Nick Chadwick

Understanding where your company’s data is physically located may be very important and is known as “data sovereignty.” Laws for where privacy data is stored is highly regulated. Replicating data across cloud regions is great for availability and durability, but configuring those cloud regions is very important to consider and manage.

Communicating cloud security typically means translating the vendor jargon and specific product names and options into comparable on-premises datacenter examples. Those in charge of enterprise clouds usually exist in-between on-premises and cloud meaning there are traditional IT executives in charge. These IT managers/executives typically came of age working with physical and virtualized servers and networking hardware. With a startup or small company this is less of the case, but in larger older companies this is the norm with managers ages typically between 45-60 years old. Cloud may only mean “someone else’s datacenter” to this age group since they have zero experience with the hands on technology they now manage.

Data compliance is complex especially in the cloud. Getting a solid compliance tracker & monitoring tool/service setup is a must to provide technical and legal validation of compliance with laws and regulations. There are some built in compliance tools that are infused with AI services with each cloud provider. Additionally there are several SaaS based tools for automating this compliance such as CloudCheckerMx, McAfee MVision, and Palo Alto Prisma to name a few. If compliance is done with your own IT staff ensure they are certified in Cloud Security for that particular cloud vendor to enable use of specific services that provide similar capabilities.

Beginning with an Infrastructure-as-Code (IaC) Landing Zone, cloud security automation must be codified where it is modified in a stateful way with version control. The single biggest contributor to cloud security misconfiguration is complexity and lack of transparency. This includes security engineers comfortable and skilled in git (version control), branch management, managing Terraform, and cloud specific IaC like AWS CloudFormation, Azure Blueprints/ARM, and GCP Cloud Run. Use of monitoring tools and alert automation include AWS Lamda, Azure Functions, and GCP Functions, but must be paired with monitoring and alerting services to kickoff workflows and mitigate the effected area rapidly/instantly upon a breach. Automation = Speed.