Cloud security is critical to protect data and applications on public and private cloud platforms.
Rapid7 Cloud Risk CompleteCloud security is critical in this day and age because it protects data and applications on public and private cloud platforms. It accomplishes this by applying cybersecurity practices and programs to organizational cloud infrastructures, tackling traditional cybersecurity issues and new challenges related to cloud environments.
For the purposes of this page, we will focus on considerations for securing public cloud platforms, since the challenges of private cloud more closely align to traditional challenges in cybersecurity.
Download Cloud Misconfigurations Report ▶︎
Cloud computing is the on-demand availability of computer system resources without direct active management by the user. The term describes data centers that are available to many users over the internet, so that organizations can better leverage mobile technologies and big data as well as gain a competitive advantage.
Cloud platform providers are responsible for safeguarding their physical infrastructure and the basic computing, network, storage, and network services they provide. However, their customers retain most or all of the responsibility for protecting their applications, monitoring activities, and ensuring that security tools are correctly deployed and configured. This division of responsibility is known as the Shared Responsibility Model. That means customers cope with:
Cloud security solutions allow organizations to take advantage of the flexibility, scalability, openness, and reduced operating costs of today’s cloud platforms without endangering confidential data, regulatory compliance, or continuous business operations.
The benefits of cloud security include being able to:
Amazon Web Services (AWS) offers a feature-rich environment for hosting and managing workloads in the cloud. What are some of the ways that organizations can strengthen cloud security for workloads hosted on AWS?
Learn more about AWS Cloud Security
Security teams can use a vulnerability management solution to discover and assess EC2 instances and scan them for vulnerabilities, misconfigurations, and policy violations.
A dynamic application security testing (DAST) solution can test web apps to discover vulnerabilities in the OWASP Top Ten and other attacks and potential violations of PCI DSS and other regulations. When a DAST solution is integrated with DevOps tools like Jenkins, security testing can be triggered at specified milestones in the development process to ensure that vulnerabilities and violations are detected and fixed before code is put into production.
To detect indicators of attacks and data breaches, a SIEM solution can be integrated with the management and security services provided by Amazon. This includes access to logs created by AWS CloudTrails and CloudWatch, as well as services like Virtual Private Cloud (VPC) flow logs, and Amazon Route 53 DNS logs.
A SIEM solution designed to work with cloud platforms can enrich this log data with additional context from other sources (including endpoints, on-premises systems, and other cloud platforms), flag indicators of compromise, and use advanced security analytics to detect attacks early and remediate quickly.
Security alerts from AWS GuardDuty and other AWS services can be fed directly to a SIEM, allowing the enterprise security team to quickly investigate and respond.
Microsoft Azure is a powerful, flexible, scalable platform for hosting workloads in the cloud. How can organizations enhance security for workloads running on Azure?
Learn more about Azure Cloud Security
A vulnerability management solution can use Azure Discovery Connection to discover and scan virtual machines and other assets as soon as they are spun up in an Azure environment. The scanning can uncover vulnerabilities, misconfigurations, policy violations, and other security risks. It may be possible to import Azure tags and use them to organize assets into dynamic groups that can be assessed and reported on selectively.
A DAST solution can be integrated with Azure DevOps Pipelines, allowing it to automatically launch scans for vulnerabilities at each stage in Continuous Integration and Continuous Deployment (CI/CD)workflows. This helps enterprises eliminate vulnerabilities from web applications early in the development process, when they are easiest to fix.
A SIEM solution can work with Azure Event Hubs, which aggregate cloud logs from important Azure services such as Azure Active Directory, Azure Monitor, the Azure Resource Manager (ARM), the Azure Security Center, and Office365. The SIEM can obtain log data from Azure Event Hubs in real time, combine it log data with information from endpoints, networks, on-premises data centers, and other cloud platforms, and perform analyses that uncover phishing attacks, active malware, the use of compromised credentials, lateral movement by attackers, and other evidence of attacks.
The Azure Security Center also generates alerts, but lacks the data enrichment, analysis, and workflow features of a full SIEM. However, security teams can arrange to send Security Center alerts directly to a SIEM solution to take advantage of those advanced capabilities.
Cloud security is not just about providing security for separate cloud platforms independently. Rather, it is a matter of capturing, correlating, analyzing, and acting on all the security data generated by the organization and its cloud service providers.
With today’s microservice-based apps and hybrid and multi-cloud architectures, applications can be spread across several cloud platforms and on-premises data centers. The need for cloud security comes from advanced attacks that often start with endpoints or web apps and then move across multiple computing environments. Attacks against one cloud platform are often followed by the same type of attack against other cloud platforms.
For these reasons, it is essential that organizations use security solutions that provide visibility and monitoring across their entire IT footprint, including multiple cloud platforms and on-premises data centers.
2022 Cloud Misconfigurations Report: Latest Cloud Security Breaches and Attack Trends
Cloud Security: Latest News from the Blog