How to Improve Security in Multicloud Environments

🚨NSA Releases Guidance on Hybrid and Multi-Cloud Environments🚨 The National Security Agency (NSA) recently published an important Cybersecurity Information Sheet (CSI): "Account for Complexities Introduced by Hybrid Cloud and Multi-Cloud Environments." As organizations increasingly adopt hybrid and multi-cloud strategies to enhance flexibility and scalability, understanding the complexities of these environments is crucial for securing digital assets. This CSI provides a comprehensive overview of the unique challenges presented by hybrid and multi-cloud setups. Key Insights Include: 🛠️ Operational Complexities: Addressing the knowledge and skill gaps that arise from managing diverse cloud environments and the potential for security gaps due to operational siloes. 🔗 Network Protections: Implementing Zero Trust principles to minimize data flows and secure communications across cloud environments. 🔑 Identity and Access Management (IAM): Ensuring robust identity management and access control across cloud platforms, adhering to the principle of least privilege. 📊 Logging and Monitoring: Centralizing log management for improved visibility and threat detection across hybrid and multi-cloud infrastructures. 🚑 Disaster Recovery: Utilizing multi-cloud strategies to ensure redundancy and resilience, facilitating rapid recovery from outages or cyber incidents. 📜 Compliance: Applying policy as code to ensure uniform security and compliance practices across all cloud environments. The guide also emphasizes the strategic use of Infrastructure as Code (IaC) to streamline cloud deployments and the importance of continuous education to keep pace with evolving cloud technologies. As organizations navigate the complexities of hybrid and multi-cloud strategies, this CSI provides valuable insights into securing cloud infrastructures against the backdrop of increasing cyber threats. Embracing these practices not only fortifies defenses but also ensures a scalable, compliant, and efficient cloud ecosystem. Read NSA's full guidance here: https://lnkd.in/eFfCSq5R #cybersecurity #innovation #ZeroTrust #cloudcomputing #programming #future #bigdata #softwareengineering

2024 State of Cloud Security Study Key Insights A great morning read from Datadog ‘analyzed security posture data from a sample of thousands of organizations that use AWS, Azure, or Google Cloud.’ ↗️ Long-lived credentials -> remain a security risk, with 60% of AWS IAM users having access keys older than one year. Unused credentials are widespread, increasing attack surfaces across all cloud providers (AWS, Azure, GCP). Recommendation -> Shift to temporary, time-bound credentials & centralized identity management solutions. ↗️ Public access blocks on cloud storage increasing AWS S3 & Azure Blob Storage are increasingly using public access blocks, with S3 seeing 79% of buckets proactively secured. Recommendation -> Enable account-level public access blocks to minimize risks of accidental data exposure. ↗️ IMDSv2 adoption growing AWS EC2 instances enforcing IMDSv2 have grown from 25% to 47%, yet many instances remain vulnerable. Recommendation -> Enforce IMDSv2 across all EC2 instances & use regional settings for secure defaults. ↗️ Managed Kubernetes clusters Many clusters (almost 50% on AWS) expose APIs publicly, with insecure default configurations risking attacks. Recommendation -> Use private networks, enforce audit logs, & limit permissions on Kubernetes worker nodes. ↗️ 3rd-Party integrations pose supply chain risk 10% of third-party IAM roles are overprivileged, creating risks of AWS account takeover. Recommendation ->Limit permissions, enforce External IDs, & remove unused third-party roles. ↗️ Most cloud incidents caused by compromised cloud credentials Cloud incidents are often triggered by compromised credentials, particularly in AWS, Azure, & Entra ID environments. Patterns of Attack + Compromised identities + Escalation via GetFederationToken + Service enumeration + Reselling access + Persistence techniques Microsoft 365 -> Credential stuffing, bypassing MFA, & malicious OAuth apps for email exfiltration. Google Cloud -> Attackers leverage VPNs & proxies for crypto mining and follow common attack patterns. Recommendations -> Implement strong identity controls & monitor API changes that attackers may exploit. ↗️ Many cloud workloads are excessively privileged or run in risky configurations Overprivileged cloud workloads expose organizations to significant risks, including full account compromise & data breaches. Recommendation ->Enforce least privilege principles on all workloads. Use non-default service accounts with tailored permissions in Google Cloud. Avoid running production workloads in AWS Organization management accounts. The study shows improved adoption of secure cloud configurations -> better awareness + enforcement of secure defaults. However, risky credentials & common misconfigurations in cloud infrastructure remain significant entry points for attackers. P.s. use the info to strengthen your org cloud security posture. Full study report in the comment ⬇️ #cloudsecurity #cloudsec #cybersecurity

Are you addressing the root causes of your cloud security threats or just treating the symptoms? The Cloud Security Alliance's Top Threats to Cloud Computing 2024 report illuminates critical security challenges, but many of these threats result from overlooking foundational practices in favor of more complex solutions. My takeaways: 1️⃣ Misconfiguration and change control - Misconfigurations often signal that organizations advance to complex cloud setups without mastering the basics. For example, the Toyota data breach, where a decade-long exposure was due to human error and inadequate cloud configuration management, highlights the need for robust configuration management and continuous monitoring. 2️⃣ Identity & Access Management (IAM) - IAM issues frequently stem from inconsistent governance. The JumpCloud breach, where attackers exploited over-permissioned accounts and poor separation of duties, underscores the importance of regular policy reviews and strict governance practices. 3️⃣ Insecure interfaces and APIs - Securing APIs is crucial, but the rush to innovate can sometimes overshadow security. The Spoutible (an X alternative) API vulnerability, which exposed user data due to poor security practices, serves as a reminder to embed security into the API development process from the start. What can you do? 1) Focus on fundamentals: To address misconfigurations, prioritize strong configuration management and continuous monitoring. Look at tools like Prisma Cloud by Palo Alto Networks. 2) Regular governance reviews: Prevent IAM issues by regularly reviewing and adapting policies. Ensure all your applications are part of your IAM strategy, not just those supporting standards like SAML, OIDC, and SCIM. (Cerby can help you with these apps.) 3) Balanced innovation: Integrate security into development processes to avoid compromising security in a rush to innovate (see Secure by Design from the Cybersecurity and Infrastructure Security Agency). Focusing on the basics and doing them well can mitigate most of the risks in this report. Props to the authors Jon-Michael C. Randall, Alexander S. Getsin, Vic Hargrave, Laura Kenner, Michael Morgenstern, Stephen Pieraldi, and Michael Roza. #Cybersecurity #cloudsecurity #api Cloud Security Alliance

Every time I talk to security leaders about their experiences with the cloud, I hear the same thing: The problem isn’t just the tech. It’s how teams think about security. They’re dragging outdated, on-prem security models into a cloud-first world and wondering why nothing fits. I sat down with Gal Yosef from AlgoSec on the Audience 1st Podcast to dig into the BIGGEST mindset shifts security teams need to make if they want to secure multi-cloud environments without losing their minds. Here's a sneak peak of what we're going to be talking about this Friday. 1. Forget Perimeters—Follow the Data There’s no clean perimeter in cloud—data, workloads, and users are everywhere. Security needs to follow them. Static rules won’t cut it. Security has to be identity-based, adaptive, and dynamic. 2. Break Down the Silos Between Network & Cloud Security Network teams think in firewalls. Cloud teams think in security groups. Neither side understands the other—and that’s why misconfigurations happen. Attackers don’t care about your org chart. If security teams don’t unify, breaches will happen in the gaps you left open. 3. Manual Security is a Death Sentence—Automate or Die Security teams still doing quarterly audits and manual reviews? That’s a joke. Cloud moves in seconds. By the time you check for misconfigurations, an attacker has already found them. Continuous, automated enforcement isn’t a nice-to-have—it’s survival. 4. Security Can’t Be a Bottleneck—It Has to Enable the Business If you lock everything down and make it impossible for dev teams to move, they will find a way around you. Security needs to work with engineering, not against it. Set up smart guardrails instead of rigid roadblocks. Otherwise, security becomes optional—and that’s how breaches happen. 5. One-Size-Fits-All Security Doesn’t Work in Cloud Different teams have different risks, different cloud needs, and different compliance requirements. Yet, most security leaders apply the same policies to everyone, forcing teams to work against security rather than with it. The best security leaders treat internal teams like customers—giving them flexibility within safe guardrails. Cloud security isn’t just a tooling problem—it’s a mindset problem. Join me and Gal March 14 at 10:00am PST as we break down 5 mindset shifts security teams must adopt to master multi-cloud security, linked in the comments below ⬇️ #cybersecurity #cloudsecurity #customerresearch #audience1st