How to Bake Cloud Security into your Infrastructure

Cloud migration—whether to a public, hybrid, or multi-cloud environment—is essential for financial services organizations looking to keep up with competitors. But as you prepare to migrate, remember this: you cannot reap the benefits of the cloud without making security a priority from the start.

Hopefully, this is something you already know. More than 90% of cybersecurity professionals worry about security in the cloud, and firms in the financial services space deal with particularly sensitive data.

For cloud migration to succeed, organizations must have an established cloud security policy in place before the process begins. Data security specialists cite misconfiguration as the biggest threat for public cloud users.

Here are five steps to ensure security is baked into your cloud infrastructure from the start.

1. Plan, plan, plan!
Moving to the cloud should follow a standardized approach. Far too often, though, rapid results are prioritized over security. But security must be considered from the very beginning—before any data is migrated off-premises.

It’s much more effective to move to a cloud solution that has all the necessary security layers in place at the start. To that end, be sure to assess the data security protections of any potential cloud services providers. Many providers use a shared responsibility model in which they secure their own software and hardware, but customers are responsible for securing their own data.

Additionally, carefully consider which assets and applications you plan to move to the cloud.  Financial services institutions may want to keep applications with highly sensitive data on-prem, while moving applications with less sensitive data to a public cloud.

By considering security upfront, you can ensure your organization’s cloud infrastructure is secure before any data is migrated. Thorough planning may get you off to a slower start, but it will save you trouble and money down the road.

2. Adopt a layered approach.
There is no simple “on button” for security, which is why a multi-layered defense is so important. Adding layers creates a vital safety net should something fall through the cracks.

To start, secure the perimeter with access protocols and controls. These allow you to manage who has access to what information. Unauthorized access is widely considered one of the foremost threats to public cloud security and protecting against it is very hard to do once systems are in use.

Next, layer in anti-virus protection, multi-factor authentication, patch management software, employee security awareness, and encryption. Most data security experts agree encryption is the best method for protecting sensitive information hosted in public clouds.
Finally, a managed SIEM provides real-time security analysis of data to proactively identify potential security risks. Leveraging machine learning and statistical analysis, it identifies anomalies, patterns, and trends that may indicate a current or future security risk.
As your business grows and new threats emerge, you can evolve and layer in additional controls as needed. But don’t go too crazy on tools, as too many can lead to confusion and obstruct visibility into your network.

3. Know where your data resides—and what’s most critical. 
As you ramp up security in the cloud, ask yourself: Do I know where my data is located? Do I have controls in place to protect it as it moves?

Knowing where your cloud data is stored—especially your “crown jewels,” or most sensitive data—can help inform security policies and ensure compliance with national and international regulations, like the General Data Protection Regulation (GDPR). If you don’t know where your most sensitive data is stored, you can’t protect it.

As you craft your cloud security policy, ask your provider if your data is likely to be moved around to different data centers to increase latency, meet SLAs, or mitigate data loss. Also, ask what controls are in place to protect it as it moves.


4. Revisit your policy often
Plan to review your cloud security policy annually—at the bare minimum. If you operate in an agile environment, tie your policy review to your rate of change.

You’ll also have to adapt policies as compliance regulations change. The recent introduction of new SEC cybersecurity guidelines is a good example of rules that financial services firms need to adapt to.

The bottom line is that security is not set it and forget it. You must consider it at the beginning of the project and on an ongoing basis.

5. Choose the right partner
Working with a managed service provider that bundles public cloud features with best-of-breed security solutions is a great strategy for keeping your cloud protected. When choosing an MSP, look for a partner that executes the necessary product testing to select the best vendor for each security layer and has the expertise to manage your cloud environment.

Also, consider the type of support the MSP can provide. ECI, for example, offers a 24x7x365 help desk with personalized support. It is an invaluable service, particularly for firms that are just beginning their cloud migration journeys.

For those journeys to succeed in both the short-term and long-term, you must have an established cloud security policy to guide your operations in the cloud, identify and mitigate vulnerabilities, and defend against cyberattacks—all before a single byte is migrated.
For more information on ECI’s cloud transformation services, contact us today.