Cloud security starts with a cloud security architecture. An organization should first understand its current cloud security posture, and then plan the controls and cloud security solutions it will use to prevent and mitigate threats. This planning is critical to secure hyper-complex environments, which may include multiple public clouds, SaaS and PaaS services, on-premise resources, all of which are accessed from both corporate and unsecured personal devices.
In this article, you will learn:
As organizations become more dependent on the cloud, they must also place a bigger focus on security. Most off-network data flows through cloud-based services, yet many of these cloud services are used without any security planning.
The use of cloud service providers and multiple personal devices makes it difficult for companies to view and control data flows. Cloud collaboration bypasses ordinary network control measures. Access to sensitive data on unmanaged personal devices presents a major risk.
Related content: read our guide to cloud security threats.
Security and risk management experts find it difficult to gain visibility over a complex mix of devices, networks and clouds. These network security mosaics, fraught with hidden vulnerabilities, are an invitation for attackers to attempt breaches.
Many cloud service providers do not provide detailed information about their internal environment, and many common internal security controls cannot be directly converted to a public cloud.
For all these reasons, organizations need to think about cloud security as a new challenge, and build a cloud security architecture that will help them adequately secure this complex environment.
The right pattern can help you implement security across your organization. For example, it can help you protect the CIA (confidentiality, integrity, and availability) of your cloud data assets, as well as respond to security threats. You can implement security controls directly, or use security controls as a service offered by your cloud provider or third-party vendors.
The cloud security architecture model is usually expressed in terms of:
Each security control should be clearly defined using the following attributes:
The cloud security architecture model differs depending on the type of cloud service: IaaS (Infrastructure as a Service), PaaS (Platform as a Service), or SaaS (Software as a Service). Below we explain different security considerations for each model.
IaaS provides storage and network resources in the cloud. It relies heavily on APIs to help manage and operate the cloud. However, cloud APIs are often not secure, because they are open and easily accessible from the web.
The cloud service provider (CSP) is responsible for securing the infrastructure and abstraction layer used to access the resources. Your organization's security obligations cover the rest of the layers, mainly containing the business applications.
To better visualize cloud network security issues, deploy a Network Packet Broker (NPB) in an IaaS environment. The NPB sends traffic and data to a Network Performance Management (NPM) system, and to the relevant security tools. In addition, establish logging of events occurring on network endpoints.
IaaS cloud deployments require the following additional security features:
SaaS services provide access to software applications and data through a browser. The specific terms of security responsibility may vary between services, and are sometimes up for negotiation with the service provider.
Cloud Access Security Brokers (CASB) offers logging, auditing, access control and encryption capabilities that can be critical when investigating security issues in a SaaS product. In addition, make sure your SaaS environment has:
PaaS platforms enable organizations to build applications without the overhead and complexity associated with managing hardware and back-end software. In a PaaS model, the CSP protects most of the environment. However, the company is still responsible for the security of the applications it is developing.
Therefore, a PaaS security architecture is similar to a SaaS model. Ensure you have CASP, logging and alerting, IP restrictions and an API gateway to ensure secure internal and external access to your application’s APIs.
NetApp Cloud Insights is an infrastructure monitoring tool that gives you visibility into your complete infrastructure. With Cloud Insights, you can monitor, troubleshoot and optimize all your resources including your public clouds and your private data centers.
Cloud Insights helps you find problems fast before they impact your business. Optimize usage so you can defer spend, do more with your limited budgets, improve security and detect ransomware attacks through better visibility, and easily report on data access for security compliance auditing.
In particular, NetApp Cloud Insights helps you discover your entire hybrid infrastructure, from the public cloud to the data center.
Schedule time to speak with a specialist about how NetApp Cloud Insights can help your organization. Learn how you can better optimize your IT Infrastructure with NetApp Cloud Insights here.
Read next: