Cloud Risk Management

如何评估云中的风险? 

要评估云中的风险，首先要确定谁负责 cloud security 风险管理:您或您的云服务提供商(CSP)? The shared responsibility model (SRM) stipulates that CSPs are typically responsible for managing risks to the underlying cloud infrastructure on which your business’ operations are running.

Internal security teams are typically responsible for security of those operations in the cloud, meaning they are responsible for making sure their own data – and their customers’ data – is properly secured. Once a team determines where their responsibilities lie and what exactly they’ll need to take a hard look at, it’s important to take into account that the assessment will need to take place in real-time.

云风险评估的4个步骤

1. Identify assets: Which cloud assets would have the most significant impact on your organization if their confidentiality, 完整性或可用性受到损害?
2. Identify threats: What are some of the potential causes of assets or information becoming compromised? Threat modeling is an important activity that helps add context by tying risks to known threats and  vulnerabilities and the different ways threats can exploit risks and disrupt an entire company’s operations.
3. Prioritize risks报告通常在前两个步骤中建立和传播, 因此，在这个阶段可以考虑到上下文. Key criteria one must keep in mind when adding context is knowledge of the existing threat landscape and consideration of how threats may evolve.
4. Act: Now would be the time to implement remediation controls: applying a patch for a vulnerability, instituting a firewall rule, ensuring 身份和访问管理(IAM) 协议已经制定并更新.

管理云中的风险的最佳实践

选择信誉良好的云服务提供商

重要的是要选择一个CSP，它不仅支持SRM的末端, 但这也是一个有多年经验支持的决定, 可靠的法规和遵从性标准, 随时间变化的一致性能, 以及他们的服务/架构与您的需求的匹配程度. A security team must also ensure their scanning tools can fit into the workflow you define within that CSPs platform.

Things happen fast in the cloud, 风险通常在第一次暴露的两分钟内就被利用了, meaning you should be able to access real-time visibility into your environment at any given time instead of waiting for a scheduled scan.

进行彻底的风险评估 

Regularly conduct risk assessments via the steps outlined in the previous section. 从过程的前两个步骤收集的数据, however, 仍然面临着规模的现实, speed, and complexity of cloud environments creates a situation where the amount of risk signals/alerts is so vast you simply can't address everything at once.

As such, it’s imperative to prioritize the risk signals that present the most risk to the business and have the highest likelihood of exploitation. 这需要在完整的背景下实时完成, 因为风险信号本身并不能提供采取行动所需的全面细节.

Monitor for anomalies

Extend coverage into runtime and monitor for anomalous activity based on an established baseline of what "normal" looks like. Detecting anomalous behavior – and thus potential threats – into runtime helps to correlate behaviors across multiple logged activities. It’s best to target a solution that can consolidate runtime threat detections and provide context by associating the findings with the affected cloud resource.

调查结果和背景什么都不是, however, 如果没有人意识到这一事实，就会发生异常情况. Teams should calibrate notifications and alerts to go to specific personnel who can most quickly remediate the issue.

加密传输和静止的数据 

Data is sensitive at any state, so it’s important to implement risk- management tools as early in the development process as possible. 这有助于避免团队之间的摩擦, 还可以在关键构建和运行时过程中持续保护数据. Data should always be encrypted at rest by default.

In this way of protecting data at all times, it’s probably a good idea to also establish a least privilege access (LPA) protocol. This helps to set the minimum amount of access a person or machine will need to do the job, 同时在数据的整个生命周期中保护数据.

云风险管理中的业务连续性

In the event of a significant cloud-security incident, it won’t be business as usual. However, business can and should certainly continue to whatever extent possible. Therefore, it’s critical to have a business-continuity plan in place in the event of just such an incident. 该计划的一些关键组成部分包括: 

• Disaster recovery:这是SOC恢复正常业务操作流程的时间. 如果在利益相关者和分析师需要数据时无法获得数据, 需要有一个适当的计划来尽快恢复它. Documentation is key to disaster planning so teams can understand what will and will not be part of your backup system. 维护一个完整系统的副本是非常昂贵的, 因此，灾难恢复计划可能只考虑部分恢复.
• Backup and restore procedures: Having an automated, offline backup can help to smoothly recover from a destructive virus or ransomware attack. The key here is to have scheduled backups that are usable for restore operations. Outdated backups are less valuable than recent ones – though better than nothing – and backups that don’t restore properly are of no value. No one wants to engage in stressful, frantic scrambling and costly downtime/data-loss.
• Incident response planning: An incident response plan should include buy-in from key stakeholders; clearly defined roles, responsibilities, and processes; and technologies and partnerships to enable quick action. 当检测到异常或发生违规时, it’s certainly worth it to know the steps that need to be taken and who needs to take them.
  
  Perhaps the most important aspect of business continuity is reporting and communication of risk to all stakeholders in the organization, 无论是从高层到领导层，还是横向到其他团队.

阅读更多关于云风险管理的信息

2022 Cloud Misconfigurations Report: Latest Cloud Security Breaches and Attack Trends

了解Rapid7的云风险管理解决方案

云安全:博客的最新消息