure that you are rotating your keys on a regular basis, such as 90 days or less.

6. Managing firewalls and unrestricted traffic

VPC firewalls are stateful virtual firewalls that manage network traffic to VPC networks, VMs, and other compute resources in those networks. Unfortunately, admins often assign IP ranges to firewalls, both inbound and outbound, which are broader than necessary. Adding to the concern, research from Unit 42’s cloud threat intelligence team found that 85% of resources associated with security groups don’t restrict outbound traffic at all. Further, an increasing number of organizations are not following network security best practices, and as such had misconfigurations or risky configurations. Industry best practices mandate that outbound access should be restricted to prevent accidental data loss or data exfiltration in the event of a breach.

Best Practice: Limit the IP ranges that you assign to each firewall to only the networks that need access to those resources. GCP’s advanced VPC features allow you to get very granular with traffic by assigning targets by tag and Service Accounts. This allows you to express traffic flows logically in a way that you can identify later, such as allowing a front-end service to communicate to VMs in a back-end service’s Service Account.

7. Setup and review of activity logs

Organizations need oversight into user activities to reveal account compromises, insider threats and other risks. Virtualization – the backbone of cloud networks – and the ability to use the infrastructure of a very large and experienced third-party vendor affords agility as privileged users can make changes to the environment as needed. The downside is the potential for insufficient security oversight. To avoid this risk, user activities must be tracked to identify account compromises and insider threats as well as to assure that a malicious outsider hasn’t hijacked an account. Fortunately, businesses can effectively monitor users when the right technologies are deployed. GCP records API and other admin activity in Stackdriver Admin Activity Logs as well as captures other data access activity in Data Access Logs.

Best Practice: Monitoring Admin Activity Logs is key to understanding what’s going on with your GCP resources. Admin Activity Logs are stored for 400 days, Data Access Logs for 30 days; so make sure to export logs if you’d like to keep them around longer for regulatory or legal purposes. RedLock ingests alerts based on activity log issues.

8. Managing VM image lifecycles

It is your responsibility to ensure the latest security patches have been applied to hosts within your environment. The latest research from Unit 42 provides insight into a related problem: traditional network vulnerability scanners are most effective for on-premises networks but miss crucial vulnerabilities when they’re used to test cloud networks. In GCP, however, patching running VMs may not be the ideal approach.

Best Practice: Use the power of automation to manage your VM image lifecycles. Create a custom image that’s either been patched or blessed from a security or compliance perspective, and then deny access to non-custom (trusted) images using a Resource Manager Constraint. Additionally, you can remove obsolete, older images to ensure that you are using the latest and greatest VM image.