|
In the first section of this two part post on
implementing cloud data protection for Salesforce, we looked at identifying an appropriate cloud data
protection solution, encrypting Salesforce data and how to lock end applications to the cloud data protection gateway. In this second part,
we are looking at moving to the next level of cloud protection, threat identification, countermeasures and mitigation.
Continuing the 6 steps to securing your cloud application:
4: Implement stringent security countermeasures
Any cloud data protection
platform should utilize some form of countermeasures to protect end data. Countermeasures consist of automated responses
to security events. When the gateway detects an in-bound threat, it must have the capability to mitigate this threat.
Countermeasures should operate from a technical
standpoint at a firewall level and bubble up to an individual user. This granular focus ensures
that there is not a denial of service for the user base. Directed, individually focused countermeasures, should only apply to the user that
triggered it, and not disrupt the entire the user base.
An automated countermeasure may be to block the individual request and take no further action. Depending on severity and if other security
anomalies have been detected, the response may be to lock a user account, block the footprint and require the suspect user to perform steps
to re-establish their authenticity. The severity of response should be able to be adjusted to meet the security condition detected.
Far too often, security analytics (such as behavioural) operate distinctly from threat mitigation. Analysis engines detect anomalies and notify
the security team. Depending on work-load, these notifications are investigated or ignored. One case in point is the Target data breach. It is
widely accepted that the security team had "notification fatigue" and was thus not acting on all notifications.
Mitigating alert fatigue is done through automated countermeasures. These countermeasures respond to threat conditions without the need for human
interaction. This reduces the delay in threat detection and mitigation.
Countermeasures should be able to fingerprint individual users and their machines and determine legitimate users from nefarious ones. If the system
is unsure, it should at the very least challenge the authenticity of the user.
Unfortunately, there has been a complete and utter disjoint in the cloud data protection market in terms of the overall threat picture. It is absolutely
not enough to simply encrypt data, or study user behaviour. A cloud security solution must incorporate a complete set of security measures, rather
than just single individual pieces.
There is no point in encrypting information if an attacker can casually utilize a stolen username and password to transit through the cloud data
protection gateway, decrypting the protected data. The cloud security gateway must perform non-hostile user analysis and deploy countermeasures as
required.
5: Track and mitigate any anomalies immediately
Anomaly detection, tracking and ultimately mitigation must be performed without delay. Bringing delays into the threat mitigation process is a recipe
for disaster.
Cloud data protection gateways should not only be encrypting data going into Salesforce, they should be monitoring your users, establishing user
identities and understanding the various behavioral patterns of users. This level of analysis and rigor provides a strong defence against determined
adversaries.
Learning as users work with an end system is important in building a one-to-one security footprint. Set countermeasures should respond when a user’s
footprint changes in any distinct manner, or if they are acting differently from their peers.
Given where cloud data protection gateways sit in the network infrastructure stack, they have access to an incredible amount of useful information on
users. This information must be analyzed to ensure that the needle in the haystack is found. The security anomaly is not a myth. Basic analysis can
detect often otherwise undetected changes in behaviour that lead to data breaches.
Being able to act on behavioral data without delay is a fundamental piece to ensure that threats do not progress to a critical state. A robust countermeasure
system provides a platform to respond immediately to threats as they develop, rather than a typical system that notifies an administrator and requires human
intervention, which can impose critical delays.
6: Cloud security analytics, monitoring and visibility
The cloud, and indeed SaaS applications are known as Security Information and Event Management (SEIM) "blind-spots". The reason is, that these architectures
do not necessarily expose the low level logs that SIEM consumes. This SIEM blind-spot in itself is a security vulnerability.
Cloud data protection gateways can remove this SIEM blind-spot by providing their own logging and analytical data. This data can typically be consumed by
SIEM systems and thus remove the blind-spot that is the cloud.
However, raw data is not enough to provide security coverage for cloud applications. This raw data must be analyzed into meaningful identity aware metrics to ensure that
security conditions do not go unnoticed. Some cloud data protection vendors, such as StratoKey, offer an
in-built analytics engine that performs much of
the processing to make raw data meaningful within a security context.
Conclusion
There are no silver bullets in security. The best an organization can do is to layer appropriate defenses to build
Defense in Depth. Raising the level of
complexity for attackers ensures that organizations do not fall victim to the vast majority of non-Hollywood style data breaches. The type that are typically
opportunistically driven attacks, focused on either application vulnerabilities or user credential theft. By mitigating these attacks and controlling data
security with encryption, organizations have a fighting chance to avoid becoming yet another data breach headline.
|
