Gartner states that security continues to be the biggest inhibitor of cloud adoption. This is not a surprise because cloud services are shared, always connected and dynamic environments by nature, making them a challenge when it comes to security.
On-premises IT security controls do not touch the cloud, leaving customer data at risk from the same types of threats targeting assets and applications in corporate data centres. What’s more, malware introduced into the cloud can easily propagate among VMs, attack virtual segments or even ride unimpeded over VPN links back to corporate networks.
Public cloud networks are built upon a unified, multi-tenant platform using a shared infrastructure to support millions of simultaneous customers. Foundational to public cloud environments are enhanced security, operational management and threat mitigation practices that protect the infrastructure, cloud fabric, hypervisors, services and tenant environments.
While public cloud providers deliver strong security controls to protect the cloud fabric, they have no knowledge of “normal” customer traffic and thus are unable to determine malicious content from benign. This presents a big challenge to security administrators to provide the same security protections against the latest fifth generation (GenV) cyber-attacks targeting the cloud as they do on-premises. A defence-in-depth strategy for the cloud should also include protecting all workloads and data from exploits, malware and other sophisticated attacks.
These emerging technology trends, with their increased agility, flexibility and efficiency, also give rise to new security challenges:
The static security policy: The private cloud is a dynamic environment. New applications are instantly deployed, the environment scales up and down and applications move around the data centre. Security services must keep pace with these rapid changes and consider elastic scaling. This requires automation, otherwise security will either be neglected or become a bottleneck in the process of provisioning applications.
Internal traffic visibility: Private clouds and their mobile workloads mean a shift in data traffic growth inside the virtualised data centre. In addition to protecting traffic inside and outside of the data centre, virtualised networks’ security must also be able to inspect and enforce security policies for traffic moving inside the data centre.
Limits of traditional segmentation: Traditionally, security segments have been tightly coupled with the physical network topology. This resulted in exceedingly manual, process-intensive networking configurations. However, deploying security within virtualised environments means these physical boundaries are now logical and automated, adversely impacting static network security processes, contributing to operational overhead and impacting network agility.
Advanced threats: Sophisticated, fifth generation (GenV) cyber-attacks target the weakest systems on the network. They obtain control of the infected machine using a Command and Control (C&C) server and then move from virtual machine (VM-to-VM) to steal valuable data without ever being detected. The threats are no longer just at the network perimeter and so advanced protection is also needed to minimise and mitigate post-breach propagation within the data centre.
It is essential for security to overcome the challenges outlined above and integrate with SDN architectures, network virtualisation and orchestration platforms. The solution must be built on five key principles: