Cloud Security - Know your network better than the attacker

  • Article

"Know your network better than the attacker" is one of the nuggets of advice from an excellent white paper, ‘Cybersecurity for Open Government’, produced by Microsoft Cybersecurity experts. Although aimed primarily at the requirements of the USA Federal Government, the interconnected cyberworld we increasingly inhabit for both our personal and professional information management needs means that there is highly practical advice and guidance in this white paper for cybersecurity and information assurance professionals in governments worldwide.

It may be coincidence, but just as I put down my copy of the white paper, I picked up a recent copy of the Economist to read one of those scary features on Cyberwar. It is a well-researched article that argues the case for perceiving cyberspace as the new fifth domain of potential warfare after land, sea, air and space.

I have no intention of painting a doomsday scenario in today's blog posting. Never a good idea at the best of times and certainly not on a Monday morning. However, both the white paper and the Economist article are timely reminders of the need for continuing vigilance by individuals, organisations and governments as the threats to computing as a utility become increasingly sophisticated and prevalent.  

As cloud computing rapidly becomes the new paradigm in information management, the Cybersecurity for Open Government white paper contains timely guidance and specifically addresses concerns relating to security in the cloud from a strategic perspective:

“A growing number of cloud computing services promise appealing cost savings and flexibility for government agencies. Yet cloud computing may seem risky because you cannot secure its perimeter—where are a cloud’s boundaries? How do you ensure the security of data hosted in cloud data centres?

Whether you host information and services in data centres that are on your premises or in the cloud, the same security principles apply. You need a strategic and operational framework for cyber protection, detection, response, and recovery. You must look carefully at how well cloud providers protect key functions and sensitive data and tailor your security tactics to the service you use, whether that service is software, databases, storage, or platforms. ”

Microsoft’s recommendation is to focus on four key aspects of a continuous cybersecurity plan:

  • Protection – safeguarding vital assets
  • Detection – understanding your network
  • Response – reacting when a threat surfaces
  • Recovery – ensuring continuity

Governments must develop best practices around each of these areas, along with a strategy that clearly identifies the people that make security decisions, the processes used for risk-based decision making, and the technologies that support this mission. Cybersecurity is an ongoing process that requires trustworthy software and IT resources, user education, and improved regulatory standards – but it’s also only a means to an end. It’s vital because government organisations can only leverage technological innovation if they keep assets secure, empowering personnel to more efficiently achieve their goals and building citizen confidence in the security of personal information held by public sector organisations. 

Finally, here's reminder of the link for downloading your personal copy of the white paper on Cybersecurity for Open Government 

Posted by Ian