Security in a hybrid world: You can’t protect what you can’t see
Mon 18 Apr 2016
You’re probably pretty good at security. You have a well trained team, efficient, up-to-date on conquering the latest threats, and well-rehearsed for when the inevitable happens. You have worked very hard to secure your organization, but now you’re supposed to secure someone else’s environment – “the cloud?” And now developers can bring their own replacement parts for the operating system with containers? Are you kidding me?!
Relax. You’ve got this.
Start with a strong baseline. Know your baseline shifts over time. Pull your environment up to the new baseline. Ensure nothing gets started which doesn’t pass that new baseline. This is a familiar process.
The question, security guru, is how do you turn it to your advantage?
Securing your hybrid cloud (multiple public and private clouds, different virtualization vendors, and now containers), for all the new work it adds to your queue, is an incredible opportunity to improve visibility into the different branches of your infrastructure and match placement and isolation to threats. Introducing a layer of management tools permits this visibility, isolation, and automation to simplify the whole process.
Visibility: You can’t protect what you can’t see
Supporting and securing your hybrid infrastructure means you need visibility across multiple technologies, and a management layer that supports this diversity across multiple vendors: bare metal, hardware virtualization (VMs), OS virtualization (containers), infrastructure as a service (IaaS), platform as a service (PaaS), etc.
Management tools are the way to gain insights from these engines and the workloads they run. The information and visibility these tools provide allow you to provide consistency across this diversity for policies, and regulations etc. If you can’t access and see across all of these vendors and technologies, you can’t control access and enforce the required policies and governance. If you can’t see across your entire components level, you certainly can’t identify the complex interactions that make security fragile.
Isolation: DMZ is now a blurred line
With these combinations of components, we have new options to match threats with workload placement, and new options on how to isolate workloads wherever they are placed.
With each new cloud and cluster, we can further segment our applications – placing customer-facing applications on distinct accounts in the public cloud, separated from internal applications in private clouds. Even within each of our clouds, we have many ways to slice and dice access to keep applications isolated from each other, creating both platform and user-based isolation of workloads. We now have many more shades of gray than “stick it in the DMZ.”
Since, with the right tools, we can manage containers as easily as we already do with VMs, we now have another easy layer of isolation we can bring to our environment. Create one container per application to limit the attack surface. Wrap each with military grade security to protect the contents through mandatory access controls. Add native disk encryption to protect the data in-flight and at rest.
If you’re looking for a great overview on container security, there’s a coloring book that walks you through the concepts.
Automation: Enforcing what you have learnt
There are two parts to enforcing the new normal; bringing your entire estate into compliance, and enforcing the use of this new baseline. Once you have determine a need for change: patching, configuration files, applications, you name it, you need to act quickly and across your entire environment. Automation is faster, less error prone, and helps you reliably perform required actions across your entire estate.
No matter how good you and your team are, and no matter how good your tools are, someone will always try to run older unpatched code. And someone will, if you don’t have the automated policies in place to confirm and approve code execution based on software versions, configuration file settings, registry settings, etc. One easy way to limit your exposure is to scan snapshots and live VMs for policy compliance.
The experience you have earned over the years is a great place to start from for approaching security in hybrid environments. While there is more diversity to be managed, and an unprecedented scale to be dealt with, you finally have the opportunity to use these to your advantage and improve the security of your organization. Together, through visibility, isolation, and automation, you can address the risks of quickly evolving hybrid environments, take advantage of new ways to isolate risk, and rapidly turn insight into action.