Do you know this half-joke, ‘there is no cloud, it’s just someone else’s computer’? Cloud computing is often seen as THE solution, so it is often overlooked that it is only a tool, with its advantages and disadvantages.
The benefits of the cloud are linked, among others, to:
Indeed, the main cloud hosting providers operate on a shared responsibility model. Providers take care of the physical security of the hosting while you are responsible for what is hosted.
A bit like car manufacturers who have to produce reliable vehicles, but you remain responsible for your driving and for the car maintenance.
As with any tool, there are risks when using the cloud. After discussing some of the risks, we’ll review key cloud security best practices that you can implement.
In this article, we only cover risks related to what you manage when you use the cloud. We therefore don’t include the risks related to web applications that are hosted in the cloud.
Security incidents related to misconfigurations are the most frequent. It refers to situations where resources are left publicly accessible (S3 bucket, ElasticSearch database…). Configuration also covers firewall rules and port management. A risky practice is, for example, to leave administration-related ports (SSH) open.
Risk of data leaks is critical because consequences can be multiple (economic, legal and commercial).
One of the consequences of the cloud is a large and frequently changing attack surface. Between the risk of forgetting instances, the multiplication of access points and of users having access to them, the risk of data exposure is increased.
Sometimes several clouds are used in the same company. Data is then spread in several places and may be duplicated. As your teams must secure different clouds, this can lead to overlooking, errors or lack of human resources for cloud management. It is also difficult to obtain complete visibility into the information system infrastructure.
Cloud providers generally provide offers adapted to different legal requirements (GDPR, HSCN hosting…). However, this is an element that you must take into consideration and monitor when configuring instances.
These risks can be limited by good practices. Here are a few that we believe to be key for the cloud.
This article details from a more general point of view logging and monitoring best practices.
Finally, from a more global point of view, the growing good practice is Infrastructure as Code. Cloud can in fact be configured via a console. But this poses risks, because there is no trace nor history of changes. It is therefore difficult to identify the configuration problems that are introduced there, for example.
Infrastructure as Code (IaC) consists of coding what the infrastructure is going to look like. IaC allows better version and change management, standardisation of configurations and automation of resource management. Tools have been developed to help IaC, such as Terraform, Ansible, Puppet, Chef…
Code can then be analysed by static code analysis tools, which check for changes and can detect errors (e.g. Chekov), in order to enhance security.
To go further, an architecture review with access to the code can be conducted to analyse your infrastructure in depth. This white box audit allows for example to look for vulnerabilities related to service configuration, poor rights management, etc.
