End-to-End Cybersecurity in a Cloud-Native World – ETCIO

Organizations all over the world had to accelerate their digital transformation agenda in order to cope with the distinguished challenges raised by the COVID-19 pandemic. In these unprecedented times, technology turned out to be the greatest enabler for businesses in virtually every domain. Businesses of today are leveraging cloud computing, AI & ML, and blockchain-driven solutions to achieve scalability of operations and business efficiency. Cloud in particular, has become a key enabler for companies that are going through a digital transformation journey. From maintaining operational continuity to driving innovation and expansion, cloud is at the core of business growth strategy. However, the ever-expanding cloud footprint has increased their susceptibility to sophisticated cyberattacks.

With this backdrop, Palo Alto Networks in association with ETCIO.com organized a closed-door discussion, wherein industry leaders deliberated on the upcoming cloud security challenges in the face of dynamic and new-age cyber threats, as well as best practices to drive consolidated cloud security.

Shipra Malhotra, Executive Editor, ETCIO.com, moderated this session. While moderating, Malhotra pointed out, Cybersecurity threats are getting increasingly complex and the attacks are becoming more and more sophisticated. This calls for a very consistent and integrated approach that provides complete visibility and a granular control across the entire cloud estate. This can be done by simplifying cloud security through an integrated architecture across the life-cycle of your cloud journey.

What are the challenges in terms of cloud security, especially in multi-cloud environments? Priya Kanduri, Lead - Cybersecurity Practice, Happiest Minds, opined, The biggest challenge facing cloud-computing and security is the lack of a security strategy itself. Some of the organizations that started with legacy systems and then shifted to cloud still face operational challenges linked with cloud-computing and SaaS because they failed to formulate and execute a clear strategy. Additionally, some of the DevSecOps challenges are still not fully resolved due to the lack of understanding and awareness about such technologies. Rudimentary challenges like having security built in from the beginning of cloud adoption, having a clear strategy, finding the right tools and bringing them together in the right manner, and having the right platform to facilitate cloud computing still persist.

Commenting on the concerns of people regarding cloud adoption in legacy companies, Vipin Rustagi, CIO, Duroflex, said Organizations that are a part of the traditional consumer goods setup have to convince their people that cloud is secure, since they are very possessive and particular about their data. The major concern such organizations have regarding adoption of cloud technology are around data security. There are also concerns regarding over-exposure and siphoning of data from the cloud storage, since data stored on cloud is available on public access.

Ensuring data security in multi-cloud environments

Ruchir Patwa, VP - Security and Compliance, MPL, highlighted the correlation between cloud security and visibility by stating, Cloud visibility helps an organization figure out its possible attack surfaces. Once the attack surface has been identified, the organization must start its management to mitigate potential attacks and data breaches. Companies that have taken their operations to the cloud must automate cloud control and security. Trivial processes like rotating keys and revoking access after a certain period of time must be automated.

Accentuating the ways in which data security can be ensured in cloud-computing, Nitin Kotwal, Head - Cybersecurity, MoEngage, said, Three basic rules need to be followed to ensure data security in a multi-cloud environment. First, stick to the basics - cloud security guidelines and procedures must be followed at all cost. Second, integrate security in the cloud life-cycle. The organization must define quality gates for security at every stage of the cloud life-cycle to ensure maximum levels of security. All the compliances, regulations and guidelines related to cloud security can act as quality gates. Third, adapt new and emerging technology solutions to resolve the complexities and challenges that you face.

Navaneethan M, Senior VP & CISO, Groww, said, The development team has to focus on speedy delivery due to which, installing a proper security and enforcement framework might take a back seat. At the same time, the DevOps team is also under pressure to fulfill all the requirements of the developer. Everybody has their own set of requirements due to which, the security aspect might get undermined.

Bhagwan Kommadi, Director - Technology and Product Engineering, Infinity Learn, pointed out how employee negligence can impact information security, Companies must organize sessions and seminars for new joiners highlighting the importance of data and information security. Most of the time, negligence of an insider becomes the root cause for cyberattacks and data breach. People often write passwords and other confidential pieces of information on their tables or on sticky notes. These trivial mistakes can pull down information security. Therefore, employees must be warned against such inadvertencies during the induction.

Emphasizing the need for incorporating security at the early stages of cloud development, Sandeep Variyam, Cybersecurity Advisor, Palo Alto Networks, said, A cloud infrastructure must be secure by design. Organizations must have a strong development procedure in place, with security checks at regular intervals that starts with coding and as it moves to the further stages, security automatically helps to resolve the issues that arise. If an organization is able to do a lot of automation in the code to cloud life-cycle then it can save a lot of manual effort as well.

Organizational strategy around cybersecurity and managing cloud apps

Shashwat Singh, CIO, Boat, shared his organizations approach towards cloud infrastructure development and cloud security, We leverage a maker-checker approach to inspect our cloud infrastructure(s). There is one partner who is responsible for setting up the cloud infrastructure, while the other one is responsible for finding all the inconsistencies and inaccuracies in the cloud at each stage of the development process. Their primary KPI for us is to find out any issues that might potentially be in the cloud infra. So, we have two partners working in tandem one is setting things up for us and taking operations to the cloud while the other one is constantly monitoring it. That is how we manage our cloud systems.

During the roundtable discussion, Amit Khandelwal, Senior VP & Head - IT and Digital Business, Visionet Systems Inc, mentioned, We ensure that our developer community is aware of DevSecOps and all the tools and techniques that fall under its ambit. We also run a variety of sessions focusing on the same.

As businesses expand their cloud footprint, adding multiple cloud vendors and creating a hybrid environment, managing cloud security across the entire lifecycle, from inception to build to operations, has become more complex than ever. In order to secure their cloud infrastructure and mitigate the possibility of a potential cyberattack, organizations must institute a strong security framework in the early development stages. With more and more businesses taking their operations to the cloud, the need for cybersecurity is stronger than ever.

View post:

End-to-End Cybersecurity in a Cloud-Native World - ETCIO