Cloud Security – Understanding the Shared Responsibility Model
One of the most significant hurdles to cloud adoption has always been the issue of security. When they are unable to physically “see” security in action, many CTOs are (understandably) suspicious. And the enormous potential penalties for security breaches under GDPR make decision-makers even more nervous.
Under GDPR, your business has ultimate responsibility for protecting personal data – even when that information is held in the cloud. But how do you discharge that responsibility when you have no control over the service provider’s security infrastructure?
Introducing shared responsibility
Before going any further, it is vitally important to understand that there is a delineation of responsibility for security in the cloud. A service provider is not, as some assume, responsible for securing everything hosted in their data centres. In reality they are only obliged to secure the infrastructure layer.
Applications and data will always remain the responsibility of you – the service user.
Shared responsibility is an understanding of where these boundaries lie, and how both parties work together to ensure the integrity and protection of data at every layer.
Cloud security doesn’t have to be in-house
Securing data in the cloud requires a slightly different skill set to traditional on-premises data centre disciplines. Some businesses may be tempted to deploy DIY security tools to help keep costs low as they ‘plug the gap’.
Such an approach is extremely cost-effective in the short term, but may actually be storing up problems for the future. Without knowledge and experience of securing the cloud, you will be unable to accurately assess and mitigate all potential risks.
DIY tools will only protect for so long – eventually you will need to augment your engineering team to acquire cloud security skills too. But there is an effective alternative; partnering with a managed security partner (like Navisite) provides access to skilled engineers who can manage security provisions for your cloud assets.
Building a coordinated security response with an SOC
Due to the hybrid nature of the modern operating environment, you will have to change the way you approach security however. Here at Navisite we would normally recommend setting up a security operations centre (SOC) that coordinates responses to detected security issues around the clock.
The SOC is of increased importance when blending teams, helping to ensure issues are passed to the right team, and reducing duplicated work troubleshooting and fixing problems. By defining response frameworks to underpin your SOC, you can increase the speed with which security breaches/compromises are detected and resolved, narrowing the window of opportunity (also known as ‘dwell time’) for cybercriminals to steal or damage digital assets.
Putting it all together
As you split data and applications between on-premises and the cloud, your entire approach to security will need to change; this also depends on whether you opt for private, public or hybrid cloud. You can generally rely on your hosted service provider to take care of their cloud infrastructure and perimeter security for instance, but you remain responsible for various other elements of data security.
Unless you have a limitless IT budget, you will need to build a best-of-breed security team that combines your own in-house resources with a third party managed security services provider. And the use of a security operations center will help to create a consistent, secure approach to protecting data and systems at all of your locations.
Click here to learn more about security in the age of the decentralized network – and how you can better protect your resources in the cloud. Get in touch with us today or call us at (888) 298-8222 for more information