There is a common misconception that cloud access security brokers are all that’s needed to make cloud computing secure. Sitting between cloud services users and cloud applications, a CASB is certainly an important part of cloud security, but it is only one piece of a necessary holistic framework, particularly for a zero-trust architecture. As agencies increase their cloud adoption, they will achieve far greater security if they adopt the same kind of approach for the cloud as for do for their on-premises IT environment. Understanding how the following four pillars work together to create the foundational support for robust cloud security is vital to successful outcomes for federal agencies moving to the cloud.

1. Visibility and compliance

One of the key constructs of zero-trust computing is continuous improvement. An effective cloud security solution should enable ongoing insight into the entire cloud environment, thereby creating the opportunity for ongoing improvement. That involves several steps:

• Asset inventory. Every agency needs an overarching inventory of what it has in the cloud: servers, cloud provider services, users and cloud tools like load balancers. This is especially important when using multicloud solutions from different providers. A centralized inventory of all cloud-based assets streamlines management overhead, but it’s complex and manually intensive to develop and maintain. The best security solution would automate the entire inventory process.
• Most agencies will follow one or several available security frameworks (such as those from the National Institute of Standards and Technology,ISO 27001, or others) that detail what a secure cloud environment looks like. Using these frameworks for assessment helps determine what controls are needed to secure data and endpoints. While helpful, these tools can be complex or confusing for IT professionals who are not deep security experts. It helps to have a cloud security solution that automates framework implementation and provides continual reporting and remediation controls. Additionally, while compliance is no substitute for security, many government organizations require it, so auditing controls should be included as well.
• Data security. An effective security solution will accurately label its data and its level of sensitivity. It should also provide controls that stipulate where specific data types can reside, such as in a software-as-a-service application or cloud-provider storage, whether or not data is publicly exposed and who may access it. CASB tools enable role-based data access, bringing that layer of protection down to the data level itself.

2. Compute-based security

The second pillar involves providing security for end systems, managed services or different workloads running inside the cloud – commonly called platform as a service. This compute-level security has two key components. First is automated vulnerability management, which identifies and prevents vulnerabilities across the entire application lifecycle while prioritizing risk for cloud-native environments.

The other key component is ongoing operational security, involving anything considered to be a compute engine or compute workload. Effective cloud security requires inspecting activity automatically and continuously to detect any anomalous or malicious activity.

3. Network protections

Protecting the network is traditionally integral to on-premises environments but is equally important for the cloud. There are two major components of network protections. One is microsegmentation, a method of creating zones to isolate workloads from one another and secure them individually. This is at the heart of zero trust. By putting up roadblocks between applications and workloads, microsegmentation makes it much more difficult for would-be attackers to move laterally from one infected host to another. The method employs containerization (of the app and its operating environment) and segmenting the application itself in order to minimize any damage.

For example, an organization may have multiple applications running in one cloud environment, some of which support a civilian workforce and others that support sensitive or even classified information. Since the two application types cannot be mixed together, microsegmentation can keep them at different classification levels, ensuring no overlap.

The other critical component of network protection applies to the live “inline” flow of traffic. Rather than providing a border around the cloud, such as with a traditional on-premises environment, network protection extends the border down to the user level. A cloud security solution should allow authorized users to securely access cloud-based data they need while providing threat visibility into what activities they are performing.

4. Identity security

The fourth pillar involves mapping user and machine identities to what they are authorized to actually do on the network. A cloud security solution should ensure that users are only able to access the applications they need at the level they need to perform their jobs while ensuring the machines can only communicate with other machines needed to accomplish their application. Akin to microsegmentation, identity security is another integral component of zero trust.

These four pillars are the foundational requirements for comprehensive cloud security. It’s a multi-layered approach that cannot be satisfied by a single technology, CASB or other solution. During this unpredictable time of remote work, as agencies are increase cloud adoption, shift IT practices, while continuing to face persistent cyber adversaries, implementing a holistic framework that includes each pillar is key for greater cloud security and achieving a zero-trust network.