5 Things to Consider When Transitioning to the Cloud
Tags: Ciso, Cybersecurity, Cio, Cloud, Infosec

5 Things to Consider When Transitioning to the Cloud Fletch Jun 17·5 min read

Image source: Unsplash

A cloud-based business can boast many efficiencies that an on-premise counterpart may not. In a new remote work economy and almost every organization having technical facets, cloud migration is a prevalent mechanism across sectors.

There are many benefits to becoming a cloud and Saas-based business, but costs could stem from leaders neglecting to reshape how they think about their business, infrastructure, and security.

Risks Associated with Migrating to the Cloud

The most significant risks associated with migrating to the cloud often stem from the fact that organizations think they can transition the same practices they’ve followed while on-prem directly to the cloud.

If you take your on-prem ideals with you, you risk not reaping the benefits of the cloud and fall more susceptible to risk. It’s best to reimagine your security policy based on how your infrastructure and operations will look across your new cloud and Saas applications.

Additionally, since you don’t completely own your perimeter in the transition, don’t assume you can trust your cloud providers to secure your perimeter. Making this transaction requires strategizing how security policies should change.

Here’s what you should think about when making the transition:

Acknowledge the transition won’t happen overnight

Expect the move to the cloud to be a journey, not an overnight event. This is key to avoid becoming overwhelmed and pressured to tackle all issues at once. The move will save you money and grant you efficiency and elasticity. But don’t buy up a bunch of services with features that are not needed simply because your peers are doing it, or your board may be mandating it. Instead, push back and remind your organization to be agile and find the best people to learn from before making a blind purchase. Accept responsibility for new infrastructure

Don’t adopt the cloud and keep your on-prem mindset. Be wary of the changing threat levels that come with adopting the cloud and the decreased control over your environment. Your engineering team will now be responsible for securing your assets in the cloud, and to support them, it’s best to automate wherever you’re able to. Foster a partnership between your IT and engineering teams

A transition of power happens with cloud migration in terms of security measures now being owned partly by your software providers and your engineering teams. This means you will need to create a deeper partnership with your IT and engineering team to work closely together. Understand new security risks

Shifts to cloud infrastructure incite new norms around information-sharing between departments within your organization. As a result, employees need heightened access to various documents, making it trickier for security teams to identify abnormal behavior and insider threats. Additionally, as teams have had to work remotely due to COVID-19 and consequently experience burnout, distractions, or fatigue, employees are likely to fall for external phishing scams. To mitigate risks, you can limit the number of applications and features to use and train all of your personnel to be competent in detecting scams, as well as internal malicious or abnormal behavior. Don’t assume your cloud providers will secure everything for you

Your cloud providers have your back in securing your perimeters with firewalls. However, when it comes to the software you’re running, how you configure things, and whether or not a bucket is open for the world is your responsibility to monitor.

As businesses move away from physical, on-prem data centers to the much more flexible, efficient, time-saving, and cost-effective cloud-based applications, the journey can be complicated.

To ease the pain and help optimize the journey ahead…

Educate employees on new security policy

Once you create a new security policy, make sure your company is educated on it. Your organization will be more secure when employees understand that security isn’t for the benefit of security and IT teams only and just checking boxes, but rather for solving a real business problem and keeping the company and its customers safe.

Once you create a new security policy, make sure your company is educated on it. Your organization will be more secure when employees understand that security isn’t for the benefit of security and IT teams only and just checking boxes, but rather for solving a real business problem and keeping the company and its customers safe. Focus on the behaviors of people and machines

The need to monitor behavior for anomalies quickly and efficiently is skyrocketing. User behavior analysis takes care of this, but the tools tackling this issue have fallen short of being reliable, transparent, and accessible in the past. The emergence of new technologies, automation, and natural language processing can quickly let you know in human terms whether somebody is behaving oddly by accident or if their account is compromised. New tools will also be able to determine whether a machine is malfunctioning because it’s set up wrong or if it’s hacked.

The need to monitor behavior for anomalies quickly and efficiently is skyrocketing. User behavior analysis takes care of this, but the tools tackling this issue have fallen short of being reliable, transparent, and accessible in the past. The emergence of new technologies, automation, and natural language processing can quickly let you know in human terms whether somebody is behaving oddly by accident or if their account is compromised. New tools will also be able to determine whether a machine is malfunctioning because it’s set up wrong or if it’s hacked. Set best practices that are right for your business

Pay attention to how your CSA controls have followed frameworks like SOC2 or HIPAA, and put together a plan that gives you the visibility you need across your infrastructure. Then, establish best practices to build your new infrastructure and eliminate gaps accordingly. Automation and new technologies can help you continuously monitor and discover gaps within your cloud controls on an ongoing basis and prioritize accordingly to mitigate any issues.

Pay attention to how your CSA controls have followed frameworks like SOC2 or HIPAA, and put together a plan that gives you the visibility you need across your infrastructure. Then, establish best practices to build your new infrastructure and eliminate gaps accordingly. Automation and new technologies can help you continuously monitor and discover gaps within your cloud controls on an ongoing basis and prioritize accordingly to mitigate any issues. Keep emerging cyber threats in mind

Each time there is a cybersecurity scandal in the news, it’s easy to fall down a rabbit hole of constantly asking yourself if you’re vulnerable or impacted. The best way to mitigate risk is to tag and organize your assets, identify where your crown jewels lie, which applications and files are most important, and where your customer data is stored. Then, implement new technology to triangulate your priorities and the attacks emerging every day to confirm you are focusing on the right stuff and protecting your most valuable assets.

To learn more, check out this conversation with Fletch’s CEO and Founder, Grant Wernick, for more guidance on tackling migration to the cloud.

If you are interested in learning more about how Fletch can help as you take on adopting the cloud and all of its flexibility, please contact us at uba@fletch.ai or sign up for a demo on our website.