Cloud security should be a business driver, not a barrier

Migration to the cloud has become a top priority for businesses due to the benefits it delivers in terms of agility, resilience and cost-effectiveness. As a result, global spending on public cloud services is expected to top $480 billion this year.

But at what cost? IT environments have become increasingly complex, especially as firms adopt multi-cloud strategies and hybrid approaches that mix cloud and on-premises infrastructure. This added complexity has increased the burden on IT teams tasked with managing the digital environment and keeping track of connections and permissions.

More critically, it has heightened their risk exposure. Complex and obtuse cloud environments present an ideal opportunity for cyber criminals, affording them with overlooked attack paths that enable them to infiltrate networks and access critical assets undetected.

Organisations must be able to secure their cloud environments against these threats or fall victim to catastrophic data breaches. But security cannot come at the cost of the cloud’s prized agility. To truly succeed, cloud security must be a driver for business growth, not a barrier.

Why have IT environments become more complex?

Several factors have conspired to make IT infrastructure more complex and accordingly harder to manage and secure.

One issue is the sheer number of devices involved. Most business now have expansive IT estates comprised of on-prem and cloud systems, individual endpoints and smart devices and any number of third-party SaaS solutions connected to their network.

Remote working has escalated this issue as many employees now work outside the protection of location-based defences such as secure routers. A remote workforce is also more isolated and easily exploited by phishing attacks. It is often easier for attackers to exploit stolen credentials for staff outside the office if the organisation doesn’t have effective authorisation measures in place.

A growing number of business sectors have also invested heavily in IoT, which can add hundreds of thousands of interconnected devices to the count through assets like smart sensors used in industrial settings.

This results in a huge attack surface for threat actors to exploit. Hybrid environments are particularly prone to redundancies and blind spots, where cloud and on-prem systems overlap. Unless the organisation has effective visibility over the entire extended IT estate and strong policies to control access, a single weak point can be enough to let attackers into the network.

Automation is the key

If cloud security is to be a business driver and not a barrier, it needs to keep pace with the agility that is so important to cloud strategies. Automation is critical to achieving this.

Most businesses will already be utilising some degree of automation, particularly those that are further along their digital journeys. However, these automated processes often tend to be operating separately, rather than as a single integrated solution. Even if some individual elements are automated, the need for manual implementation can drastically slow down key activities like DevOps and change management.

This is especially dangerous when it comes to implementing security policy changes. Taking weeks to manually implement new security policies to accommodate new processes and endpoints is not only inefficient, it creates a larger window for threat actors to strike.

Bringing more processes together under a single point of control establishes a greater degree of visibility over the network. This assists with both urgent activities such as auditing logs in the aftermath of a security incident and more long-term strategic decisions that shape security policies.

The importance of a unified approach

Implementing strong security policies is one of the most important priorities for keeping the cloud secure. These polices are critical for governing how users and systems can connect with each other across the entire network. However, many organisations still rely on a manual, fragmented approach to implementing security policies, with each set being implemented and managed separately. This is both highly inefficient and a poor fit for the fluid, dynamic nature of the modern cloud environment.

To effectively keep the organisation secure, security policies need to be unified with a single set of security policy guardrails. This approach means that all connection requests are automatically detected, assessed and validated or rejected according to the policies in place. Accordingly, legitimate user and system connections are handled with no impact to business agility or productivity, while malicious or unauthorised attempts are blocked. This both protects the network from threat actors attempting to exploit the complex environment and frees up IT and security teams from manually managing policies.

With effective visibility across the network and automated policy implementation and management, IT teams can concentrate more on high-value activities like security audits and threat monitoring, allowing organisations to pursue agility while staying secure.

By Nick Lowe, VP EMEA at Tufin

For more information, visit: www.tufin.com