Understanding What’s In My Cloud
Today’s business applications run in an environment that would be unrecognizable to IT professionals 10 years ago. The rise of virtualization and the cloud has finally cut the ties to specific hardware, and all but the most exotic workloads can now be run anywhere — on virtual machines in your physical buildings, or on a cloud vendor of your choice. The underlying cloud technologies are powerful, but with that power comes great responsibility. Security teams struggle to keep up, because the new technologies focus on agility, rapid rate of change, and dynamic response — all of these are positive buzzwords to most people in a business, but all of them are bad news to security. Ask any military commander — defense is far easier when your resources are home in a well-built fort, and far harder when your troops are constantly moving, shifting location into unfamiliar terrain.
It’s not all doom and gloom, however. Cloud innovation takes away certain legacy risks — after all, you can’t leave an open password on a key router in the middle of your network infrastructure if you don’t control the routers any more! The trouble is that the change to new ways of building and managing modern apps (often referred to as DevOps) closes out some old challenges, but opens just as many new ones. Cloud gives you new kinds of rope, and it’s different from the old rope, but you can still get just as tangled up in the complexities.
Some security fundamentals remain, though. No matter what kind of infrastructure you own or rent, you still need to pursue the basics:
1. Find all your stuff
2. Categorize it so you know what’s most important
3. Harden the individual elements to avoid easy compromise
4. Map out and run your defenses as a system, so you can be a hard target
The most basic discipline of all is inventory — cyber security experts and industry guidance all agree that you must start there. Inventory in cloud is not like inventory in conventional networks, though, so the same old principle has to be thought about differently in a cloud world.
The good news with the cloud is that each virtual network has a “God of the Cloud” — a central controller, run by the cloud provider that you can talk to via a proprietary API. I call it a “God”, because no endpoints can exist in that small virtual network that the controller did not create. This means you can always find a completely reliable resource for each virtual network — someone who knows the inventory. Problem solved, right? Well, not so fast — it’s certainly very different from legacy on-premises networks, but that’s hardly all there is to it. There are three major problems when talking to each cloud controller — finding the controllers, speaking their language, and keeping up with the changes.
The good news is a cloud account comes with an API you can talk to and get a complete inventory of the assets it knows about. The bad news is your company has many, many accounts. And even once you locate them all, they will speak a proprietary and changing language — the Amazon language for the AWS API is different from Microsoft’s for Azure, or Google’s, or Oracle’s. You need a network linguist to make sense of it all, and pull together a single view of your clouds — in all flavors. And since security is central by its nature (because it needs to look at the complete picture), that means security has the unenviable task of needing to speak all the languages — fluently — at once. This is hard, but it’s a great job for automated software.
Equally, the rate of change in the cloud is something automated software can tackle far more effectively than humans can. Cloud assets have ugly names — often just a long stream of gibberish assigned by a robot, to make it easy for other robots. You’ll need your own robot interpreter to even identify one asset, let alone track it as it moves and changes. The nature of the cloud is highly dynamic — instances are spun up and killed on demand, and they move far faster than, say, a classic vulnerability scanner can keep up with. If you want to see your final as-built infrastructure (and you need to, since this is what your adversary is looking at too), you need software to keep up with all the changes, track the assets, and untangle the myriad ways that cloud assets are marked. There are tags, there are labels, there are unique ID’s, and there are security groups. Every vendor has subtly different rules, and just to add to the confusion cloud vendors don’t even agree on what a cloud network should be called, but they all offer the same idea.
At the end of the day, security is about adapting and keeping up, as the pace of change keeps speeding up. Cloud is just the latest evolution, where names change, details shift, but the core principles remain — first and strongest of all is inventory. This is why we at RedSeal build software to automate all the communication and mapping, so that you can visually scan your cloud footprint, understand your security posture, and make optimal moves to increase your security and reduce your risk.
For more information, check out our overview of RedSeal Stratus Maps and Inventory capabilities to learn more about how you can Map Your AWS Infrastructure Including Connectivity Paths.
