Dissolve your cloud concerns | How to de-risk your cloud transformation

Dissolve your
cloud concerns
How to de-risk your
cloud transformation
i
 Dissolve your cloud concerns | How to de-risk your cloud transformation

Contents

01 Introduction

02 Handling the shift: Two main challenges

Introduction
03 Governance and responsibility
Organizations in every industry are continually striving to evolve into more agile,
faster-moving businesses. They’re searching for ways to reduce friction, unlock

04 Develop a cloud security strategy innovation, deliver better customer experiences, and stay competitive in an
increasingly challenging world.

Cloud technology is often at the centre of such efforts, since it provides an agile

05 Focus on identity and

access management
environment that allows an organization to address its transformational needs.
Cloud services are typically easy to access and convenient to use—but they
can also create significant risks for organizations that don’t have the necessary
capability and capacity to adapt to the new model.

Organizations often fail to appreciate that setting up and managing technology

infrastructure in the cloud is substantially different than managing
on-premises infrastructure. This lack of understanding is at the root of major
cloud-related risks and security incidents.

ii 1
Dissolve your cloud concerns | How to de-risk your cloud transformation Dissolve your cloud concerns | How to de-risk your cloud transformation

Handling the shift: Two main challenges Reducing risk: where to start
• Understand what you’re already doing on the cloud. • Upgrade your governance to include cloud.
Legacy thinking, which can lead to vulnerabilities Review how your organization is already using cloud services. To reflect the realities of doing business in the cloud, the
Identify the related risks and the steps that have been taken organization’s IT governance model needs to be upgraded.
to manage or mitigate them. Determine which, if any, guard Set out clear accountabilities for cloud-based initiatives and
Technology teams sometimes bring a legacy mindset to These replicated legacy processes, practices, or
rails currently exist for the use of cloud. establish the rules of engagement to govern cloud use and the
their cloud implementations. Rather than taking time to systems may not be properly configured for cloud,
management of data on the cloud. Put in place mechanisms to
understand the features that are native to a given cloud unlike the optimized cloud-native offerings. These • Benchmark your efforts. To understand cloud-related gaps
service and to figure out how to incorporate them into misconfigurations can lead to new risks that leave detect when cloud-based operations run into problems and
and risks, benchmark your efforts against well-established,
new business practices, IT teams may try to replicate a company and its data vulnerable. resolve them quickly and effectively.
best-practice frameworks for cloud architecture, such as
existing processes in the cloud or “lift and shift” those described by the US National Institute of Standards and • Invest in education. Cloud is still a new frontier for most
existing assets to cloud assets, in an effort to move Security incidents in 2019 showed how such
Technology (NIST) and the Center for Internet Security (CIS). organizations, and the level of understanding about what it is
the system from one environment to another without vulnerabilities are ripe for exploitation. New projections
This assessment will show what the organization is doing well and what it can do for the business can vary widely. Make sure
a proper redesign. For example, rather than using the show that almost all cloud cyber attacks are expected
and what it needs to improve to mitigate cloud-related risk. leaders and their teams are provided with adequate, ongoing
logging system built into the cloud service, they may to be related to misconfiguration. Nearly all means over
attempt to virtualize the logging system they’ve been training and education to ensure they know what they need to
99%.1 While more organizations are undertaking cloud • Make sure there’s a strategy. Ensure your organization has
using with on-premises technology for years—even transformations, they’re more inclined to simply extend know about cloud.
a clear, shared cloud strategy that describes what it’s trying to
though using the cloud service’s default offering would their on-premise security capabilities, which have not achieve with cloud and how it intends to achieve those goals.
be simpler, faster, and potentially superior. been tailored for native cloud services, to the cloud.
Developing this strategy—which can evolve along with the cloud
transformation—will ensure all parties are on the same page
and help minimize rogue cloud experiments.

Gaps in security configurations, which expose traditional vulnerabilities

Organizations have tended to focus on securing their provider route requires the correct configuration to
assets against emerging threats and attacks. While manage traffic flow. One of the best ways to mitigate
they’re now making better use of new technologies this is through the use of cloud security posture
to secure their environment, cyberattacks continue to management systems and cloud-native compliance
exploit old vulnerabilities. Using cloud-platform-specific monitoring tools that use leading security practices.
threat modelling, penetration testing, and vulnerability
assessments can help your organization evolve in Failure to recognize gaps in security configurations
its understanding of how its threat landscape can lead to exploitation through existing vulnerabilities.
has changed. It’s therefore critical to gain visibility of the workloads
in the environment and to implement appropriate
In many instances, resources are misconfigured controls by using benchmarks, through automated
because the implementation/infrastructure team configuration management and remediation of
either does not have the appropriate knowledge or identified misconfigurations. Staff will need to be
it follows traditional processes that are not suitable equipped to manage and configure cloud-native
for a cloud environment. For example, configuring tools according to these defined benchmarks.
network routes through the existing cloud-service

1. Innovation Insight for Cloud Security Posture Management Gartner - Published 25 January 2019 - ID G00377795

2 33
Dissolve your cloud concerns | How to de-risk your cloud transformation Dissolve your cloud concerns | How to de-risk your cloud transformation

Governance and responsibility 2. Promote a shared-responsibility model

A fuzzy concept some organizations have is that cloud In general, infrastructure as a service (IaaS) models place
transformation reduces the effort needed to manage more security responsibility on the customer, while
One of the reasons companies find it challenging to understand and manage their cloud-related and secure resources, whether they migrate completely platform as a service (PaaS) and software as a service
to cloud or share assets between on-premise and cloud (SaaS) puts more responsibility on the cloud service
risk is that few have a thorough understanding of their cloud strategy and risks.
environments. On the other end of the spectrum, some provider (CSP). Regardless of the model, it’s critical to
organizations think that protecting data in the cloud understand the details and to clear up any confusion
In our experience, CEOs, chief information officers, a competitive breakthrough. This makes it hard for them is always their responsibility, regardless of the service with the CSP at the outset. Once defined, don’t hesitate
chief data officers, and other leaders often have to manage cloud effectively and mitigate the risks of an model utilized. to promote your shared-responsibility model with your
differing views of what that strategy should be and organizational transformation to cloud. Difficult, but by no IT and security teams. The more people are aware of
what the results should be. In fact, most companies means impossible. The first two steps are to prepare to The reality is that cloud security is a shared responsibility the responsibilities, the better prepared your
lack an all-encompassing cloud strategy. They have govern the cloud program appropriately and to determine between the customer and the cloud service provider, organization will be.
instead a series of tactical initiatives, launched for any who is responsible for cloud security: the company or with the share of responsibility depending on the
number of reasons as they seek to innovate and reach the cloud provider. selected service model.

1. Make IT governance cloud-ready

Governing cloud services effectively is a key aspect of To avoid regulatory headaches, make sure your
de-risking cloud-related programs. This is especially organization has ways to monitor and manage what
true given that it can be very easy, fast, and inexpensive data is put into the cloud, where it’s stored, how it’s
Security governance,
to start using cloud services; in many cases, all it takes secured, and when it’s removed. Extending your
risk, and compliance
is one person with a credit card to complete a swift information classification policy to the cloud and using
upload of company data, such as sales contacts. In tagging for your cloud resources is a good way to gain
just a few minutes, a company can find itself and its such visibility. For example, uploading European Union Application security Security in the cloud
data unwittingly in the cloud. This demonstrates the citizens’ data into the cloud can result in a company
is the customer's
importance of bringing visibility about cloud services suddenly being required to abide by the EU General
to those responsible for IT and data security within Data Protection Regulation. responsibility
Platform security
an organization. Security of the cloud
Finally, ensure your organization does not leave a is the cloud provider's
Ensure your teams are aware of the services your host of data “artifacts” to linger in the cloud, lost and
Infrastructure responsibilty
company is using so they can be better prepared to forgotten—until a hacker or cybercriminal discovers
security
protect the company and its data in the cloud. it. As we’ve seen time and again in recent years, data
breaches can lead to significant financial, reputational,
regulatory, and legal repercussions from which it can
Physical security
take a long time to recover.

Private cloud Private cloud IaaS PaaS SaaS

(self-hosted) (co-located)

Enterprise Shared Cloud provider

responsibility responsibility responsibility

4 5
Dissolve your cloud concerns | How to de-risk your cloud transformation Dissolve your cloud concerns | How to de-risk your cloud transformation

This page has been intentionally left blank.

Develop a cloud security strategy

To create a strategy for protecting your information in the cloud, start by understanding
the new risks to your organization. It’s important to prioritize those that are relevant to
your public cloud environment based on the various regulations that may apply and the
level of sensitivity of the company data you’re considering moving to the cloud.

Identify your information crown jewels and This won’t happen overnight. Staff is needed. Cloud
then map risks to understand how those jewels cybersecurity specialists are expensive and rare. Your
can be threatened and protected. What specific existing cybersecurity team won’t know how to address
information is at risk in each cloud scenario? What cloud security events or remediation strategies, and
are the vulnerabilities and the potential threats? your cloud team is likely not going to understand the full
How important is the information at risk? depth of corporate cybersecurity. Start building nimble,
integrated teams drawn from the best players of both
With the correct precautions, cloud environments can worlds and cross-train from within.
be as secure as on-premise ones. But, as with physical
security, the more cloud security you enable, the more These teams are going to need help, so automation
complex and costly it will be. Consider a cloud threat and monitoring will be required. Now is the time to
risk assessment and cloud threat-modelling start thinking of security as code (SaC). Security
exercises tailored to your proposed or existing cloud development operations practices and automated
applications or environment. Identifying the risks and monitoring will be differentiators for organizations that
knowing your risk appetite will help you approach your wish to capitalize on the velocity the cloud promised but
cloud usage in a more informed manner. This will that security concerns had slowed to a crawl. Investing
allow you to scale your security measures and budget in tools like cloud-native or cloud-enabled security
by environment to make the most efficient use of information and event management (SIEM) and
your resources. cloud security posture management will help you
get a handle on security. Security configuration files like
Next, get your house in order. What changes Azure Policy, AWS Organizations, and CloudFormation
will need to be made to your operational and Templates can be adapted for your enterprise needs
organizational models to ensure cloud doesn’t and deployed at scale using modern identity and
run in a silo or as unmanaged shadow IT? This access management (CI/CD) pipelines. Best of all,
means prioritizing a new cloud responsible, these tools can all be configured to match your chosen
accountable, consulted, and informed (RACI), cybersecurity policy, giving those teams you’ve built a
ensuring you have cloud cybersecurity standards fighting chance to get the job done.
and controls that tie back to and align with your
chosen cybersecurity framework (e.g., NIST, ISO, CSA)
and fully integrating your cloud environments with
your existing cybersecurity departments.

6 7
Dissolve your cloud concerns | How to de-risk your cloud transformation Dissolve your cloud concerns | How to de-risk your cloud transformation

Focus on identity and

access management
One of the most important domains for cloud security is identity and access management (IAM).
Disappearing or blurring network perimeters in the cloud introduce new difficulties in responding Customers Apps, services,
to risk, including how to best administer granular access controls to cloud services. All entities and and partners and data in a
hybrid cloud
cloud resources have an identity that must be secured.

Identity and
The following are critical cloud-identity capabilities • IAM solutions currently on the market seem to focus context
Unsanctioned cloud
and considerations: either on cloud computing or on the enterprise.
Focus on the design and architecture of your
• People are the new perimeter—spend as much time identity-based security solution, and then select
protecting the people in your cloud environments as the technology. While the solution is more complex,
BYOD and
you do setting up your cloud network security. remote users
the architecture should endure through many
New cloud services:
• Enterprise cloud needs federated identity and technological changes. Never let technology lead
Custom and Saas
integration, with enterprise directories. your requirements or design.

• Enterprise single sign-on (SSO) and multi-factor • Splurge on testing, including ethical security tests.
authentication with conditional access should These can lead to an understanding of where the
be enabled for all users. vulnerabilities in your system exist and thus to a better
Cloud infrastructure
choice of approaches and use of security technology.
• Cloud user-provisioning, IAM roles, and role-based IAM systems that focus on cloud computing are
access control require careful planning and design, becoming more critical with the expansion of what
but add in-depth security. a cloud “identity” really is. Identity now is not just Traditional perimeter
• Privileged account management and privileged identity people, but can be secrets, containers and IOT devices Applications Databases Infrastructure
management can use solutions that are either native among a myriad of other possibilities.2 However,
to cloud or enabled for it. this could be because many on-premise enterprise
systems are much less secure and therefore provide
• Mobile device app and data management are better pickings.
important when the cloud extends to your mobile
user base. • In your design, make sure to consider things such On-premise users Enterprise networks and legacy data centres
as performance. While most IAM systems don’t
Some of the more notable IAM patterns include slow things down, they can, and they’re hard to fix
the following: after deployment. They cause issues with security
systems because users quickly figure out ways
• Integrating cloud-based identity management around the security.

Privileged account management and privileged

solutions with enterprise security from the outset.
While many companies are comfortable with • Make sure to consider your industry and all the
creating security silos that use different approaches regulations that require compliance. These are
and technologies, such a strategy tends to be typically managed by the identity governance
system within the IAM, and need to be understood
identity management can use solutions that are
counterproductive over time. You’ll eventually need
to consolidate around a single security model. from the outset. It’s tough to retrofit these policies
after implementation. either native to cloud or enabled for it.

2. 2021 Planning Guide for Identity and Access Management, Gartner - Published 9 October 2020 - ID G00729005

8 9
Dissolve your cloud concerns | How to de-risk your cloud transformation

Handle cloud risks—and realize its potential

Key contact
Cloud will play a vital role in enabling companies to be quicker, more agile, and more
competitive in the years to come, no matter their industry. But managing, reducing, and
Rob Masse
mitigating cloud-related risks are essential to ensuring their long-term health and vitality.
It’s time to act to position your organization to capitalize on all cloud has to offer while Partner, Risk Advisory
keeping the risks in check. [email protected]

Acknowledgements
Aaron Fleming
Director, Risk Advisory

Ian Guthrie
Senior Manager, Risk Advisory

Rene Heroux
Senior Advisor, Consulting

Naresh Kurada
Director, Risk Advisory

Gregory Lemaire
Senior Manager, Risk Advisory

Kevin Young
Partner, Consulting

10
Dissolve your cloud concerns | How to de-risk your cloud transformation

www.deloitte.ca

About Deloitte
This publication contains general information only and Deloitte is not, by means of this publication, rendering accounting, business,
financial, investment, legal, tax, or other professional advice or services. This publication is not a substitute for such professional
advice or services, nor should it be used as a basis for any decision or action that may affect your business. Before making any
decision or taking any action that may affect your business, you should consult a qualified professional advisor. Deloitte shall not
be responsible for any loss sustained by any person who relies on this publication.

Deloitte provides audit and assurance, consulting, financial advisory, risk advisory, tax, and related services to public and
private clients spanning multiple industries. Deloitte serves four out of five Fortune Global 500® companies through a globally
connected network of member firms in more than 150 countries and territories bringing world-class capabilities, insights, and
service to address clients’ most complex business challenges. Deloitte LLP, an Ontario limited liability partnership, is the Canadian
member firm of Deloitte Touche Tohmatsu Limited. Deloitte refers to one or more of Deloitte Touche Tohmatsu Limited, a
UK private company limited by guarantee, and its network of member firms, each of which is a legally separate and independent
entity. Please see www.deloitte.com/about for a detailed description of the legal structure of Deloitte Touche Tohmatsu Limited
and its member firms.

Our global Purpose is making an impact that matters. At Deloitte Canada, that translates into building a better future by
accelerating and expanding access to knowledge. We believe we can achieve this Purpose by living our shared values to lead the
way, serve with integrity, take care of each other, foster inclusion, and collaborate for measurable impact.

To learn more about Deloitte’s approximately 312,000 professionals, over 12,000 of whom are part of the Canadian firm, please
connect with us on LinkedIn, Twitter, Instagram, or Facebook.

© Deloitte LLP and affiliated entities.

Designed and produced by the Agency | Deloitte Canada. 20-3190014
12