Data protection principles are the same whether your data sits in a traditional on-premises data center or a cloud environment. However, the way you apply those principles is quite different when it comes to cloud security vs. traditional security. Moving data to the cloud – whether it’s a public cloud like AWS, a private cloud or hybrid cloud — introduces new attack surfaces, threats and challenges, so you need to approach security in a new way.
Organizations typically have a mix of traditional IT security and cloud services, so security solutions need to protect both. The security controls in place for the data center may not be suitable for new challenges introduced in the cloud. Big data, the new skills required of security teams, and compliance and regulatory requirements all add to the complexity and cost of a cloud security solution.
The good news is that cloud-based security solutions are available to address challenges around protecting sensitive data, cybersecurity issues and cyber threats, cloud data security, network security and more for comprehensive monitoring of your security posture.
Ideally, you want a solution that minimizes the load on your security team and the training time required to support the solution. It must also address new cloud security threats while protecting traditional systems. Understanding the differences between cloud security vs. traditional security is key to finding the right security solution.
Cloud security threats
Cloud and traditional IT environments need to protect against many of the same threats. Even though the threats may be the same, new solutions are needed to protect resources in the cloud. Cloud security challenges include:
Containers, microservices and serverless computing
Applications in the cloud often run serverless, as microservices, or in containers. Traditional security solutions are not equipped to handle these newer technologies, so some threats can and do go undetected.
Elastic scalability
The cloud is dynamic and elastic in nature. The frequent, sudden, and hyperscale changes seen in the cloud would cripple many traditional security solutions.
Hybrid and multi-cloud
Monitoring and analyzing traffic traversing multiple clouds from different providers is difficult with on-premises security solutions. It makes sense that the best way to address security threats in the cloud is with a cloud-native security solution. These solutions are built in the cloud with the necessary capabilities to handle today’s varied architectures.
Why securing the cloud is different
Cloud-native security solutions, built specifically to protect cloud resources, excel where traditional on-premises security solutions struggle. Here’s a breakdown of how cloud and traditional security solutions address major challenges:
| Challenge | Cloud Security | Traditional Security |
| Visibility | Monitoring of both on-premises and cloud resources. On-premises resources across different locations can be monitored without having additional security appliances at each site. | Monitoring of on-premises resources, but only limited monitoring of cloud resources. |
| Deployment | The SaaS model eliminates the need to deploy hardware or software. Saves time on change management, facility, provisioning, etc. Runs on an established platform, so deployment issues are rare. | Security appliances must be procured, shipped to each site, installed, and configured. Given the new infrastructure and initial configuration, deployment issues are common. Gartner says that over 50% of SIEM deployments fail. |
| Time to value | Rapid deployment, built-in and updated content, updated use cases and simplified user experience let you get started on security in just a few hours or even 30 minutes. | Typical project lifecycle—procure, ship, install, configure, tune—causes slow time to value. Long cycles for updating, managing, running the use cases, etc. Most deployments run over nine months, and you cannot usually see value in the first year. |
| Maintenance | Handled by the cloud service provider (CSP). The vendors update the platform daily and update features and bugs more frequently. It is typical for cloud vendors to have 12 releases a year where software/appliances will be updated once a year. | Handled by in-house IT and security teams. This is a big point of failure. We see more customers looking for cloud solutions after they go through a maintenance cycle and stop seeing value. |
| Total cost of ownership and ROI | Opex-based
Consumption model Subscription-based No long-term contracts Easy to replace vendors if there is no fit Low-risk solutions Payback is typically 6-9 months Subscription cost covers almost 70% of the TCO |
Capex-based
Big budgetary investments Long planning and deployment cycles Multiple groups from security, IT, facilities, ops, DevOps, to LOB, and apps are all involved Licensing cost is only 9% of the TCO. HW/SW/facilities and other hidden costs are involved. Tough to predict the pricing for the next quarter/ year |
| Updates and patches | Cloud vendors take care of updates and patches through the shared responsibility model
Low risk of vulnerabilities for unpatched systems |
Requires periodic maintenance windows and planned outages
Unpatched systems are a big threat to security |
| Capacity planning and elasticity | No planning for capacity
Elastic scaling takes care of unplanned capacity planning Seasonality, peaks, and bursts are handled effortlessly |
HW, SW, and licensing need to be planned for over-capacity for occasional burstsor peaks
Your TCO is designed on seasonal peaks Extreme bursts lock you out of tools when you need the most |
Cloud security and log management
Logs provide visibility into the health of the application and infrastructure stacks. The lack of log visibility creates operational challenges when modern applications leverage the cloud, the infrastructure they don’t own, and microservices architecture, where three-tier architecture is transformed into n-tier architecture with many-to-many communications between those services.
If a security incident or operation outage occurs, your DevOps, ITOps and SecOps team(s) don’t have insight that allows them to resolve the issue quickly. This lack of visibility into their stack often creates higher application latency and system outages, resulting in poor customer experience and customer churn.
Knowing where to look to pinpoint problems that cause customer satisfaction issues, applications to slow down, system-wide outages, or security threats is the primary reason for the existence of logs. Each log contains a stream of events and includes a wealth of data about software and related infrastructure performance, availability, user access, and behavior. By analyzing these logs, one can proactively detect and resolve issues that impact the business.
Ideally, you need a centralized log management solution, like Sumo Logic, that centralizes, correlates and analyzes all of these logs to provide meaningful insights into solving application performance and cybersecurity issues.
Why securing the cloud is essential
Cloud environments are constantly changing — by design. Services are spun up and taken down to meet demand and transient events. Traditional security cannot react to these changes in an effective way. Cloud security is designed to understand and react to the dynamic aspects of cloud computing. It can ingest data from containers that traditional security methods would never have known existed. Cloud security is the only way to effectively secure resources from a security risk or active threat in cloud computing environments.
Traditional security solutions do not have the ability to view activity within a container and events across containers and microservices. This leaves you blind to potential threats. Cloud security is aware of containers and microservices being purposefully built to see the threats against them.
To be secure, the cloud needs cloud-native security solutions that meet these criteria:
- Visibility into containers, microservices, and serverless
- Ability to monitor and analyze transient and elastic workload data
- A holistic view of the entire threat surface
- Software-as-a-service (SaaS) security solutions
Cloud-native security
Many security solutions are delivered from the cloud today, but there is a difference between cloud-native solutions and traditional security solutions that have been moved into the cloud. For example, running firewall software on a virtual machine in the Amazon Web Services cloud is not a cloud-native solution. It is a traditional firewall running on an infrastructure-as-a-service (IaaS) platform.
In contrast, cloud-native security runs on a true SaaS model, wherein the service provider is responsible for the entire service stack, from the hardware through to the application. When we describe a platform or system as cloud-native, we are referring to a method of building and deploying applications that takes advantage of cloud computing as a delivery model. Rather than indicating where applications are run, cloud-native refers to the environment in which applications are built and implemented – they begin their life in the cloud and remain there.
Some cloud-native applications can be characterized by the use of the open-source software stack, with the parts of an app being separated into containers and oriented around microservices. While not a universal element of all SaaS providers, the ability to leverage microservices and the open-source community is endemic to cloud environments.
Cloud security with Sumo Logic
Your changing attack surface needs increased threat visibility and deep security context from use-case-driven queries, dashboards and alerts. Sumo Logic is a cloud-native platform that offers multi-cloud observability, log analytics and management, security information and event management (SIEM) and security orchestration, automation and response (SOAR) solutions.
With Sumo Logic Cloud Infrastructure Security, you can cut through the noise of complex cloud environments, including AWS, to monitor your attack surface with real-time cloud-scale collection, storage and security analytics.
Download our ebook to explore how you can also accelerate and secure your software development lifecycle with DevSecOps.
