5 Tips for Building a Cloud Security Architecture

With organizations increasingly shifting data and applications to the cloud, the security architecture is becoming critical in ensuring workloads are secure. A cloud security architecture is a framework that defines how an organization approaches cloud security for each cloud model it operates and what solutions and technologies it intends to use to create a secure environment.

Cloud security best practices should be a starting point for a cloud security architecture. Possible sources for standards are documents published by cloud providers, compliance standards by organizations like the National Institute of Standards and Technology (NIST), or security research organizations like the Center for Internet Security (CIS).

A cloud security architecture must also take into account the shared responsibility between your organization and the infrastructure as a service (IaaS) provider, specifying how the organization should perform its role in securing data and workloads on the cloud provider’s platform.

Cloud Security Challenges

Cloud security presents unique challenges for organizations. Here are some of the major challenges you should consider as you design your cloud security architecture:

Tips for Building Your Cloud Security Architecture

Here are a few tips that will help you build a solid cloud security architecture.

1) Conduct Due Diligence

Before migrating to a cloud provider or expanding a cloud deployment to additional cloud providers, organizations should carefully investigate the security and resilience properties of the cloud provider as a whole and specific services they intend to use.

The due diligence process should include:

2) Determine Which Data is the Most Sensitive

For most organizations, it is not feasible to apply stringent security measures for all data. Some data can remain unsecured, but you must determine which data categories must be protected to prevent breaches and compliance violations. It is critical to understand what you need to protect, using data detection and classification.

This is commonly achieved using automated data classification engines. These tools are designed to find sensitive content across networks, endpoints, databases, and the cloud, allowing organizations to identify sensitive data and establish the necessary security controls.

3) Bring Employee Cloud Usage Out of the Shadows

Just because you have a corporate cloud security strategy does not mean employees will comply with it. Employees rarely consult with the IT department before using common cloud services such as Dropbox or web-based email.

An organization's web proxy, firewall, and SIEM logs are good resources for measuring the shadow use of the cloud by employees. These can provide a comprehensive view of which services are being used and by which employees. When discovering shadow cloud usage, you can assess a service’s added value against the risks it poses. You can choose to “legalize” shadow cloud services or crack down and take measures to disallow them.

Another aspect of shadow usage is access to legitimate cloud resources from untrusted endpoint devices. Because any device connected to the internet can conceivably access any cloud service, personal mobile devices can create a gap in your security strategy. To prevent data from escaping from a trusted cloud service to an unmanaged device, require device security verification before enabling access.

4) Protect Cloud Endpoints

Many organizations are deploying endpoint protection platforms with multi-layered protection, including endpoint detection and response (EDR), next-generation anti-virus (NGAV), and user and entity behavior analysis (UEBA).

Endpoint protection is even more important in the cloud. In the cloud, endpoints are compute instances, storage volumes and buckets, and managed services such as Amazon RDS.

Cloud deployments have a large number of endpoints, which change much more frequently than on-premises, and thus require a higher level of visibility. Endpoint protection tools can help organizations get control of their cloud workloads and protect the weakest links in their security posture.

5) Understand Your Part in Compliance Obligations

Remember that regulatory compliance is—at the end of the day—your organization’s sole responsibility. No matter how many business functions you shift to the cloud, it is up to you to select a cloud architecture platform that helps you comply with all the regulatory standards applicable to your industry, whether it is PCI DSS, GDPR, HIPAA, CCPA, or any other standards or regulation.

Understand the tools and services offered by your cloud provider to ensure compliance and which third-party tools you can use to create cloud systems that are compliant and can be proved to be compliant via auditing.

Conclusion

Building a cloud security architecture is no easy task. You need to address your organization's security policies, relevant compliance standards, and security best practices for your cloud environment while contending with the high complexity and dynamic nature of cloud infrastructure. We provided five tips that can make your cloud security architecture a success:

I hope this will be helpful as you construct a robust, effective cloud security strategy for your organization.