Tips and Best Practices for Securing your Cloud Initiative

Since every environment is unique, very careful consideration must be given to how the corporate workloads are to be delivered to the end-user. By designing a solution from the start which embraces security, an infrastructure will already be one step ahead in their cloud initiative. Taking a secure approach from the initial phase creates a solid foundation for entering into the cloud. By starting with security first, compliance conscious organizations are able to deploy both a resilient and audit-ready environment.

Your partner’s ability to protect sensitive cloud-based data will be crucial. There are many cloud providers to choose from. Some will offer private cloud solutions, while others will offer a combination of a pubic/hybrid cloud deployment. When evaluating a partner that will be set to deliver corporate IT services via the cloud, make sure that partner has a foundation and heritage in both IT and security services. Verify that cloud-ready risk mitigation is part of the provider’s common security practice. Evaluate a partner that has proven experience integrating IT, security, network services, as well as providing robust and strategic service-performance assurances.

Every enterprise environment will likely have some sort of identity management system. This is to control user access to corporate data and computing resources. When looking to move to the cloud, identity management quickly becomes a security concern. One of the last things an IT administrator would want is a user who is forced to remember several sets of credentials. Cloud providers must either integrate the customer’s identity management system into their own infrastructure, using identity federation or single sign-on technology, or provide an identity management solution of their own. Without that, some environments have seen what is known as identity pools, where users have multiple sets of authoritative credentials they must use to access common workloads.

For an IT organization to be considered protected, data from one end-user must be properly segmented from that of another. That means that “data at rest” must be stored securely and “data in motion” must be able to securely move from one location to another without interruption. Good cloud partners have solutions like this in place to prevent data leaks or access by unauthorized third parties. As such, it’s important to clearly define roles and responsibilities to ensure that auditing, monitoring and testing cannot be circumvented even by privileged users unless otherwise authorized.

Just like information within a data center – data in the cloud must be continuously monitored. If an IT manager needs live data to be pulled from a cloud environment, they must leverage an active monitoring solution. Performance bottlenecks, system instabilities or other issues must be caught proactively to avoid any outages in services. Failure to constantly monitor the health of a cloud environment will result in poor performance, possible data leaks and, sometimes worst of all, an angry end-user. Organizations which are ready for the cloud must plan accordingly as to the monitoring and intervals required based on their data content. From there, it’s advised they implement manual or automated procedures to respond to related events that may occur in their cloud environment.

Whether deploying your own private cloud or using a cloud-ready partner, always make sure to test and regularly maintain your environment. When looking at a service provider, make sure they offer a solid Service Level Agreement (SLA) that should include metrics like: availability, notification of a breach, outage notification, service restoration, average time to resolve, and so on. Both in a provider relationship and in a private cloud solution, regular proactive testing should occur. By keeping an environment healthy and tested, we remove quite a bit of risk associated with security or inadvertent data leaks.