Check if you take these security points into consideration before you migrate to the cloud.
While you move your infrastructure into the cloud (“lift and shift”), your security assumptions also go through the change, since the on-prem threat model and security priorities are very different from cloud-based. And it’s always less stressful to get well-prepared
for changes than botch along the way, especially in fintech and modern finance.
Consider the following points.
1. Weigh your security engineers efforts against the cloud providers’ responsibility.
Often when you lift and shift and push your assets to cloud computer/storage, you continue treating it as your own hardware in terms of the system’s design. Many companies continue to spend time on patching, keeping components up-to-date, managing accesses
manually, etc. Understandably, companies don’t trust cloud providers (read my post about
cloud security).
But here are some things to consider: what are the odds that vendor's engineers bulk-misconfiguring some service for all their customers? Wouldn’t it be better to refocus your thin security budget on securing your applications and data, and not doing the
cloud provider’s job?
2. Mind attack vectors and risks specific for a cloud provider.
Generally, you can face 4 large attack vector groups:
- 1st group: cloud provider insiders (a rare thing,
but happens).
- 2nd group: adversaries targeting cloud providers (rare thing as well).
- 3rd group: leakage of your credentials for management of your cloud resources (basically equates “lift and shift” to “cloud-native” development).
- 4th group: adversaries targeting your cloud deployment specifically (well, cloud-native deployments have a better chance to withstand such attacks than “lift and shift” ones).
And remember about an advanced adversary that can attack your cloud providers to compromise you.
3. Mind supply chain vulnerabilities.
As soon as you trust a 3rd party supply chain, you do not manage/control it in full since, in fact, you trust numerous open-source and closed-source components involved you’ve no idea about.
The good news here is that you might have nothing to lose, but are you ready to trust your cloud provider that much? The answer is always about the balance between your system’s risks & available resources.
4. Build defense-in-depth.
When you lift and shift and unburden yourself from dozens of everyday concerns, use this chance to strengthen your security posture.
In security, we add layer by layer to make your defence stronger and bring you peace of mind.
Instead of spending time re-doing cloud provider’s work, focus this energy on actually securing your unique applications and doing all the things you’ve had an excuse not to do for ages.
For example, you can encrypt your data during the whole dataflow, invest in IaaC, deterministic builds, proper threat modelling and architecture design.
---
This blog post is written by Pavlo Farb, a Security Engineer at Cossack Labs. We help companies to protect their sensitive and valuable data.