Cloud Security in Practice

In recent years, many Swiss companies have moved parts of their IT infrastructure to the cloud, mostly to Microsoft Azure. The migration was often carried out quickly, without adequately adapting IT security to the new environment. This creates security gaps that attackers exploit deliberately: uninspected traffic, a lack of transparency during incidents and inconsistent security policies.

In our cloud security projects, we keep encountering the same three challenges. Here we share what we have learned and which technologies have proven effective.

Is your Azure environment as well protected as your data centre?

The most common route to the cloud is a hybrid environment: the existing data centre remains in place while Azure is added. The connection is set up quickly, but adapting the security measures is often postponed.

In our projects, we repeatedly find that Azure thus becomes an extension of the internal network, but without the security controls that are taken for granted on-premises. Traffic on the link to the data centre (backhaul) is not inspected, there is no segmentation within Azure (east-west), and traffic to the internet (north-south) often flows unprotected via public IP addresses. If a system in Azure is compromised, an attacker can exfiltrate data unnoticed or work their way into the internal corporate network.

Our solution: we deploy a next-generation firewall as a central control point in Azure, protecting all connections, whether backhaul, east-west or north-south, according to the same rules as on-premises.

Do you know what is really happening in your cloud?

When a security incident occurs, the first question is: what exactly happened? In many cloud environments, this is hard to answer, and the longer the analysis takes, the greater the damage.

Cloud flow logs usually show only the source IP, destination IP, port, protocol and whether a connection was allowed or blocked. Depending on the service tier, the cloud providers’ firewall services add domain names, full URLs and threat alerts. However, the application actually behind a connection often remains unclear.

Our solution: we supplement this data with the logs generated by a next-generation firewall, creating genuine visibility. Every connection is logged together with the identified application and its content. Our customers can see at a glance which applications are in use, how much data is flowing where, and where threats are occurring. This makes incidents much faster to trace, and all logs can be forwarded centrally to an existing SIEM.

Do you have an overall view of all your cloud environments?

Besides Azure, other platforms such as AWS or Google Cloud are often in use, each with its own security tools, consoles and rule sets. In our projects, we see that security policies are therefore maintained in several places and drift apart over time. This makes it almost impossible to ensure a consistent level of security.

Our solution: we rely on a firewall platform that integrates seamlessly into all major cloud environments. Using central management, we define security policies once and enforce them consistently in the data centre and across all clouds.

Why do we rely on Palo Alto Networks?

The cloud providers’ firewall services have developed considerably in recent years. The Premium tier of Azure Firewall, for example, now offers intrusion prevention, URL filtering and inspection of encrypted traffic. In hybrid and multi-cloud environments, however, our experience shows that Palo Alto Networks offers decisive advantages.

• One platform for all environments. Whether in the data centre, as a virtual firewall or as a cloud service, Palo Alto uses the same technology everywhere, so policies can be transferred directly.
• Security at application and user level. The cloud providers’ firewalls filter by IP addresses, ports, and domain names or URLs. Palo Alto identifies the application in use regardless of the port and assigns every connection to a user. This provides far greater insight into network traffic.
• Integrated threat prevention. Intrusion prevention, malware analysis, URL filtering and DNS security are built in. Depending on the tier, the cloud providers cover some of this, but they lack sandbox analysis of unknown files.
• Central management. With Panorama or the cloud-based Strata Cloud Manager, all firewalls can be managed centrally, both on-premises and in the cloud.

How can Asecus help?

Asecus has been helping Swiss companies protect themselves against cyberattacks since 1997. Our interdisciplinary team has extensive experience in securing on-premises, cloud and hybrid environments. We serve more than 160 active customers from a wide range of industries.

Our key insight: a next-generation firewall delivers the greatest value when it is deployed specifically where the cloud’s native tools reach their limits.

Our approach is as follows:
1. Assessment: we analyse the existing environment, data flows and requirements.

2. Architecture: we define where the firewall usefully complements the cloud’s native tools.

3. Implementation: we integrate the firewalls and migrate the policies without disrupting ongoing operations.

4. Operation: we support our customers and continuously adapt the security measures.