3 Common Cloud Security Challenges (and How to Solve Them)

4 Min Read

Public clouds have fundamentally changed the way organizations build, operate, and manage applications. Developers now have easy access to a variety of cloud services and tremendous flexibility in how each service can be configured in order to build complex, modern applications. However, this freedom to innovate also comes with its own set of cloud security risks.

The dynamic nature of the cloud is forcing information security teams to rethink how they operate in order to address emerging security and compliance challenges. In this article, we address three of the most common challenges cloud security practitioners face and recommendations for how to solve them.

3 Cloud security challenges (and how to solve them)

CHALLENGE 1: Security change management can't handle the speed of the cloud

Cloud computing has made DevOps a reality, with developers executing hundreds of code changes every week. The traditional change management approach of meeting once a month (or at any other regular interval) to review the security impact of new updates and changes doesn’t work in the cloud.

SOLUTION: Shift security mindset from blocking teams to building guardrails

To help the business move fast and stay secure, security owners need a shift in mindset. Cloud security teams need to strike a balance between giving developers what they need when they need it, and also putting rules in place to ensure security. To do this, align with your organization’s Cloud Center of Excellence to create a cloud governance program where you define best practices, socialize them, and take action when a policy or standard is violated.

The best security teams today think like developers. They share code examples of correct usage and build security guardrails to ensure someone doesn’t accidentally make a mistake. To help increase cloud security policy adoption, ensure policies are clearly defined and something a developer could actually put into code. For example, if you have a policy that passwords must be complex, it would be better to have a policy that passwords must be greater than 12 characters because a developer can implement this function into their code.

CHALLENGE 2: Lack of skilled staff and appropriate guidelines for security teams

Even though IT teams and developers have been embracing DevOps techniques and building applications in the cloud for years, these technologies are still relatively new for many teams. Finding engineers who are skilled in both security and cloud can be a difficult challenge. 

SOLUTION: Train internal teams and leverage cloud security standards

While there is no easy solution to this problem, organizations can start by identifying internal personnel skilled in DevOps and train them in cloud security. These individuals can gradually help raise the overall security awareness amongst development teams. To help organizations get off the blocks quickly, different cloud providers and public sector groups publish cloud-specific best practices and security controls for maintaining compliance with industry regulations. Take AWS’ Well-Architected Framework for example, or the Center for Internet Security (CIS) controls.

CHALLENGE 3: Traditional security tools don’t protect resources in the cloud

Cloud environments are extremely dynamic and the lifecycle of resources is often short-lived. Network parameters such as IP addresses and network ports are no longer reliable, and perimeter firewalls and other solutions that served security teams for years in the data center no longer work in the cloud.

SOLUTION: Use a cloud security posture management solution

Unlike traditional security solutions, cloud security posture management solutions leverage cloud APIs and event logs to provide visibility into service configuration risks in the cloud. Many of these solutions provide out-of-the-box implementation of security controls recommended by different cloud providers and industry standards such as CIS, NIST, GDPR, and HIPAA. While selecting the right cloud security solution, security teams should compare how different solutions model configuration risk, factoring in service dependencies, the speed at which they detect changes in the cloud, and the integrations available to enable all security stakeholders.

Solution Brief
Mitigating Cloud Security and Compliance Risk with CloudHealth Secure State

Final thoughts

Here we’ve listed three of some of the most common cloud security challenges, but this is by no means an exhaustive list. To stay ahead of all the potential security challenges and risks in the cloud, organizations should establish a cloud security and compliance practice. 

For more information on how to get started, see our in-depth whitepaper, which breaks down the four phases all organizations tackle in their cloud security journey, along with example KPIs to track and measure success in each phase.

Image
profile photo of lauren van der vaart
Lauren van der Vaart, Senior Content Marketing Specialist

Lauren is a member of the Digital Marketing team at CloudHealth by VMware. She focuses on delivering valuable, relevant, and actionable content for customers on their cloud journey. Before joining CloudHealth, Lauren held various roles across digital and field marketing for global technology organizations.

We Think You Might Like These: