governance
and security just saying those words i
feel compelled to use a stern and
serious voice
i guess that's because those things
aren't frequently tied to happy times
rainbows and puppies
but what if i were to tell you that most
companies find their governance and
security efforts
actually improve when they move to the
cloud in this module we're going to talk
about security in the cloud and some
things to consider
to keep your cloud landscape safe
and we'll also cover governance and what
a cloud governance program
might look like in your business case
it seems not a week goes by without some
news story about a giant data breach let
alone
all those breaches that go undetected
so what is the most common cause of
cloud-based data breaches
is it nefarious hackers in their
stereotypical black hoodie hunched over
a glowing monitor
nope according to a 2020 survey of 300
cloud security professionals
the most common root cause for cloud
data breaches
is misconfiguration
human error so what can we do to help
minimize
our risk of misconfiguration well for
one
if we can minimize the human in the
process
then we should be able to lower the risk
of human error
no i'm not talking about the robot
apocalypse
rather i'm talking about automation if
we can automate how we set up and manage
our cloud resources
then we can be reasonably certain that
automation will do it the same way each
and every time without mistakes
we can also automate proactive scans
for potential vulnerabilities in our
cloud landscape
all the major cloud providers have
products and services
that help with automation and proactive
security measures
the second thing we can do to improve
our security is to encrypt
everything by encrypting our data it
will stay safe
even if it falls into the wrong hands
encryption at rest refers to
making sure your data is encrypted when
it's just sitting around
on the cloud on premise on someone's
laptop
examples of this are file encryption
like pgp
or full disk encryption like bitlocker
encryption in transit means that you're
using secure
channels when you're transferring your
data here and there
https on your browser is a method of
encryption
in transit and so is using a vpn
using both of these encryption types
together should be part of your normal
operating procedures
now the exact method of encryption in
your cloud landscape will vary with
cloud providers
but it's usually push button easy to use
and you really don't have an excuse
not to encrypt all the things and how
about
one other thing that we can do to be
more secure in the cloud
training if you've watched my other
modules you saw that coming from a mile
away
the simple fact is the more skilled a
person is the less likely they will
misconfigure something
not saying it's not going to happen but
there is a reason why we hold
experience in high regard when it comes
to skilled people
so i will yet again beat my drum for
investing
in a comprehensive and continuous
training program
for anybody who might be touching your
cloud resources
when i say cloud governance most people
immediately associate that word with
bureaucracy restrictions
red tape and just general inefficiency
however a good cloud governance
framework should improve efficiency and
accelerate things but
that sort of thing doesn't happen
without a lot of hard work and careful
thought
when i'm talking about cloud governance
i'm talking about how we just avoid
complete cloud anarchy now in the early
days of cloud
exploration and proof of concepts things
are small and
simple and fairly easy to manage but as
things grow and scale
you can quickly end up with a big
unmanageable and dangerous
mess governance is how we can create the
conditions
for order efficiency and ease of use
a cloud governance framework will
usually have
several components first you'll want to
define
who and how decisions get made involving
cloud
matters now that could be something like
a cloud
architecture review board or maybe just
a single person but
ultimately you need to have a single
point of responsibility and
accountability
next you'll want to define some common
standards and practices
and for example maybe you agree to use
the same versions
of an operating system or software in
your cloud landscape
you'll also want to define what sorts of
data you will allow in the cloud
only non-confidential data no customer
data
any data as long as it's encrypted it's
important to make sure that
everyone knows the rules of the road
at some point early in your cloud
migration you're going to want to define
some cost control
processes and guidelines now it could be
as simple as an automated report on cost
accruals or
maybe an allocated budget per department
when you're just getting started in the
cloud it is not unusual at all for your
costs to be higher than you anticipated
and this is because people are still
learning and exploring
now as your cloud landscape becomes more
stable
you should be able to really hone in on
the most efficient and cost effective
options
now depending on your cloud provider of
choice you'll have different options
available to you
on how you can optimize your cloud
spending
if you are in a regulated industry you
want to be sure your governance includes
those considerations as well
now all the major cloud providers have a
wealth of information
on various audits and attestations for
common industry standards like pci dss
iso 27001 and sock reports
in the early days third-party auditors
weren't that familiar with the cloud
life but
nowadays most auditors are well versed
in upholding those
industry standards across hybrid and
cloud landscapes
governance and security are big topics
in the cloud world but
they shouldn't be feared or dreaded if
they just create a layer of bureaucracy
and slow things down then
you're doing it wrong approach
governance as a way to
empower and enable your organization to
maximize their cloud value
avoid costly problems and generally
avoid all out
anarchy governance is a good thing