Cloud Hosting

Multi-cloud environments are rapidly becoming a common deployment model for many organizations. From a security standpoint, however, they introduce added complexity.

A main source of this complexity is the expansion of both the threat surface and of the skills and knowledge needed to handle the various tools, services, software objects and security policies of each cloud service provider (CSP). Due to this, organizations contend with the following main multi-cloud security challenges:

Let's dig deeper into each challenge and then look at the best practices to help solve them.

Alongside existing challenges for cloud security, an organization's security team needs to consider the following multi-cloud security challenges.

Configuration management is one of the most common issues organizations face and given the velocity of changes and updates in cloud environments, it's one that recurs.

The range and complexity of the services and objects available in a single-cloud environment can lead to misconfiguration. That range and complexity only compounds with each additional cloud in multi-cloud deployments.

Common configuration issues -- such as using outdated server and container components and images, accidentally exposing storage nodes to the internet, or improperly implementing and aligning identity and access management policies -- can result in security vulnerabilities and possible exposure in the cloud.

Logging and monitoring are relatively straightforward in leading IaaS and PaaS clouds, but many organizations struggle with the volume of cloud-related events generated. This becomes even more difficult when multiple clouds are involved.

Many organizations also often don't understand how to coordinate and contextualize playbooks for monitoring and alerting across different service environments, which leads to further complexity.

Incident detection and response are often a struggle for organizations with multi-cloud deployments. They require preparation of forensic and response tools and services ahead of time in each cloud, as well as specific workflows and playbooks that cover all cloud environments. Workflows and playbooks can become more complicated if hybrid cloud architectures are in use. Further, incident responders often lack the appropriate skills to respond to incidents in each specific cloud environment.

Meeting compliance and regulatory requirements across a diverse set of cloud environments can be difficult, depending on an organization's industry. Most larger cloud providers have SOC, ISO and other compliance-specific reports available to attest to the state of controls and processes on their side of the shared responsibility model. Customer controls status and reporting, however, still need to be collected and aggregated.

The following industry best practices and security tools and processes can help organizations meet multi-cloud security challenges head-on:

Dave Shackleford is founder and principal consultant with Voodoo Security; SANS analyst, instructor and course author; and GIAC technical director.

Read more:
Multi-cloud security challenges and best practices - TechTarget