"If you build it, they will come".
Although this was said keeping customers in mind, however in today's digital world any service or product which is exposed on the internet attracts equal & sometimes even more number of unwanted visitors than actual customers.
Only way out is to mitigate the extent and impact of such attacks on businesses by securing infrastructure layers, enough to hold back attacks and let the business run.
A Cloud provider does not guarantee your infrastructure security, your security configurations and policies do.
Infrastructure and the intellectual property residing on it has to be secured by enabling the 5 key trust principles of Security.
Security Key Trust Principles:
Security: The system is protected, both logically and physically, against unauthorised access.
Availability: The system is available for operation and use as committed or agreed to.
Processing Integrity: The completeness, accuracy, validity, timeliness, and authorisation of system processing.
Confidentiality: The system’s ability to protect the information designated as confidential, as committed or agreed.
Privacy: Personal information is collected, used, retained, disclosed, and disposed of in conformity with the commitments in the privacy notice.
Most often security issues are only considered as data being compromised or stolen. Although that's the ultimate goal of hackers, attacks like DDoS are capable of bringing the entire business down for days without even entering your premises.
How to mitigate and prepare yourself better in terms of security. Here are 10 factors that can help:
Identity and Access Management: RBAC for accounts, web-console, and APIs
Perimeter Security: Securing Network, Systems, and Services
System Security: Hardening, Patching, Vulnerability Scanning for operating system and platforms
Data Security: Protecting and securing database system and platform for data at rest and data in transit.
Application Security: Security Testing, Auditing, penetration testing of application
Release Management: Processes for Prod-deployment, Risk & Mitigation Factors(RMF), Security Review
Logging and Auditing: Server, appliance and system logs, API and console logs, database logs
Reporting: Alerting and Notification
Availability: Guidelines for Recovery Time Objective/Recovery Point Objective (RTO/RPO)
Disaster Recovery: Guidelines for DR and rollback, backups
Protect your entry points by whitelisting sources and enabling a zero trust policy. Communications with abstracted cloud services (i.e not within the same account tiers) are encrypted.
Credentials/secrets must be stored in a centralised secret management system with strong password policy, periodic rotation, runtime access, configuration management. For example, Hashicorp Vault, Gitlab secrets etc.
Regular security testing, auditing, penetration testing, vulnerability scanning must be enabled for all infrastructure resources. Version-Controlled Security as Code to make it auditable and traceable.
This approach will permit portability across cloud providers, as well as tenant-specific customisation and review.
Must Have Security Measures for Infrastructure:
VPNs for encrypted access to internal infrastructure. These can be of two types:
Client-to-Site: For authorised users (mostly internal) to connect to infrastructure resources for operations.
Site to Site: For integrating with third party services over the internet through an encrypted tunnel. Communication with abstracted cloud services (i.e, not within the account tiers must be encrypted.
Firewalls: Network or Web Application Firewalls for securing ingress and egress traffic.
SSL certificates for service/application endpoints and encryption of data in transit.
Storage or disk encryption for PII data at rest with managed key rotation.
Nowadays more enterprises especially those in banking and fintechs are moving towards MTLS for enabling Zero Trust Policy for intra and inter network communications. One such example is integrating with VISA apis requiring MTLS to be enabled on your end and theirs.
Penetration Testing: This one is a must have for any Security Compliance and also very useful for keeping application and infrastructure security in track.
Vulnerability Scanning helps identify vulnerabilities in your application or infrastructure configurations if any and some tools nowadays also allow to auto fix such misconfigurations, hence a must have.
Summary:
These security policies must be enforced in the code as a first-class member of their infrastructure creation making it a default feature in every stage of the application lifecycle.
The configurations must be catered to in the form of Infra as Code and version controlled to ensure every configuration change is auditable and traceable.
Such that each time an environment is spun up for applications or IT operations, these principles come by default making it easy for Compliance related activities.
Security settings should no longer be mysterious or to be feared. Thanks to automation, the impact of configuration changes can be ascertained quickly. This approach also permits portability across cloud providers, as well as tenant-specific customisation and review.
Your objective must be to design and implement a security policy for cloud infrastructure based on industry-accepted norms to get them ready for third party information security audit.
Don’t let your best-selling product suffer due to an unstable, vulnerable & mutable infrastructure.
Thanks & Regards
Kamalika Majumder
Comments