If your plans in 2018 involve migrating to or expanding the use of cloud services and applications, it’s important to be aware of the challenges. The reality of the cloud is two-fold: on the one hand, it accelerates digital transformation, increases productivity, intelligence and competitiveness; but at the same time introduces and multiplies security risks if not architected correctly.

To safely use the cloud along with other emerging technologies, here’s a cloud security checklist with five recommendations to strengthen your defenses and ensure a secure presence in the cloud.

With the diversity of services available from cloud platforms, readily available to any company, you can expect that the use of these services is widely disseminated. However, a recent study by the McKinsey Consulting shows that this is not yet the case. For example, only about 40% of the companies studied use more than 10% of their workloads in the cloud. Cybersecurity is a central concern behind this outcome.

Of course, there are challenges, but little by little cloud adoption grows in the corporate environment.

Map all your processes

Migration to cloud environments does not have to happen overnight. As with any digital security initiative, it is crucial to plan the entire process, mapping all the advantages and challenges, processes, and information.

Moving platforms or data to the cloud is a long-term decision and must be taken with care. In addition, a cloud migration will directly impact your security policies and practices, which will need to be reviewed – including the fact that your team will need to more training on how to properly use the cloud and how it relates to your updated security policies and procedures.

Challenges:

• Map all processes that will migrate to the cloud
• Monitor all activity in the cloud
• Know how and where your information will be stored
• Review security policies

Re-evaluate your users

Unlike a private network, the cloud is the external network, where the controls will be positioned to establish the perimeter. That’s why it’s important to audit and redefine your user privileges in the cloud. This includes permission levels for internal users, partners, and vendors.

Challenges:

• Reset Usage Permissions
• Centralize / prioritize privileges
• Audit accounts

Learn more about the disadvantages of privileged account access here. 

Encrypt your data

If it is your first investment with the cloud, you can take a calculated step with a pilot project or proof of concept, migrating only one specific initiative. This will help you understand how using the cloud will impact your business.

In all cases, ensuring that encryption is used on any data is indisputable. Even when using cloud services and applications, your data will likely travel between the private and public cloud, and the use of encrypted channels is essential.

Challenges:

• Audit features of your cloud service
• Select cloud environments that adopt encryption procedure
• Adopt technologies such as VPN to bridge the gap between your network and the cloud

Learn more about data protection and encryption in our previous blog post here.  

Build an incident recovery plan

Creating a document to guide your team in preparing and recovering from security events within the cloud will also be critical to your cloud migration initiative.

Challenges:

• Gather and train team of experts
• Map and prioritize the types of risks to data in the cloud
• Create a security event management guide
• Choosing appropriate cyber security products

Monitor logs

Keeping and evaluating logs for all cloud activities will be instrumental in understanding the status of your security in a hybrid cloud environment and will also help you create your incident recovery plan.

Challenges:

• Understand what data is shared between your network and the cloud
• Set secure rules for data traffic
• Monitor all users’ activities

Learn how to extract value from your SIEM logs for added value.

Finally, it is important to remember how the use of services and applications in the cloud can impact the compliance and industry regulations (such as PCI-DSS) and local privacy laws (such as HIPAA, GDPR, etc.)

Do you know the main risks associated with the cloud? Stay tuned as we answer this in an upcoming blog!