With the rise of hybrid cloud architectures, organizations are increasingly relying on a mix of on-premises and cloud-based infrastructures. Organizations commonly choose to run their data pipelines using hybrid cloud management since sensitive data needs to be hosted on-premises for compliance or residency obligations. The approach offers a number of benefits but can also introduce new challenges with data security as data may be spread across multiple locations and accessed by different users.
Amazon Web Services (AWS) offers multiple cloud security services and recommendations to administer security for hybrid cloud pipelines. This article looks at key considerations and challenges of AWS data security in hybrid setups, best practices to address such challenges, and AWS tools and services to implement security controls.
Jump to a specific topic in this post:
Although AWS operates on a shared responsibility model, the platform offers various controls and guidelines for maintaining optimum security and compliance levels. While you get options to select from a broad range of compute, storage, database, and networking options for provisioning a hybrid ecosystem, you can also utilize the platform’s services for hardening security controls of operating systems and applications. In addition, AWS maintains an industry-leading program that includes more than 70 compliance programs, covering a wide range of global regulatory requirements and attestations.
AWS also enforces multiple layers of data protection, including physical security, logical controls, and encryption capabilities. These protections work together to help ensure that customer data is safe from unauthorized access. Still, securing a hybrid cloud requires more than straightforward technical controls.
As a unified platform of different computing environments, the AWS hybrid cloud requires a careful and nuanced approach to data security. Since the hybrid cloud combines both on-premises and off-premises infrastructure, there are additional considerations that must be taken into account.
Access policies
Access policies let hybrid cloud deployment teams specify who can access data and the actions they can perform. Each identity, such as a user, user group, or role should be attached to an access policy with a clearly defined privilege principle to prevent misuse. Some key considerations for implementation of access policies for hybrid setups include:
Data encryption
Data encryption is a proactive threat mitigation technique that maintains integrity and confidentiality in the event data is accidentally exposed. Encryption involves the use of algorithms, encrypted keys, and cryptographic certificates to encode and transform data to avoid excessive exposure. Administering an encryption service should be dependent on the type of storage media (such as storage volumes, object storage, and tape drives), or if the data is in-transit or at-rest. Diligent analysis of choosing the right encryption algorithm, secure key storage, and centralizing the key management system are other key considerations for comprehensive security.
Secure cloud service configurations
When configuring a hybrid cloud environment, it's important to consider how various platforms will interact with each other. For example, if sensitive data is stored on the same platform as less sensitive data, what security controls will be put in place to protect it?
Securing a hybrid architecture requires service configurations that reduce potential cyber threats and vulnerabilities. Organizations can leverage reputed security benchmarks (such as the CIS Benchmarks) or formulate hardening standards from scratch by factoring-in security risks and data sensitivity.
Security updates and patches
Before applying updates and patches in a hybrid environment, it’s important to consider both the business impact, technical feasibility, and potential conflict between security solutions. For example, a critical security vulnerability may require an immediate patch, but if that patch isn’t compatible with the on-premises version of the software, it may not be possible to apply it immediately. In such cases, it might be necessary to implement workarounds until the patch can be applied. It’s also important to have a plan for rolling back changes in case of unforeseen problems with an update or patch.
Observability
In hybrid cloud deployments, observability systems help aggregate, correlate and analyze a steady stream of performance data from on-prem, public and private clouds to troubleshoot issues. Key considerations for monitoring data pipelines in hybrid cloud include:
In addition to the above-mentioned considerations, there are also a few challenges teams face when implementing security in a hybrid cloud model.
Visibility and monitoring
Mixing on-premises, private, AWS, and other public cloud resources raises the complexity of the data pipeline. This makes it difficult for cloud security teams to have a holistic view and control over the various distributed components and systems that can potentially compromise the hybrid deployment. Security blind spots also obscure the appropriate implementation of industry benchmarks that help tackle rising threats and vulnerabilities.
Excessive data exposure
One of the biggest risks with hybrid setups is that sensitive data may be inadvertently exposed due to platform misconfiguration and improper access controls. In typical scenarios, data may be unintentionally synced between on-premises and cloud-based systems, resulting in duplicate copies of sensitive data being stored in both locations. As data flows through hybrid systems, inconsistent implementation of security controls may expose it to eavesdropping and other forms of advanced persistent threats.
Compliance and governance requirements
Deploying data pipelines in hybrid clouds often requires an effort-intensive evaluation of disparate services to inspect whether they comply with regulatory requirements. Each environment requires a distinctly iterative security analysis, resulting in a tedious and error-prone process. Because data may reside on-premises and in both the public and private clouds, it’s often more difficult to maintain.
Additionally, different compliance regulations may have distinct requirements for how data must be stored and accessed. The lack of a standard auditing approach makes it difficult to estimate the data pipeline’s security baseline for compliance and governance requirements.
AWS hybrid cloud security relies on securing multiple levels of the cloud tech stack, which requires cluster administrators to enforce uniform protection measures across susceptible services, resources, and data in different environments. This is a time-consuming, arduous, and may be error-prone process if performed manually. AWS offers various security services and best practices that automate and simplify the administration of security across hybrid cloud deployments. This section discusses the services and best practices for the effective implementation of AWS data security in hybrid environments.
Some AWS services and tools for securing data in hybrid deployments include:
AWS Key Management Service (KMS)
Encryption is one of the most powerful approaches to preventing data misuse by unauthorized individuals. AWS KMS encryption is a fully-managed service that enforces data encryption through cryptographic keys. The service offers centralized storage, auditing, and management of encryption keys across distributed hybrid setups.
KMS also integrates seamlessly with other services for simplified encryption of data at rest or in transit across these services. If you’re managing a hybrid cloud deployment, you can use the AWS CLI or the Encryption SDK to enable the use of KMS to create, rotate, and manage permissions for keys used by services on other clouds.
AWS CloudHSM (Hardware Security Module)
A Cloud Hardware Security Module is a device that performs encryption functions and stores cryptographic keys used to secure data in hybrid cloud pipelines. The service allows security teams to encrypt and decrypt data using both symmetric and asymmetric algorithms. With CloudHSM, DevOps teams can generate, import, store, export, and manage encryption keys. CloudHSM also allows for the generation of cryptographically secure random data for use as tokens, one-time pins, and nonces for secure operations.
Bring-Your-Own-Encryption
The Bring-Your-Own-Encryption key model allows DevOps teams to perform encryption themselves, generate encryption keys, and upload them to the AWS KMS. This allows the software enterprises to meet stringent governance and regulatory requirements needed to run sensitive workloads on a hybrid cloud infrastructure. The security teams can initiate the key import process through the AWS CLI, through the AWS management console, or by making API calls to the KMS service.
AWS Cloud Security Hub
The AWS Cloud Security Hub is a security posture management service that helps enforce observability through automated checks, alerts, and simple threat remediation. With the Security Hub, hybrid setups can be organized, aggregated, and prioritized for security alerts, while obtaining a comprehensive view of your environment and identifying potential vulnerabilities. The hub also offers a pre-built centralized dashboard for easier visualization of threats and automated checks for regulatory compliance.
Standardize data pipeline processes
A data pipeline encompasses various stages in which data traverse different systems. One major consideration for data security is to ensure data pipelines are standardized and secure and that data isn’t lost or corrupted in-transit. It also helps to ensure that all systems of the hybrid setup are using the same data format and apply uniform security controls.
With standard data pipelines and processes, hybrid cloud teams can create a unified platform for the visibility and administration of standardized security protocols. This also helps foster organization-wide collaboration for maintaining a robust security posture through all stages of the data lifecycle.
Enforce consistent encryption
Data in a hybrid cloud pipeline is particularly at risk of exposure since it transits through different systems throughout its lifecycle. One way to address this is to enforce strong encryption of both data in-transit and at-rest for maintaining consistent levels of integrity and confidentiality.
A recommended approach is to consider using centralized encryption services such as AWS Key Management Service or the AWS Hardware Security Module to protect key confidentiality. In addition, file-level encryption and data sharding should be implemented to prevent the reassembling and misuse of application data even when exposed to malicious users.
Utilize backups and disaster recovery for continuity
Adopting the right approach for regular backups and disaster planning is essential to protecting your data in hybrid setups. You may want to consider backing up to both on-premises and cloud-based storage locations or use a combination of snapshotting and replication for added protection.
The backed-up data should also be stored securely. A typical approach is to retain the backup storage offsite to prevent a single point of failure. It's also important to inspect backups regularly to ensure they’re up to date with defined recovery points. In the event of a disaster, you should have a well-rehearsed plan for quickly restoring data to ensure minimal business disruption.
Isolate critical infrastructure/sensitive data
To limit the range of impact in case of a compromise, it’s critical to segment the network and maintain distinct isolation. With isolation, even if attackers gain access to a portion of the data pipeline, it’s easier to identify the compromised service/component, allowing for quicker containment and remediation.
To achieve this, you can use AWS Virtual Private Cloud (VPC) where each VPC is logically isolated from others on the network, essentially safeguarding the traffic from being sniffed or tampered-with by outsiders. The service also helps segment on-prem vs cloud deployments for complete control over traffic flowing in and out of each subsystem.
As organizations continue to move more of their workloads and data to the cloud, they’re increasingly looking for ways to secure and optimize data pipelines. One way to achieve this is by using BlueXP Cloud Volumes ONTAP, which offers enterprise-grade data management features including data protection, security, performance and cost efficiency.
With Cloud Volumes ONTAP, you can:
Cloud Volumes ONTAP also simplifies the process of moving workloads to the cloud. Besides data protection, the platform provides all the benefits of ONTAP storage - including high availability, high performance, scalability, and enhanced ROI, available on AWS, Azure, and Google Cloud, as well as in hybrid and multicloud deployments.
Read more about data security features of Cloud Volumes ONTAP for hybrid setups.
AWS hybrid cloud security is a crucial consideration that operates on a shared responsibility model. With a constantly evolving cloud threat landscape, enterprises need to deploy trusted security services and adopt best practices to secure data pipelines when using a hybrid cloud strategy.
However, there isn’t a one-size-fits-all approach for AWS data security, so it’s important to consider usability patterns, threat levels, and audit requirements before choosing tools and best practices to administer robust security.
Learn more about BlueXP Cloud Volumes ONTAP for your enterprise setup.