Multi-cloud security: How to manage risk in a multi-cloud environment?

The era when companies made the strategic decision to choose a single, single public cloud provider is irrevocably gone. Today’s business reality is multi-cloud. Organizations no longer choose between AWS, Microsoft Azure and Google Cloud Platform – they use them all simultaneously, selecting the best and most cost-effective services from each provider’s portfolio. Application infrastructure lands in AWS, identity and office tools are managed in Azure, and advanced data analytics and machine learning run in GCP. This strategy, while offering tremendous flexibility and avoiding dependence on a single vendor (vendor lock-in), comes at a price.

From a cyber security perspective, a multi-cloud environment is a nightmare of complexity. Each cloud provider is a separate “state” with its own language, its own laws and its own unique security management tools. Trying to ensure consistent visibility, uniform policies and central management in such a heterogeneous and dynamic ecosystem is becoming one of the biggest challenges for today’s CISO and CIO teams. How do you regain control of a distributed empire and avoid each cloud becoming an isolated, poorly protected silo?

What is a multi-cloud strategy and why are companies increasingly adopting it?

A multi-cloud strategy is the conscious and deliberate use of public cloud services from two or more different providers. It should be distinguished from a hybrid cloud strategy, which means combining a public cloud with a private, local data center. In a multi-cloud model, an organization can simultaneously use virtual machines in Amazon Web Services (AWS), database services in Microsoft Azure and a Big Data analytics platform in Google Cloud Platform (GCP).

Adoption of this strategy is driven by several key business drivers. Chief among them is the drive to leverage best-in-class (best-of-breed) services. Each of the big cloud players has its own strengths – AWS is a leader in IaaS, Azure integrates well with Microsoft’s ecosystem, and GCP leads the way in analytics and AI services. Multi-cloud allows companies to flexibly select optimal components, rather than locking themselves into one limited ecosystem.

Other motivations include avoiding dependence on a single vendor (vendor lock-in), which gives you a better negotiating position, optimizing costs by choosing the cheapest service for a given task, and increasing resilience – a failure at one vendor doesn’t have to mean paralyzing the entire company. Whatever the motivation, the effect is one: increasing complexity and fragmentation of the IT infrastructure.

What are the biggest and most common security challenges in a multi-cloud environment?

The flexibility of a multi-cloud strategy comes with a huge baggage of challenges for security teams. Problems that are difficult to manage in a single cloud are compounded and compounded in a multi-cloud environment.

Lack of consistent visibility and control: This is the number one challenge. Each cloud has its own console, its own naming of services and its own way of reporting events. This forces security teams to constantly jump between different interfaces, making it difficult to get a holistic view and leading to blind spots.

Inconsistent identity and entitlement management (IAM): The permissions model in AWS works differently than in Azure and even differently than in GCP. Manually managing roles and permissions in each of these environments separately is extremely difficult, error-prone and leads to excessive permissions, which are a prime target for attackers.

Complexity in compliance: Proving to an auditor that a company is compliant with RODO or PCI DSS when data and applications are spread among three different vendors, each with different controls, becomes a nightmare.

Variety of native tools: Each vendor offers its own set of monitoring and security tools (e.g., AWS GuardDuty, Azure Sentinel). While these are powerful in their silo, they do not provide a consistent view of the entire multi-cloud environment, forcing companies to invest in additional third-party platforms.

How do you manage identity and entitlements (IAM) consistently across multiple clouds?

Identity and Access Management (IAM) is the cornerstone of cloud security, and in a multi-cloud environment it becomes a critical challenge. Manually replicating users, groups and roles in each cloud individually is inefficient and dangerous. The key to success is centralization and federation of identities.

The best practice is to establish a single, central Identity Provider (IdP) that will be the sole “source of truth” about users and their basic attributes. For most companies, the natural choice is Microsoft Azure Active Directory (now Entra ID), since they already manage their employees’ identities there for Microsoft 365. Other popular solutions include Okta or Ping Identity.

Then, set up federation between the central IdP and the individual cloud platforms (AWS, GCP). This way, a user logs in once, using his or her corporate credentials, and the background systems automatically and securely “transfer” his or her identity to the individual clouds, mapping him or her to the appropriate roles and permissions. This eliminates the need to manage separate passwords and permissions in each cloud, significantly simplifying administration and strengthening security.

What are misconfigurations and why are they even more dangerous in multi-cloud?

Configuration errors are, according to all industry reports, the leading cause of security incidents and data leaks in the cloud. These are not sophisticated hacking attacks, but simple human mistakes made during the configuration of cloud services. The most common examples are leaving a data tray (such as AWS S3) publicly open, exposing a database to the Internet without a password, or assigning excessive permissions to a service account.

In a multi-cloud environment, this risk is even greater. First, each cloud has thousands of configuration options, and setting them up securely requires deep, specialized knowledge unique to the platform. It’s easy for a team that is an expert in Azure to make a basic mistake in AWS because the services, while conceptually similar, operate differently.

Second, the lack of a central view makes it difficult to detect these errors. Administrators have to manually check settings in many different consoles, a slow and prone to oversight process. Automated attacker scripts are constantly scanning the Internet for just such simple errors, and in a distributed multi-cloud environment the chance of finding an “open door” is statistically much higher.

How do CNAPP (Cloud-Native Application Protection Platform) platforms integrate all these tools?

In response to the complexity of multi-cloud security, a new category of integrated platforms has emerged on the market, known as CNAPP (Cloud-Native Application Protection Platform). CNAPP is not a single tool, but a holistic platform that combines the functionality of several previously separate product categories to provide consistent protection for the entire lifecycle of cloud applications.

CNAPP’s main goal is to break down silos and provide a single, consistent view of security across a multi-cloud environment. The platform integrates key modules that until now were often purchased and managed separately. This gives security teams a single “command center” for the entire cloud.

How can nFlo help you design and implement an effective multi-cloud security strategy?

At nFlo, we understand that managing security in a multi-cloud environment is one of the biggest challenges facing organizations today. Our approach is based on strategy, centralization and automation, and our goal is to help customers take back control and transform chaos into an orderly, secure ecosystem.

Our services begin with a comprehensive audit and risk assessment of your multi-cloud environment. Our team of experts conducts an in-depth configuration analysis across all the clouds you use (AWS, Azure, GCP), identifying configuration errors, excessive permissions and visibility gaps. Based on this audit, we create a consistent security strategy and reference architecture, which includes, among other things, centralization of identity management and definition of uniform security standards for all platforms.

We specialize in implementing unified security platforms such as CNAPP and CSPM. We help select and implement a tool that will provide the customer with a “single source of truth” and allow monitoring and management of the security posture across the multi-cloud environment from a single console. For companies that want to fully delegate this complex area, we offer Managed Cloud Security services. Under this service, our 24/7 SOC team monitors alerts from the CNAPP/CSPM platform, responds to threats and proactively manages the security posture, allowing the customer to reap the benefits of multi-cloud without burdening the internal team.