- It's been my experience
that security is the most important aspect
of any cloud project
because an unsecure cloud will quickly fail.
Make sure you understand the security options,
including certain security models, technology, and tools.
Be proactive is the best defense.
Make sure that you focus on monitoring
and taking corrective action.
Cloud security requires that we understand the very basics,
such as being reactive to the ultimate insecurity solution
where you can be proactive or spot issues
before they become real problems.
Let's use this knowledge to understand the differences
between basic layered tools and integrated tools
and how the tools may be proactive and/or predictive.
After using integrated tools is the first time
that we reach minimum viable cloud security,
which is good enough.
Most enterprises, however,
should set the objective of being predictive
and thus the most secure.
An effective action plan is to deal with the basics first.
This means that we'll set the foundation of security
that provides the minimum amount of security that we need.
Understand that the maturity model presented
in the last slide is progressive.
Be proactive, meaning that the heart
of any good cloud security architecture and technology
is the ability to spot issues before they become problems.
By the time a hacker has access to your data,
it's too late,
but you can easily see how they progress to the point
and stop the attack before it becomes an issue.
Leveraging standards are needed to achieve business benefits
while encouraging adaptability, flexibility, and innovation.
This means that we should leverage
the many security standards with productivity in mind.
If using a standard not required by law means
that we're making the end user less productive,
then perhaps it should not be used.
Provide clarity in security policies,
standards, processes, roles, and accountabilities.
Security is as much a people issue
as it is a technology issue,
and thus we need to focus on what roles and processes exist.
For example, it's the job of the DBA,
or database administrator,
to report strange activity on the database
to the security administrators
so that the issue can be looked into.
If anybody takes the position that it's not their job,
this could be a clear indication
that a breach could be unnoticed.
Measure and communicate results.
Drive continual improvement.
Build on existing capabilities.
This means that we're also looking to improve,
thus there is a sound feedback loop that exists
that allows the cloud security administrators
to improve cloud security ongoing.
In some instances,
this could be moving to a new level of encryption
for data in flight and at rest
and that's more secure and easier to manage.
Cloud security requires
that we understand all aspects of security
from being reactive,
all the way to being able to be predictive
and spot issues before they become real problems.
The core idea here is to craft the right security strategy
and technology stack
to meet the needs of the cloud deployment
and thus the needs of the business.
Follow these guidelines,
and you'll have a first-rate secure cloud.