How to catch security blind spots during a cloud migration

Providing employees and contractors with frictionless access to data while also safeguarding sensitive information is one of the greatest IT challenges of our time -- especially during the cloud migration process.  Although security was once considered one of cloud’s weaknesses, particularly by government agencies that maintained near-total control over their data, today many organizations view cloud security more favorably. IT managers who trust the public cloud now outnumber those who don’t by a ratio of 2-to-1, according to a recent Intel security report.

Still, security blind spots remain in the form of cloud services used with and without explicit agency approval. Gartner states that by 2020, one-third of successful attacks experienced by enterprises will be on their shadow IT resources, making shadow IT a significant and growing problem for agency IT managers.

Here are three tactics agencies can use to mitigate those risks:

1. Discover: Shadow IT can often exceed 35 percent of an agency’s total cloud usage, so it is important to have a complete picture of all agency cloud accounts and their potential risks. This includes active services, such as home-grown web applications, but also dormant (inactive current employees), orphaned (ex-employees) and external (contractors) accounts. Even sanctioned cloud usage can be misreported or get lost in a cloud migration or in the course of day to day operations.

It’s important to know what data is stored in cloud or file-sync services like OneDrive and Box, classify that data properly and set security policies accordingly. Proper auditing entails monitoring files, content and usage in real time to ensure that sensitive data and personally identifiable information covered by laws and regulations stay protected.

Proper cloud discovery entails understanding how, when, where and through what devices people are accessing cloud accounts. This helps agencies ascertain who their riskiest cloud users are and what risks -- from brute-force attacks to account hijackings -- they are susceptible to.

2. Govern: Benchmarking an agency’s cloud application security configurations against industry best practices and standards allows IT managers to pinpoint security and compliance gaps and take action to close them. The National Institute of Standards and Technology and the Cloud Security Alliance have both issued fantastic best practices.

Agencies that follow such best practices are always better off than those that do not. In addition to ensuring  security policies meet expert recommendations, agencies should actually hold themselves accountable to those best practices through internal key performance indicators. Instilling a culture of security from the beginning is much easier and more effective than attempting to enforce one later.

3. Protect: Agencies should establish controls to protect data at rest and in transit, monitor administrators and users and protect against external cyber threats. To balance risk and access, agencies should create detailed behavioral profiles based on the normal usage patterns for each user, department and device. Any access that deviates from the normal profile can trigger an alert, block the user or require two-factor authentication, among other custom policies.

Behavioral profiles account for variation between employees. Individuals can be assigned risk scores, which can change over time with new roles and responsibilities. As a person’s risk score changes, so will security measures.  By leveraging automation, this far more targeted and effective method focuses on user behaviors, systems and processes to better protect the organization. 

There are a number of other steps agencies can take to bolster their cloud security efforts. They can set up automated alerts when indications show that information may have been compromised, quarantine or remove sensitive files from the cloud or take a hybrid-cloud approach that keeps some data on-premises and other information with the hosted service provider.

In any case, protection should be standardized and take place in real time. However, having several different products for data loss prevention, with no uniform capabilities or information, can be counter productive. Instead, transparency and standardization should be applied to how audits take place and how data is used. While application programming interface security can be easier to integrate, it can come with up to 30-minute delays for updates from the cloud application provider. A tremendous amount of data can be stolen in that time.

The cloud dissolves traditional perimeters and increases business velocity by removing the friction caused by legacy systems, but it also requires ever-tighter security. As agencies roll out “cloud first” policies, they must follow proper discovery, governance and protection practices to expose security blind spots and safeguard agency personnel and data.