Categories: Cloud

Securing the Hybrid Cloud: Data breaches, ransomware, phishing and more

As businesses continue to embrace the power and flexibility of the hybrid cloud, ensuring these networks are secure is paramount.

Used to securing siloed data, and managing secure logins for applications, CTOs and their teams have had to embrace a brave new world where applications and the sensitive data they often use can be outside of their enterprise’s firewalls.

The hybrid cloud doesn’t necessarily bring with it a new set of security issues that need to be mitigated and defended against. Data breaches, ransomware, phishing attacks and BEC scams are a present danger to traditional networks. Moving to a cloud environment may potentially amplify the attacks, but it’s a mistake to think that the hybrid cloud necessarily brings new threats.

Also, enterprises often believe that once a hybrid cloud is set-up, the responsibility for its security shifts to the vendor or service provider. Research contained in the report ‘Cloud and hybrid environments: The state of security from Algose concluded 58% of respondents use the cloud provider’s native security controls to secure their cloud deployments while 44% said they also use third-party firewalls deployed in their cloud environment.

These included Cisco Adaptive Security Virtual Appliance, Palo Alto Networks VM Series, Check Point vSEC, Fortinet FortiGate-VM and Juniper vSRX, thereby creating a mixed estate of traditional and virtualized firewalls, and cloud security controls.

The reality is that a close partnership with cloud services vendors must be developed to ensure network-wide security is maintained. Often, this will mean a symbiotic relationship developing that ensures your business understands which components of the hybrid cloud security you must maintain.

Dave Klein, Senior Director of engineering and architecture at GuardiCore, told Silicon: “In essence, every established enterprise has to contend with bare metal, hypervisors, premises, clouds, containers and serverless. They all have critical applications running on legacy operating systems – some end of life.  Traditional segmentation techniques like VLANs, ACLs and firewalls aren’t working well since they are static and only work within portions of their environments.”

Securing sensitive data is, of course, a core component of any comprehensive security policy. It’s interesting that in the wake of GDPR, security in a hybrid cloud environment has had to become more comprehensive.

Tim Mackey, Principal Security Strategist at the Synopsys CyRC, explained: “The role of general-purpose privacy regulations like GDPR introduces complexities into any digital transformation effort. While industry regulations like HIPAA or PCI deal with a class of data inherent to a business’s core operations, GDPR deals with the residency of current and prospective customers to a business and then applies data governance rules to the interaction.

Mackey concluded: “If a hybrid cloud strategy is being considered to address the requirements of GDPR, then the overall privacy landscape should be reviewed as part of the initiative. For example, while it may be desirable to host data on EU residents on cloud infrastructure within the EEA, the application must be able to recognize that EU residents may travel outside of the EEA and that while outside of the EEA, their data privacy rights remain the same as if they were accessing the web site from their home.”

Securing the hybrid cloud needs, therefore, a multifaceted and comprehensive approach that simultaneously delivers strong general perimeter security and more focused data or application-based security protocols.

NEXT: Managing Risk

Page: 1 2 3 4

David Howell

Dave Howell is a freelance journalist and writer. His work has appeared across the national press and in industry-leading magazines and websites. He specialises in technology and business. Read more about Dave on his website: Nexus Publishing.

Recent Posts

CMA Competition Probe Into Music Streaming Market

British competition watchdog announces investigation into music streaming market, and issues recommendations for anti-virus industry

2 hours ago

Qubits Are Coming: Your Quantum Computing Future

As investment in the development of practical quantum computers and with key breakthroughs in this…

4 hours ago

Hacker Steals Government Database Of All Argentine Citizens

Argentine government database containing ID card data of all citizens has been stolen by a…

4 hours ago

Dorsey: Square May Develop Bitcoin Mining Hardware

Square chief executive Jack Dorsey says fintech company looking into custom-built Bitcoin mining hardware that…

1 day ago

Twitch Warns Over Source Code Breach

Gameplay streaming service Twitch says massive breach earlier this month mainly affected confidential source code,…

1 day ago