How to optimise cloud security without budget blowout

Reduce exposure

Be aware of and limit exposed and vulnerable resources. If not exposed to the public internet, the organisation may only need “simple and straightforward” ingress filtering. Web and public internet-exposed services for consumers or third parties require more sophisticated ingress filtering features that come at a price.

Protection from Yahoo! filter bots or shopper traffic distributed denial of service (DDoS) can require a “heavy investment”, Green points out.

“This is not specifically for compliance, but for the general security posture,” he adds. “If everything you’re exposed to is just maybe a partner API [application programming interface], you may just need some API protection that can validate requests.”

Also, do not lift and shift on-prem thinking. For example, deploying a full firewall or next-gen firewalling appliances to create cloud segments is expensive and inefficient. It’s better to look for technologies that use cloud-native attributes like labels or tags that can migrate with the workload, says Green.

Kris Lovejoy, global security and resilience leader at Kyndryl, opines that cloud security has often been held back by legacy-related challenges, and that is partly why the years-ago talk of “massive security benefits”, alongside performance and scalability of cloud, have not played out as predicted.

The need to refactor applications to be cloud-native has often been neglected.

“Refactoring can be a very difficult discussion with boards and executive management,” she says. “But legacy apps contain hard-coded credentials, insecure configurations, outdated encryption methods and, often when you move into cloud, containerisation.“

Legacy applications can often present the same vulnerabilities as they would have in an on-prem environment, on top of which is layered the encapsulated complexity of containerisation. Containerisation is itself a source of “massive amounts” of potential configuration-related exposures, Lovejoy explains.

While organisations recognise the security issues, how applications – often poorly performing legacy solutions – and environments have been built and deployed has often left huge amounts of technical debt.

How far behind are some? When it comes to cloud development processes, Enterprise Strategy Group polling found a third of respondents’ security teams had insufficient visibility and control, missed security checks and testing of releases, lacked consistent cross-team security processes, skipped security to meet deadlines, or deployed with misconfigurations, vulnerabilities and “other security issues”.

Ensure sound basics

Lovejoy notes that multiple hybrid cloud environments need integration to deliver the portability and interoperability that’s needed. Often, even the dream of advanced analytics suffers as a result.

“That complexity has resulted in costs that were utterly unexpected. However, it was not optimised for cloud,” says Lovejoy. “They have resource inefficiency, poor utilisation, and higher cloud and hosting costs, because of huge consumption.”

They are in a kind of IT poverty trap, if you will. Spending on security can, in such circumstances, feel like an unwanted extra.

For Lovejoy, the best fix might involve rowing back on what is often termed modernisation – going backwards – for the sake of building a stronger foundation on which to ultimately build. Even if that means going to private cloud or on-prem, then restarting the big cloud moves down the track.

“Cloud can provide benefits, security and resiliency, but the organisation may need to apply appropriate investment in actual refactoring of applications,” she says, “as opposed to cobbling together lots of security controls, for example.”

This is “particularly relevant” considering the expansion and scope of emerging regulation, including on data use and transparency.

Instead of narrowly focusing on security separate from the rest, Lovejoy suggests, organisations must think through what their “minimum viable business services” are to enable their operation of organisations, data and systems. Map all that out, then prioritise security resilience around that.

That’s where organisations should invest to ultimately optimise cloud costs, including security, she emphasises.

 “While zero trust is great, it really should be implemented within the context of more modern architecture. Consider the basics – do you have multifactor authentication (MFA), training and good patching? – before you get to ZTNA [zero-trust network access].”