Top Five Cloud

Migration Security
Concerns

Bryan Batty
June 1, 2023
Copyright © 2022 HCL Software Limited | Confidential
Agenda

➢ Why the Cloud?

➢ One: Identity and Access Management
➢ Two: Compliance and Regulatory Requirements
➢ Three: Service Availability
➢ Four: Multitenancy
➢ Five: Insider Threat
➢ BONUS: Security Misconfiguration

.
2
.
Why the Cloud?

Cost Geographic
Speed Scalability Savings Reach

Security Must Enable These Drivers

.
3
.
1. Identity and Access Management - Risks

• User imitation
• Old accounts not revoked

.
4
.
1. Identity and Access Management - Impacts

• Data exposure
• Lost integrity
• Customer trust

.
5
.
1. Identity and Access Management - Mitigations

• Map roles and responsibilities up front

• Use the CSP native IAM
• Multi-factor authentication as default
• Proper access control

.
6
.
2. Compliance and Regulatory Issues - Risks

• GDPR
• FedRAMP
• CFIUS
• PCI
• Information Security Policy

.
7
.
2. Compliance and Regulatory Issues - Impacts

• Regulatory fines
• Lost business
• Lost opportunity

.
8
.
2. Compliance and Regulatory Issues - Mitigations

• Understand what applies to your

business needs
• Ensure your cloud provider meets
necessary requirements

.
9
.
3. Service Availability - Risks

• Server outage
• Denial of Service attack

.
10
.
3. Service Availability - Impacts

• Lost service
• Lost revenue

.
11
.
3. Service Availability - Mitigations

• Autoscaling and load balancing

• Backup and restore strategy
• Disaster recovery
• Classify and prioritize critical systems

.
12
.
4. Multitenancy Security Concerns - Risks

• Multiple customers sharing same

hardware
• Resource competition

.
13
.
4. Multitenancy Security Concerns - Impacts

• Breach of one customer could potentially

impact another
• Data exposure
• Unexpected downtime

.
14
.
4. Multitenancy Security Concerns - Mitigations

• Contract language that says you get your

own hardware ($$)
• Understand security measures put in place
to prevent that type of breach
• Protect your own applications and data

.
15
.
5. Insider Threats - Risks

• Careless employee
• Disgruntled employee
• Compromised account
• Privilege misuse/abuse
• Opportunity

.
16
.
5Insider Threats - Impacts

• Lost data
• Stolen resources
• Sabotage
• Fraud
• Theft of Intellectual Property

.
17
.
5. Insider Threats - Mitigations

• Insider Threat Program

• Anti-phishing program
• Behavioral analysis
• Zero Trust architecture
• Watermarks

.
18
.
BONUS: Security Misconfiguration - Risks

• Exposed cloud storage buckets

• Container run as root

.
19
.
BONUS: Security Misconfiguration - Impacts

• Exposure of sensitive data

• Introduction of variety of security
vulnerabilities

.
20
.
BONUS: Security Misconfiguration – Mitigations

• Utilize Infrastructure as Code

templates (AWS CloudFormation,
Azure Resource Manager,
Terraform)
• Automate security scanning of
templates
• Drift detection
• Continuous monitoring
• Security posture assessment

.
21
.
Summary

Start with Why!

Align Security Goals with Business Goals

Top Five Cloud Migration Security Concerns

1. Identity and Access Management
2. Compliance and Regulatory Issues
3. Data Loss and Service Availability
4. Multitenancy Security Risks
5. Insider Threats
Bonus: Security Misconfigurations

.
22
.