How to Lock Down the Cloud Control Plane with CSPM

Therefore, securing that expanding cloud control plane is a key priority for the CIO or CISO, particularly in a multi-cloud environment. This can be done using several methods, but still requires clear operational understanding, role responsibilities and reporting across the IT team to ensure that every alert is tracked, traced and responded to.

Tips for securing the cloud control plane

Verizon highlighted some 80% of hacking-related breaches were caused by compromised, weak or reused credentials. Fortunately, there are a number of technical means to help secure the cloud control plane, with increasing automation helping manage the growing number of alerts.

1. Use multifactor authentication

The first task is to limit access and ensure that no one point of failure will create a breach. The deployment of multifactor authentication will ensure that only authorized operators can log into the cloud control plane through a physical device, either by entering an access code through Google Authenticator, Duo Mobile or another mobile application.

Sometimes there’s a case that multifactor authentication may interface with automated processes, but even here you should weigh the balance on strong security with the need for smoother business operations.

2. Restrict API access to prevent abuse

Cloud APIs can be used to maliciously access services or trigger attacks, so it’s important to limit access to a core team of admins or developers to prevent abuse. Typical examples include Google’s Cloud API, Microsoft’s Azure PowerShell and Amazon AWS CLI, all of which are full of powerful commands and instructions that can cause serious damage if abused.

There are plenty of examples across any platform, from the big players, such as AWS (where nearly two dozen APIs are vulnerable to abuse) to WordPress and Salesforce, all creating an area of risk if left unmanaged. And as departments launch their own cloud services across HR, marketing or production, the business could also find itself at risk of developing shadow IT services that aren’t as secure as they should be.

3. Use account inventory and logging

From day one, admins should constantly be updating their cloud account inventory, removing old services and accounts to reduce the risk of someone accessing and hijacking them. Users should be regularly asked what applications they need to use, and locked out of applications they no longer require. Using Active Directory, single-sign-on or creating unified account management all help reduce the risk (and cost for per-user accounts).

With services in operation, careful management and study of access and usage logs is also essential. Some logging services are turned off by default and should be activated. Most of them are automated to highlight outlier use cases or suspicious activity, but manual checks should take place for something that the automation might not notice.

4. Use of cloud security posture management services

To better secure the cloud control plane, CISOs and security teams should consider deploying cloud security posture management (CSPM). These tools help businesses manage how increasingly complex cloud environments are configured. With CSPM, firms can have continuous insight into business cloud compliance policies. It provides automated services that detect and resolve compliance violations and enforce business internal security policies.

Additional benefits include the power to monitor cloud operations, manage incidents and provide the appropriate response at a tactical and strategic level, from banning users to changing cloud providers in extreme cases. CISOs can also use it to identify likely risks as well as perform part of the cloud asset management task for account and service

A combination of all of these proactive measures will help minimize cloud security risks and promote good practices across the business. It can also help identify where training and awareness is required. For IT leaders seeking to tame the cloud, each element has its benefits and should be employed as part of a multi-layered approach to defending and protecting the cloud.

Further reading:

• The Cloud Security Buyers Guide
• 4 Common Multi-Cloud Security Challenges (and How to Solve Them)
• ​5 Steps to Build a Successful Cloud Center of Excellence
• 12 Best Practices to Maintain Cloud Security