There is a common misconception that cloud access security brokers are all that’s needed to make cloud computing secure. Sitting between cloud services users and cloud applications, a CASB is certainly an important part of cloud security, but it is only one piece of a necessary holistic framework, particularly for a zero-trust architecture. As agencies increase their cloud adoption, they will achieve far greater security if they adopt the same kind of approach for the cloud as for do for their on-premises IT environment. Understanding how the following four pillars work together to create the foundational support for robust cloud security is vital to successful outcomes for federal agencies moving to the cloud.
One of the key constructs of zero-trust computing is continuous improvement. An effective cloud security solution should enable ongoing insight into the entire cloud environment, thereby creating the opportunity for ongoing improvement. That involves several steps:
The second pillar involves providing security for end systems, managed services or different workloads running inside the cloud – commonly called platform as a service. This compute-level security has two key components. First is automated vulnerability management, which identifies and prevents vulnerabilities across the entire application lifecycle while prioritizing risk for cloud-native environments.
The other key component is ongoing operational security, involving anything considered to be a compute engine or compute workload. Effective cloud security requires inspecting activity automatically and continuously to detect any anomalous or malicious activity.
Protecting the network is traditionally integral to on-premises environments but is equally important for the cloud. There are two major components of network protections. One is microsegmentation, a method of creating zones to isolate workloads from one another and secure them individually. This is at the heart of zero trust. By putting up roadblocks between applications and workloads, microsegmentation makes it much more difficult for would-be attackers to move laterally from one infected host to another. The method employs containerization (of the app and its operating environment) and segmenting the application itself in order to minimize any damage.
For example, an organization may have multiple applications running in one cloud environment, some of which support a civilian workforce and others that support sensitive or even classified information. Since the two application types cannot be mixed together, microsegmentation can keep them at different classification levels, ensuring no overlap.
The other critical component of network protection applies to the live “inline” flow of traffic. Rather than providing a border around the cloud, such as with a traditional on-premises environment, network protection extends the border down to the user level. A cloud security solution should allow authorized users to securely access cloud-based data they need while providing threat visibility into what activities they are performing.
The fourth pillar involves mapping user and machine identities to what they are authorized to actually do on the network. A cloud security solution should ensure that users are only able to access the applications they need at the level they need to perform their jobs while ensuring the machines can only communicate with other machines needed to accomplish their application. Akin to microsegmentation, identity security is another integral component of zero trust.
These four pillars are the foundational requirements for comprehensive cloud security. It’s a multi-layered approach that cannot be satisfied by a single technology, CASB or other solution. During this unpredictable time of remote work, as agencies are increase cloud adoption, shift IT practices, while continuing to face persistent cyber adversaries, implementing a holistic framework that includes each pillar is key for greater cloud security and achieving a zero-trust network.