Over the last few years there has been rapid adoption of the public cloud primarily propelled by the following:
- Emerging technologies such as Docker containers & Kubernetes
- Increased appetite for cloud native applications
- Increased need to modernize monolithic applications using microservices etc.
More and more enterprises are embracing a multi-cloud strategy for a variety of reasons such as:
- Avoiding vendor lock-in
- Cost savings etc
The above trend has created a new set of problems for the multi-cloud administrators and auditors. For example, with respect to managing authorization policies, the administrator has to now understand the different tools and suitably configure authorization policies. This can get very complicated for the following reasons.
- The user interfaces/APIs are generally very cloud vendor-specific.
- There is no consistency in the terminology and representation of any given resource.
- The operations that can be performed on the resources may not be the same, and even where they are the same, the operations may be named differently. Also the granularity of the operations that can be performed may diverge significantly such that consistent separation of duties may not be achievable or overly complex to configure correctly.
Dealing with a myriad of tools and more importantly the silo’d nature of those tools and the inability to having a common or consistent set of authorization policies in such environments would ultimately result in poor security configuration of the multi-cloud environment and hence can become an easy target for exploitation.
In this article we highlight some of the key concepts and themes that are fundamental to HyTrust’s approach to securing multi-cloud environments. These are being implemented in our flagship HyTrust CloudControl product version 6.0 that is currently in early access and slated to be generally available in early 2019.
Key Concepts and Themes
First and foremost, security starts with visibility of the assets in a given enterprise. You cannot secure what you are not aware of. Today, in a multi-cloud enterprise, one has to use the respective cloud vendor-specific silo’d consoles to get perspective of the inventory. HyTrust CloudControl 6.0 provides a comprehensive view of all the resources based on the following principles:
- Unified, consistent and normalized view of all resources in a multi cloud environment using an abstracted inventory data model. Today, one has to log into the AWS console to view the AWS EC2 instances and to VMware Virtual Center to view the vSphere VMs etc.
- End-to-end view of the related resources and their context. For example, it is very important to know if a container is running on a VM or on bare metal so that the related resources could be properly secured.
- Consistent and consolidated view of all the audit logs for the various operations performed on the resources in the multi cloud. Today, one has to look at Cloud Trail logs for AWS operations and VirtualCenter logs for vSphere events.
2. Unified Policy
In a multi-cloud world, workloads are likely to move from one public cloud to another and it is very important to maintain a consistent security posture. Today, configuring security policies across multi-cloud requires deep understanding of the intricacies of the respective cloud platform. The heterogeneous nature of the cloud platforms makes it very difficult to configure consistent policies.
HyTrust CloudControl 6.0 provides a single pane of glass for configuring various security policies across a multi-cloud environment. For example, when it comes to configuring access control policies, HyTrust CloudControl provides a notion of abstracted roles that are made up of abstract operations. For example, there could be an abstract role called VM_User_Role that would be made of the following abstracted operations:
Such abstracted roles would be suitably provisioned to target platforms using their respective Identity & Access Control APIs. For example, for AWS suitable managed policies would be generated in JSON and provisioned to AWS IAM.
So with HyTrust CloudControl, administrators could centrally define access control policies without having the knowledge or understanding of the cloud platforms and instead rely on HyTrust CloudControl to do what’s needed to suitably provision policies onto the respective cloud platforms. Similarly one could centrally define and manage policies for other security controls such as configuration hardening, secondary approvals etc.
3. Security Automation
To keep up with the dynamic nature of the cloud and the rapid pace at which DevOps is pushing new builds into production environments, security needs to be agile as well.. HyTrust CloudControl 6.0 has taken a declarative approach to security and various security policies could be defined as code thru YAML documents called Trust Manifests.
The Trust Manifests could be authored through a rich intuitive UI or directly using a favorite editor such as vi or emacs. The Trust Manifest would be made of different sections each corresponding to a security policy type such as access control, configuration hardening, deployment control etc.
Such Trust Manifests could be assigned at various levels such as AWS accounts or Kubernetes clusters or namespaces and security policies would automatically apply to new resources as and when they are created under them.
To learn more about HyTrust approach to securing multi-cloud environments and our upcoming HyTrust CloudControl (HTCC) release 6.0, with support for securing AWS & Kubernetes, please watch to our recent webinar on this topic.
Fill out this form to be one of the first organizations to try out HyTrust CloudControl 6.0 for Containers via our upcoming Early Access Program.