Strategy and security in the multicloud

“The tool stack that a company typically uses to secure the public cloud looks different from the classic tools for on-premise security,” says Bart Callens, Product Manager Cybersecurity at Proximus NXT. “For applications and operating systems running in your own data center, you are responsible for handling the patching yourself. In a SaaS or PaaS environment in the public cloud, this is mainly the responsibility of the provider. The focus there is more on secure configuration.”

The question remains: how do you secure the various combined public clouds? “By definition, you can arrange cybersecurity separately for each public cloud, using the native stack in each case,” Bart continues. “But then you need a separate security specialist for each cloud.” However, there is an alternative approach. “With Azure Cloud Security Posture Management (CSPM), for example, you can detect and correct incorrect configurations not only in Azure, but also in AWS and on the Google Cloud Platform. However, this cannot be done as comprehensively as it can be in Azure itself.”

These are the decisions companies can make based on their cloud infrastructure and the related security for the multicloud environment. But each choice also has an impact on the overall monitoring and management, and, importantly, the necessary expertise. Thierry: “In practice, an organization may be focused on a single public cloud, such as Azure, but the business may request specific applications within another cloud, such as Google or Amazon.”

If the organization wants – or needs – to respond to this demand, it faces an additional challenge. It must develop expertise in that other cloud domain, not just in functional terms, but also in terms of the additional security required.

What can a company do if the management and maintenance of the multicloud environment proves too complex?

Thierry: “If the company has sufficient expertise and available staff, one solution could be to implement a cloud management platform across the various clouds and then use it to manage the multicloud environment.” What if a company wants to use a specific service from a hyperscaler but doesn't have the right skills in-house? “In that case, the company can come to us for a managed service for that cloud,” says Thierry. Proximus NXT has specialized expertise in-house. “A company can also outsource the management and maintenance of its multicloud entirely to us.”

“The same applies to security,” Bart concludes. Due to the ongoing shortage of specialized security profiles and the rapid pace at which security requirements are evolving, companies are increasingly opting for support from a partner. “We not only provide the security licenses that run in the cloud, but also manage the security controls for the company, on-site and in the various clouds, regardless of the multicloud strategy the company follows.” The services offered are modular and cover operational, tactical and strategic levels. “This ranges from keeping security controls available to providing Security Operations Center (SOC) services to a full range of Governance, Risk & Compliance (GRC) services.”