Multi cloud strategy has become very important for organizations to spread its workloads across various cloud platforms such AWS, Azure and GCP and their own private clouds. It helps organizations to better manage their costs, give better flexibility than living with a single cloud platform, achieve improved resiliency and bypass vendor lock in.
In spite of having all these advantages multi cloud deployments are highly complex and it inflates attack surfaces, cyber attack risks and brings up different security concerns. A holistic approach is required to address disparate security vulnerabilities and build dependable security controls in a multi cloud environment.
Key Security Considerations
While architecting a multi cloud environment below considerations will help to secure your environment and workloads.
- Authentication and Authorization : In a multi cloud environment, various authentication models of different hyper scalers need to be supported and at the same time user should be able to manage their accounts, roles and policies in a centralized way. A suitable framework need to be identified for this. Decoupling of authentication and authorization from any specific cloud provider is also important.
- Upgrades and Patching : Even though same infrastructure type or workload is used across different cloud providers, its associated vulnerabilities and remediation may vary for different cloud providers. Software upgrades or patches can be automated. While doing so we must ensure that upgrades are susceptible to infrastructure, workloads and their dependencies.
- Component Hardening : Best security practices need to be followed for application and infra components. Such hardening incudes closure of unsecure ports, uninstalling unwanted software, protecting APIs and interfaces and following least privilege principle for user and service access.
- Monitoring and Visibility : Most of the cloud providers offers basic security tools and user can rely on it if they use a single cloud. When it comes to multi cloud you must find a tool that supports different clouds and provides visibility over the whole environment. Such a holistic view is a requisite for identifying, investigating and responding to threats.
- Multi Cloud Storage : Data need to be classified and sensitive data must be stored to most secure storage services. DLP (Data Loss Prevention) solutions need to be implemented to recognize data loss/exfiltration across multi cloud.
Best Practices To Improve Multi Cloud Security
- Ensure that you implement same security settings across all clouds. Use automated tools to create and apply security policies using generic definitions that can synchronize policies and settings across multiple clouds.
- Create security profile and suitable security policies for each workload or application running on multi cloud. Policies should be tailor made for intended use of the workload.
- Automate security and embrace a DevSecOps mentality for all processes occurring in multi cloud infrastructure. Consider security and implement adequate security practices for all processes.
- Logs, alerts and events from all clouds must be consolidated into one place for monitoring. Remediation on any cloud needs to be automated based on various alerts. No human intervention should be required.
- Compliance certifications and features are specific to each cloud platform. Users might be running their services with different compliance obligations. So an automated platform is required to do a compliance audit across multiple clouds and provide reports on violations and remediation.
Final Thoughts
When multi cloud approaches are considered, security can no longer be considered as a second thought or an independent concept. It should be developed along with multi cloud strategy itself to fine tune an organizations cloud setup.
