Non-technology interventions equally important for security in a multi-cloud environment, say experts

The pace at which businesses are adopting cloud solutions is driven by the technology’s ability to optimise costs, boost innovation and make ventures more agile. Amid the rise in their popularity, there are also concerns about how secure cloud solutions are, given how cybersecurity threats can hamper businesses’ growth.

To gather insights and explore the roadmap for ensuring the security of businesses operating on the cloud, a panel discussion titled ‘Serve and Protect: Conversations on optimally securing the Cloud’, was hosted in association with Cisco on.

Moderated by Shivani Muthanna, Associate Programme Producer, YourStory, the panel comprised eminent experts: Neeraj Singh, Co-founder and CTO, Groww; Sudheer Tumuluru, Head of Platform Engineering for Infrastructure, Platforms and Data Analytics, Myntra; Rajiv Dinesh, Head - Data Products, Delhivery; and Anubhav Wahie, Regional Leader- Cybersecurity, Cisco India and SAARC. Here are some of the highlights from the discussion:

The importance of bringing cyber resiliency to operations

Cisco India’s Anubhav Wahie highlighted the importance of the role of agility, time-to-market and innovation in today’s business environment. “ Despite the challenges posed by lockdowns and covid social distancing protocols, Most of the essential services are available to us with the click of a button. This brings out the constant innovation and agility showcased by most organisations,” he said, adding that this rapid pace of innovation is also a double-edged sword, as it has also been seen among hackers.

Citing data from the research conducted by Cisco’s Threat Intel - Talos, Anubhav noted that the number of malicious domains with a COVID-19 related theme rose from 47,000 in March 2020 to 75,000 in May 2020. “Security can no longer be an afterthought. It has to be applicable across your landscape, right from your network to your footprint on a public cloud,” he said. He added that the availability of timely, factual and accurate threat intel; a security operations team that is alert and not ‘alert fatigued’, and fostering cyber resiliency in security operations were the need of the hour for businesses.

Assessing data lifecycle crucial to enhance security operations

Delhivery’s Rajiv Dinesh outlined how it is important to have a holistic approach to data security by considering the entire data lifecycle. “There have been concerns around ensuring that sensitive data is not breached and how long it should be stored and used altogether. This is why it is very important to look at the data lifecycle: right from where it is stored, to who has access to it and how it is stored over the immediate lifecycle and when it is erased.”

Myntra’s Sudheer Tumuluru noted that customer trust is at the essence of any e-commerce business, and ensuring security is a pillar of ?. To that end, he outlined a three-step process. “The first step is to secure your code and assets, making sure your development process goes through a code review and threat modelling process,” he said.

“We test our programmes internally and host bug bounty programmes with security researchers who can spot and report these loopholes, and work towards closing them.”

Finally, he also outlined how Myntra’s stack that deals with third party vendors for logistics and delivery services is ensured to be as secure as their main stack. “This is an exercise that is carried out to ensure that Personally Identifiable data is kept at a minimum level of exposure, and maximum privacy and security,“ he said

Scalability of security operations a necessity in a multi-cloud environment

Anubhav also talked about the three main aspects that foster security in a multi-cloud environment. “First, there is a need to bring visibility across the entire multi-cloud setup. You must have visibility ahead of time to see any outliers and anomalous behaviour. This will help with early detection and siphon out unknown malicious behaviours. Second, Ability to extend this visibility across a multi-cloud footprint will help with more contextual and relevant insights for investigation. This will directly scale and efficacy of Secops. Third, review your policy framework to ensure it aligns with the change in the business landscape. A tighter alignment between technology and updated policy/process controls will reduce noise ,” he said.

He also mentioned the need for stronger guardrails and stronger access control measures for a public cloud setup using Cisco Duo, and covered how Cisco’s ‘Secure Cloud Analytics” can help provide greater visibility in a multi-cloud environment. Anubhav also covered how Cisco’s ‘Workload Analytics’ solution can help provide deeper cloud security for workloads with an ability to offer micro-segmentation capabilities.

Foster a culture of security equally important to securing operations

Groww’s Neeraj Singh talked about how working remotely presented its own set of challenges for security teams to secure operations, and that fostering a culture of security and educating employees about best practices goes a long way in building resilience and security.

“People look at security as an effort that has to be taken care of separately. I see security as a part of the culture itself, where everyone is equally responsible. Relying only on tools will not suffice,” he said, adding that at Groww, the team proactively started talking to other divisions and conducted training programmes to make sure everyone is on the same page about security best practices.

With respect to the devices, Neeraj said that if an organisation is using devices that can be easily monitored, and are erasable, then there should be a team in place that looks after their security . “The root cause for most security breaches is silly mistakes and they can be eliminated if you educate the people and have a review mechanism, be it boarding practice, deployment or using infrastructure,” he said.