As the cloud gains popularity and businesses gain an understanding of its services and benefits, it's no surprise that multi-cloud adoption is soaring. Chairman of Oracle Corporation and Chief Technology Officer Larry Ellison anointed this “the multi-cloud era.” And according to Gartner, 81% of organizations presently use multiple cloud service providers.

There are many benefits to a multi-cloud strategy, but operating in multiple clouds also introduces complexity. If not managed carefully, a multi-cloud architecture can rob the cost-saving component of the cloud and hinder your performance goals. Multi-cloud vulnerabilities can manifest because each Cloud provider has a different method of managing identity, privileges, and entitlements. These differences in security models complicate visibility, governance, and security across multi-cloud environments. And if left unaddressed, your organization is vulnerable to attacks, breaches, and additional security incidents.

"Worldwide cloud spending will surpass $500 Billion in 2022"

Gartner

Moving from On-prem to the Cloud

Remote work has led to an exponential increase in the number of new devices connecting to company networks and cloud resources with personal laptops and smartphones. The pandemic accelerated the pace of many cloud transformations. These faster transformation periods meant that security and governance of the cloud were often an afterthought. The race to provide quick access to users working from home resulted in:

• Over-provisioning of user access

• Policies not tightly monitored across multiple cloud sources

• Siloed identity systems were created, with separate identity catalogs in cloud platforms

To compound these issues, most enterprises use multiple cloud service providers. In a multi-cloud environment, you may store specific data in Azure because they support your Microsoft Office products, but Oracle better supports the applications and databases you run. IT teams must manage and support security within various cloud environments where multiple management and monitoring tools function differently. These IT teams also need to ensure that every user has proper access and that data isn’t breached or leaked.

Multi-Cloud challenge – Visibility

Cloud visibility is the ability to view all activity occurring in your cloud and the amount of oversight and control you have over the resources and data. For example, an organization that keeps its data in a publicly hosted cloud but can’t see who is accessing it has low cloud visibility. In contrast, a company that hosts a private cloud and enforces strict access control policies has higher cloud visibility.

Visibility in the cloud is complex because, as previously mentioned, each cloud service provider is different. Many businesses have different teams managing each cloud: an Azure team, Google Cloud Platform team, and a team for AWS. There’s often a lack of accountability and cooperation across these teams, particularly when provisioning and de-provisioning access to data and applications, which can lead to accumulating privileges.

In 2022 cloud visibility extends beyond only human identities and their access to data or applications. Now identities are both human and non-human (such as bots, AI, virtual machines, serverless functions, devices, shared accounts, service accounts, and computing infrastructure), with access to policies, roles, and services. Supervision of that access requires complete visibility into everything occurring on the cloud.

Low visibility in the cloud is a security weakness. Organizations that have security weaknesses can’t detect the signs of security threats. High cloud visibility enables comprehensive, proactive risk detection. Whether done by IT teams or governance solutions, monitoring cloud visibility is a key concern.

Multi-Cloud challenge – Governance

Governance aims to reduce the risks associated with excessive access privileges to company resources. And cloud governance has become necessary as organizations endeavor to comply with regulations and strategically manage risk. 

Employing different service providers to leverage each cloud provider's unique strengths is a major benefit and the driving force behind multi-cloud popularity. However, governing access to cloud services becomes complex because there is no unifying factor between the clouds. Typically each cloud is governed by an individual security model, with no way of connecting them. This leaves companies wide open to the risk of over-provisioning access to applications and data. 

To truly govern a multi-cloud architecture, a policy-based governance hub is necessary. A centralized repository of access rules allows companies to place guard rails on user access and apply them consistently in each cloud.

For example, if a user has access to SalesForce in one cloud, where customer data is maintained, and to ERP data in another cloud, how can companies be sure that the user does not possess a toxic combination of privileges if these clouds are governed separately? And how can access certification be performed across these disparate clouds?

This is the major challenge many companies employing multi-cloud architecture face. To ensure operational control, enterprises should unify the administration and monitoring of their IT systems with a policy-based governance solution.

A policy-based solution enables companies to create access rules centrally and deploy them across their clouds to ensure appropriate access is granted. Meaning if a user has access to Salesforce in one cloud and the ERP in another, companies can create rules that deny users the ability to change customer data in the ERP.

Multi-Cloud challenge – Security

In multi-cloud infrastructures, the number of path combinations increases proportionally with the number of clouds. Each path has numerous unpredictable factors, increasing in risk and magnitude.

As companies adopt a multi-cloud approach to improve IT operations and improve customer services, you can’t afford to overlook the security implications. While issues like growing complexity, lack of cross-platform visibility, and numerous regulatory standards compete for IT focus in a multi-cloud environment, enterprise leaders see security as a major challenge.

The most significant problem in a multi-cloud model is the consistent application of controls. For example, how you access Oracle is different from how you access Azure or AWS. And the controls that Oracle offers differ from those in Azure and AWS. The outcomes are often aligned, but how they can be most effectively configured and utilized differ. Getting a consistent set of controls across multiple cloud environments is challenging. 

Solutions to manage multi-cloud environments

When securing multi-cloud environments, remember that each cloud service provider has its own model for managing identities and privileges. Those models each have different roles and security controls, requiring a single solution to manage identities across all clouds.

One of multi-cloud management's most significant security risks is privileged access sprawl. A converged platform that can reduce privileged access sprawl with access certification is necessary to curb the accumulation of privileges. Converged identity platforms consolidate this effort and perform tasks with a single set of credentials and a consistent policy.

To manage the complexity of the multi-cloud landscape, it’s advisable to utilize a governance platform that supports your multi-cloud management strategy. This platform should have the following capabilities:

• Ability to view the entire threat surface from a centralized hub instead of dealing with vendor-specific tools and end-point solutions. Your centralized governance hub must work for all systems and applications, both on-premises and cloud-based.

• Ability to identify and correct violations in real-time. The governance platform can identify and correct issues using intelligence and automation.

• Ability to provide predictive analytics that allows insightful and proactive management across the entire landscape of auditable devices.

Developing multi-cloud governance is an essential element of cloud management. Organizations seeking to manage large and complicated multi-cloud infrastructure should leverage a multi-cloud governance and security platform. These platforms will allow you to reduce risk while smoothly managing your multi-cloud environment.

If you'd like to explore multi-cloud security and governance in more detail, please contact us for a complimentary discussion.