Securing a hybrid environment is quite different from securing a traditional one, posing challenges especially for organizations with stringent regulatory requirements and/or more entrenched processes. Here are some common areas where you can expect to see issues surface:
Shared Security Responsibility
Make sure you understand what aspects of security fall to your providers and which fall to you. It’s important to ensure your providers can hold up their end of the deal and meet your compliance needs. Make business continuity plans part of any SLA to ensure the providers meet their uptime obligations, and have a disaster recovery plan in place to ensure your data and applications are protected.
Incident Handling
If an incident occurs within a cloud service provider's infrastructure, you'll need to work with them to resolve it. Other issues—such as potential commingling of data in multicloud environments, data privacy concerns that complicate log analysis, and how a provider defines an incident—can add to the challenge.
Application Security
Cloud apps can be exposed to a wide spectrum of security threats, and there are dozens of products built to solve individual pieces of the problem: software development life cycle security; authentication, compliance, app monitoring, risk management, and more. Managing all these individually is a massive logistical challenge, so you’ll want to look for an offering that combines as many of these functions as possible.
Identity and Access Management (IAM)
IAM is key to controlling access to resources, apps, data, and services. Its use changes significantly in the cloud, which often requires multifactor authentication to ensure secure access to resources. As you begin or extend your transition to the cloud, make sure you have the right management solution in place to avoid frustrated users and a deluge of trouble tickets.