Hybrid cloud security requires governance standards
Connecting state and local government leaders
One reason securing hybrid clouds is so complex is the lack of standard tools that work across applications and cloud platforms.
Government agencies’ digital modernization efforts have resulted in more hybrid networks, but also the potential for greater vulnerability because security tooling is fragmented, a new report found.
That’s because there are many endpoint offerings, and a team on the cloud side, for instance, is often responsible for implementing applications in a silo, providing tooling that works only within that silo.
“That sort of makes sense because a lot of times you have, for example, cloud architects that are responsible for migrating an application and they say, ‘Hey, that’s all I have to worry about. I don’t have a bigger-picture security view,’” said Reggie Best, president of Lumeta, a FireMon company. But “you get this hodge-podge. You get something over here in one cloud environment, you get something different in a different cloud provider environment, and you may have some other infrastructure that is operating inside the enterprise. It’s not being all tied together, which I think is going to lead to more even deeper issues.”
Yet only 22% of survey respondents cited in the FireMon 2020 State of the Hybrid Cloud Security Report said they use tools that work across multiple environments to manage hybrid networks, down from 28% in 2019.
The COVID-19 pandemic is unlikely to improve things, Best said, because agencies rushed to implement more infrastructure. The focus was on speed, not security, but eventually security teams will stop to check that everything was configured correctly and in compliance with federal and state regulations.
“I anticipate that there will be a period of time where there’s going to be even more catch-up and where these agencies are going to need to take a step back, understand what’s happened, get their compliance and security arms around some of those changes that have been made, which in many cases may be quite long-lasting,” Best said. “There’s a sense that some of these functions don’t ever 100% come back inside and that [virtual-private network] usage will continue to be very high, for example. I think there’s going to be a driving need to get their arms around that.”
To make it easier for agencies and cloud providers to get that big picture, the Open Networking User Group, comprising tech companies that push for open standards, is planning to propose standards on how cloud companies can communicate security and governance information.
Although he supports standards, Best said they often take a long time to implement and there will always be core differences, such as those between Amazon Web Services and Google Cloud.
“I think that having a level of standardization for the basic stuff will be helpful, but in the end, I think that this is going to be a shared responsibility model,” Best said. Cloud providers will provide capability infrastructure to secure their environment, but agencies need a governance structure that puts someone in charge of overall enterprise security.
“For example, whether I have an application running in the enterprise or in the cloud, I may want a single pane of glass to manage policies and access rules that the application has,” he said. “I may manage them differently in my firewall environment vs. my AWS environment vs. my [Microsoft] Azure environment, but at a higher level, you will want to manage all of that similarly so that someone who has that responsibility can make sure you’re compliant and policies are being met uniformly.”
Other findings from the report include:
- 54% of respondents said the pace of their cloud deployments has surpassed their ability to protect them.
- 77% of respondents said they spend less than 25% of their budget on cloud security, and 7% do not spend of their security budget on cloud.
- 53% of respondents said their security teams have fewer than 10 people, and 33% of those have fewer than five.
- 43% of respondents said they use manual processes even through almost a quarter said misconfigurations are the biggest threat.
Editor's note: This article was changed June 11 to correct one of the other findings from the report to say that 53% of respondents said their security teams have fewer than 10 people, and 33% (rather than 44%) of those have fewer than five.