- The most effective security is proactive security.
So look at your own requirements first,
then continually monitor and update your threat assessment
based on current and future threats.
Clouds are basically complex distributed systems,
and Cloud security can be broken down
into two types of domains.
Business security and the business domain.
Technical security and the technical domain.
Each should be equally well understood.
Business domain is all about dealing
with the business side of security,
audit and assurance for example.
This means that we're building our security solution
with audit in mind,
either from internal auditors or from outside agencies.
Anything that we address as business requirements
should be on the list.
This really answers the question, what needs to be done.
The technical domain deals with anything technology related,
including architecture, technology and tools.
It's here that you define the how of your security solution,
getting down to the types of technologies,
even the name brands that you'll likely leverage.
It's important that you define both domains in detail,
and take your time in doing so.
Missing something here could mean that you fail an audit,
or out of compliance, or worse, suffer an attack.
It's also helpful that you start your journey
to the Cloud security by understanding
what you're dealing with,
doing detailed analysis and making recommendations
as to how the problem should be solved.
Discovery is just that.
Understanding what you're dealing with.
This is where you define what the users are doing,
what data exists, and how it moves current security issues,
things like that.
Assessment means that we're looking at the data
that we just gathered, and coming to certain conclusions.
For example, is the security solution keeping us
in compliance, and what are the other risks
that are currently present?
Recommendation means that we understand
the needs of Cloud security in detail.
And now we're going to make the recommendation
for both business and technology solutions.
Carefully assess your Cloud security needs
within the two domains of business security
and technical security.
While security in the Cloud is typically much better
than with on-premise security,
it does take a bit of planning and an understanding
of what's being protected.
I urge you to follow the guidance here
to get your most secure Cloud in place.