Author: Ivan Shyshkou

Introduction

The advent of cloud computing has ushered in a new era of technological advancement, reshaping the way organizations approach data management and information technology. With cloud technologies becoming increasingly pervasive, their adoption has transcended geographical boundaries, offering businesses a versatile and scalable framework for their operations. In the era of widespread integration, when cloud technologies have become a cornerstone of digital transformation, the imperative for robust security measures has never been more evident.

Current prevalence of cloud technologies is substantiated by persuasive statistics on adoption rates. Recent studies indicate that over 80% of businesses actively use cloud services, showcasing a transformative shift in the digital landscape. Companies predominantly store employee data (44%) and customer data (44%) using cloud storage solutions, and about 80% of companies adopt a hybrid approach incorporating both public and private clouds.

Cloud services offer a number of benefits, including on-demand access to computing resources, rapid deployment of applications, and reduced infrastructure maintenance costs. However, cloud security remains a paramount concern for many businesses, as it involves entrusting sensitive data and valuable applications to a third-party provider. The present article deals with the complexities of cloud security exploring common vulnerabilities, effective strategies, and best practices to maintain a secure cloud infrastructure stemming from the extensive experience and IBA findings in the domain of cloud security.

Key Cloud Security Challenges

As organizations embark on the transformative journey of adopting cloud technologies, the spotlight on security becomes more intense. Seamless integration of cloud solutions demands meticulous attention to safeguarding digital assets and sensitive information. Apart from the promises of efficiency and innovation, firm commitment to addressing key cloud security challenges becomes imperative. Below follow some of the most common security challenges.

Misconfiguration. Misconfigurations stemming from human error or lack of comprehension have the potential to make cloud resources vulnerable to security threats caused by, for instance, the use of default accounts and passwords, the deactivation of monitoring and logging features, insecure automated backups, and unrestricted access to non-HTTPS/HTTP ports. In general, the main problems here typically originate from the employees. For instance, in 2022, 82% of breaches involved the human element. According to checkpoint research, the misconfigurations were of the primary cloud security concern in 2022 affecting about 59% of respondents.

Breach of Access Control. Unauthorized access to confidential and personally sensitive information stored in the cloud may occur when access to an API is restricted to only one host, however another instance with privileged service-account attachment has access as well. Moreover, weak password policies may facilitate early password guessing or a cloud provider may not require MFA for all users, making it easier for attackers to gain unauthorized access. For example, permissions set to all users or authenticated users can expose data to the public posing a risk if the data are sensitive. It is crucial to restrict anonymous and public access, especially to Cloud KMS cryptographic keys, to prevent unintended data exposure.

Insecure Sensitive Data Storage. Keeping passwords in plaintext inside Docker containers also poses a security risk. To mitigate unauthorized access and potential security breaches, it is crucial to constantly encrypt credentials. Storing sensitive data, such as API keys and encryption credentials, in plaintext within cloud environments can allow attackers to easily escalate their privileges. According to the findings, only 45% of cloud data is being currently encrypted on average.

Over-permissive or Insecure Network Policies. Inadequate implementation of cluster ingress controls can lead to unregulated communication among pods, while unrestricted internet access on any port heightens the potential for lateral movement and external attacks, thereby increasing the overall risk.

Granting the Editor role to a service account provides extensive privileges, it’s generally contradicting security best practices. Such roles should be assigned judiciously to minimize the risk of unauthorized access and potential system compromise. 16% of attacks occur through valid accounts.

Ineffective Logging and Monitoring with Lack of Policy and Incident Response. Unauthorized actors exploit the situation by obtaining authorization credentials with maximum access rights. Subsequently, they can boldly explore the internal infrastructure without taking covert actions and proceed to add the initially granted account to all conceivable access groups. This allows attackers to locate and acquire sensitive details, including credentials for various services within both cloud and external platforms. Furthermore, they may propagate dummy malware files and manipulate data in storage, posing a significant threat to the overall system security.

It is imperative to promptly detect and respond to the situations described. The longer attackers remain within the system undetected, the greater the potential damage they can inflict. Early detection and immediate response are crucial to mitigating the impact of such security threats.

Strategies for Ensuring Comprehensive Cloud Security

It is important to adopt a series of interrelated best practices to guarantee reliable protection. Further follows an overview of possible approaches to data protection.

1. Establishment of an all-encompassing identity and access management (IAM) system. This system acts as the guardian managing access to cloud resources through strict verification methods, including multi-factor authentication.

2. Regular inspection of cloud infrastructure (Security Assessments) which helps in pinpointing and resolving possible hazards like configuration errors or antiquated systems. Review of permissions for compute service account’s custom role on the Principle of Least Privilege.

3. The ‘zero trust’ principle is a key tactic in contemporary cloud security. This approach is based on the premise that trust is never implied, regardless of the origin of the request. Access is provided only after rigorous validation, it’s reducing the risk of both internal and external intrusions.

4. Implementation of secrets management solution. Deployment of a robust secrets management system like HashiCorp Vault to handle sensitive data such as tokens, passwords, and API keys. Ensure that secrets are not hard-coded in source code or configuration files.

5. Data Encryption and Backup. Encrypting data, whether stored or in transit, preserves their integrity and confidentiality, protecting the data from unauthorized intrusion and breaches. Moreover, consistent data backups are important to avert data loss from various dangers, including cyber-attacks and system failures.

6. Vulnerability scanning, which involves using specialized software to automatically scan systems for known vulnerabilities. Unlike the manual in-depth approach to ethical hacking, vulnerability scanning provides a broader, ongoing review of the cloud environment.

7. Introduction of necessary responses to suspicious activities by high-privileged principals. Define clear incident response procedures when Event Threat Detection identifies suspicious activities involving high-privileged accounts. Implement automated response actions where possible, such as revoking credentials or isolating affected resources. Train your security team to respond to high-severity finds, which may indicate unauthorized access to privileged groups or roles. Use tools like the Security Command Center to monitor and alert to suspicious bucket access patterns.

Conclusion

The multifaceted nature of cloud services challenges the system security and causes the need to apply comprehensive, dynamic strategies to protect against evolving threats. This necessitates high-quality training of employees not only in using cloud services, but also in how to work safely with them.
No doubt, while the Cloud Service Providers (CSPs) assume responsibility for securing the architecture utilized by customers, it is equally crucial to regularly validate it through penetration testing and red teaming.

If you are facing challenges in securing your cloud environment, IBA Group is here to help. We have a proven track record of delivering successful Red Team and cloud security projects. Our expertise in cloud security is tailored to meet the specific needs of each client.

If you are interested in bolstering your cloud security, leave us an inquiry, and let’s explore how IBA Group can provide the security solutions you need.

Author: Mark Hillary

Most people working in IT today know about the cloud and how cloud-based systems can offer immediate access to storage or computing power easily. Many companies now use a cloud strategy to ensure they can ramp up and down on available systems or storage – it’s a common theme of discussion when planning an IT strategy.

But what is a Cloud Management Platform and in particular how can one be useful to service providers offering IT services to their clients?

Cloud Management Platform (CMP) is a term coined by the industry analyst Gartner. The analyst firm wanted a way to describe products or tools that help companies to optimize and manage their cloud infrastructure for cost, security, and operations. A good CMP strategy should allow users to maintain control over dynamic and scalable cloud environments.

So it is really just a control system that allows the user to maintain dynamic control over their cloud system. Instead of frantically calling a service provider and asking them to quickly scale up storage capacity in their contracted cloud, the customer should be able to use a CMP to just scale their cloud – it should be as easy as sliding a bar on a control panel.

The major CMPs on the market today will all offer these different aspects of cloud management:

• Cost
• Security
• Performance

These are the three main areas where the customer can manage their cloud and cover more specific areas such as budgeting, rightsizing the cloud, compliance and monitoring, and creating alerts and other analytics.

CMPs are still quite new tools and so there are still different types of tool available. Some are very focused on specific issues, such as controlling security risk or optimising costs. Some allow the option to manage multiple clouds, so if you are using both Microsoft Azure and Amazon AWS then you can manage both clouds from a single tool. Some CMPs even allow the tool to manage a cloud and systems you have on site simultaneously.

Clearly this is an emerging area. There are many new tools solving problems that have only recently become apparent. It was only a few years back that companies started taking cloud-based services seriously and it has become clear that it can be difficult to control the various aspects of a cloud-based system – such as cost control and security. In addition, if a service provider is delivering services on a cloud that is owned and managed by the client then the client needs an easy way to manage areas such as security in partnership with their service provider.

CMPs are still new and it is therefore difficult to advise on which one is perfect for each client, but there is a clear need to work on CMP selection with your service provider as any chosen solution must work for both client and service provider. I’ll explore this question next time here on the IBA Group blog.

You can also read about the IBA Cloud Platform

Author: Mark Hillary

In my last couple of articles here I explored Cloud Management Platforms (CMP), both to define what they are and to give some ideas on how to choose the best one for a particular business. It was therefore interesting to see that a recent article in ITPro Today explores the top ten CMPs available today, assessing all their strengths and weaknesses.

All CMPs need to provide lifecycle management – this is the ability to track cloud resources over a period of time – and data protection, in addition to the main functionality of controlling and automating cloud-based processes. John Webster, a senior partner and analyst at the Evaluator Group, managed the research published in ITPro Today. One of his main concerns when comparing the different CMPs was that not all of them are keenly focused on data protection – they are focusing mainly on basic functionality.

John explained: “Data protection and disaster recovery is an IT responsibility, a bedrock function, and I think that the vendors in this space have to really start looking at that seriously.” He added: “Vendors will likely provide these capabilities through extensions to data protection and disaster recovery applications that are already available in the market.”

The top ten list of CMPs was created by weighing up several factors, including:

• The quality of the user interface
• Ability to manage various groups of users
• Complexity of the service

Cost control is an important area of functionality that most customers want to use, but many CMP vendors find it very difficult to offer because they are constantly updating their products. The ability to create efficiency is much easier to plan when the software is stable. If the CMP is constantly being improved then there is an almost constant need to explore efficiencies.

John explained that support for Artificial Intelligence (AI) is likely to be an important capability in the near future. He said: “Support for cloud-native including Kubernetes, and application migration will be key functions in cloud management platform tools. AI assistance, or the assistance of artificial intelligence, will become more and more important as time goes on.”

Some of the CMPs on the market at present have been built from trusted and tested systems that were essentially managing IT estates – they have been converted to managing cloud-based systems, but others are built from scratch. It’s important to be aware of this when selecting a supplier. The start-ups might move faster and add more features all the time, but their platforms may be less stable and less tested in real-life situations.

The ten CMPs are not listed with the best in position one; they are just grouped as the ten best CMPs. This is because ultimately the right choice of CMP will be based on the different priorities and needs of each company. Follow the link to the article and you can read the top ten free, providing you submit your contact details to the magazine.

Author: Andrew Dvirnyk

Micro-services and APIs for mainframe may not seem like the obvious choice for dealing with mainframe issues. Let’s look at these digital services in the context of a typical mainframe user’s biggest challenge: cost.

Cost is always part of the conversation. You might be deciding if to upgrade mainframe system or replace your existing system. Or, you may be looking for practical ways to maintain the system that supports your organization. When it comes to cost concerns in the IT space, older systems can often mean higher bills.

And if you are like most organizations on mainframe, your system is old. System age is not a problem in and of itself. As long as your mainframe is agile. So, what is a hallmark of agility on mainframe? An agile mainframe is one that allows for collaboration between software development and operations teams. Enter cloud solutions and other micro-services. These innovative solutions offer cost savings and utility for mainframe users. Effectively, APIs leverage new technologies to support old technologies and protect technology investments.

Micro-Services

Also known as micro-services architecture, microservices are an approach for developing software systems. The purpose of a microservice is to build single-function modules for software systems, breaking the systems down into programs that are self-contained. These modules then work with operations and interfaces.

As such, the microservices approach in a mainframe environment is useful for leveraging the existing system to increase efficiencies and lower development and other costs. Microservices make it possible to create digital services off mainframe.

APIs

Application Programming Interface, commonly called API. APIs enable applications to communicate with each other. As such, an API makes it possible for applications (including applications on mainframe) to access data. Further, APIs enable interaction with microservices, as well as operating systems and external software.

With APIs, organizations on mainframe get the flexibility that this type of interface offers. APIs make mainframes more agile. As a result, they can also make your mainframe more efficient. And ultimately, it can make mainframe improvements more cost effective, all while increasing its utility.

Microservices, Digital Applications, and Costs

So, let’s look at micro-services and digital applications (like APIs) in the context of costs. Applications that enable communications between parts of a system are significantly cheaper to produce and implement than new hardware.

Because microservices and digital applications are flexible, it is easier and much more cost effective to make changes to them than it is to make hardware-level changes. Looking at it this way, digital applications become not only an efficient way to get more from your mainframe. They become a much more cost-effective way to maintain an agile mainframe, despite the age of the original system.

Without digital applications, on the other hand, many organizations find themselves throwing money at mainframe problems. This is part of why mainframes are too often (and not always correctly) associated with cost and complexity.

Micro-Services Security

Of course, digital applications present their own set of challenges. Whenever we talk about third party applications, microservices, or APIs, the question of security comes up. This is where micro-services can feel like a “double edged sword.” On the one hand, microservices provide much-needed agility for our mainframes. On the other hand, the same open architecture of micro-services that helps make this kind of agility possible also makes micro-services vulnerable.

The complexity and the openness of the applications we build using a microservice architecture renders them significantly more vulnerable to attack than the traditional types of application models many of us are familiar with. While this is important to recognize (and plan for), it does not mean you should steer clear of microservices. It does, however, mean that you must enable security measures to protect your systems from risk.

Request authentication, encryption, and hard code certificates are all ways to make micro-systems more secure. Another way to protect micro-services from threats is to leverage DevOps. In an upcoming article, we share a list of the Top 5 Ways to Improve Microservice Security.

Offsite Mainframe Hosting

Even with investments into security for microservices, utilizing software integrations like APIs and others saves money and improves mainframe utility. On the other hand, even with those savings, some organizations are finding on-site mainframes cost prohibitive. For organizations who want to access the power of mainframe without the associated expenses of managing hardware, offsite mainframe hosting is a cost-effective option.

In our next article, we delve into additional ways to save on mainframe related expenses. Specifically, we dive into the whys and hows of offsite mainframe hosting. In that article (coming up soon), we help you explore the cost and efficiency benefits of hosting your infrastructure through another company.

Find Out Faster

Do you want to learn more about offsite mainframe hosting for your organization? To get an alert when we publish an article, subscribe to the IBA Group blog now.