Hybrid Cloud Data Protection: What It Actually Covers and Why It’s Easy to Get Wrong
Introduction
The hybrid cloud approach to securing data is all about securing data residing in on-premises infrastructure as well as in cloud environments, and not by using a disconnected approach to security for each of the environments independently.
It may sound pretty simple; nevertheless, the number of consistency issues inherent in securing data in two different worlds is often underestimated by companies.
Why Hybrid Cloud Data Protection Is More Complex Than It Appears
Data protection in the hybrid cloud is not a standardized procedure but a composite one which comprises the following elements:
- Security measures for on-premises environment
- Security measures for cloud environment
- Unified policy management in both environments
Some companies have different security units and tools for both environments, which leads to visibility issues as well as different levels of security in each of them.
For a company moving its data from an on-premises environment to a cloud environment and vice versa, data protection should be performed separately for each step since data transfer is the most vulnerable stage of data lifecycle.
Major Areas of Hybrid Cloud Data Protection
Consistent Policy Enforcement
Rules Governing
- Unified policies for access control in both environments
- Unified encryption policies irrespective of the location of data
- Unified policies for data classification across both environments
Inconsistent policies in both environments are one of the most common and expensive problems since this might lead to:
- Weaker security in that environment which is less cared about
- Ambiguity regarding the policy that should apply to the data
- Security vulnerabilities at the border between environments
Data Movement and Transfer Security
Data transfers usually occur often in hybrid clouds, and encryption and monitoring have to be employed to meet security requirements while moving between systems.
Transfer Security Often Includes
- Encryption during movement of data between on-premises and cloud systems
- Monitoring for any abnormal data movements
- Using secure connectivity like VPNs or dedicated network connections
Unified Visibility and Monitoring
Management involves not just individual monitoring capabilities for each of the two environments, but the growing requirement for visibility into the entire hybrid IT setup.
Those Visibility Tools Usually Vary in Many Respects Including
- How logs generated from both environments get fed into a common platform
- Consistency of alerts and incident handling between the environments
- Data lineage across systems
Backup and Recovery Across Environments
Data protection in hybrid cloud computing usually involves:
- Backups that take into consideration the location of data
- Recovery test that can prove recovery within cross-environment boundaries
- Recovery time objectives irrespective of the location of data
However, the complexity involved in such approaches depends on the level of integration of the on-premises and cloud environments.
Compliance Across Mixed Infrastructure
There are several hybrid cloud data protection software that demand certain documentation, such as:
- Proof of consistent controls for both environments
- Data residency compliance for data that moves from one location to another
- Audit logs covering the entire hybrid environment
This documentation is needed since regulators and auditors expect consistent compliance no matter where the data resides physically.
Why Hybrid Cloud Protection Gaps Happen Even at Security-Conscious Organizations
Inconsistent protection of a hybrid cloud is rarely the result of either ignoring both environments.
Inconsistent protection may be due to the fact that:
- There are separate teams responsible for security in on-premises and cloud environments which do not communicate with each other.
- The junctions through which data moves between different environments do not get enough attention.
- Monitoring tools for one environment do not provide visibility into another environment.
How Organizations Build Effective Hybrid Cloud Data Protection
Establishing Unified Governance First
In larger companies, it might be possible for them to develop consistent policies prior to deploying the environment-specific technical controls, considering the fact that each environment had different teams handling them in the past.
Practices Supporting Consistent Hybrid Protection
- There are certain hybrid cloud data protection solutions that help companies to:
- Centralize logging and monitoring within both the environments
- Develop consistent encryption and access control policies irrespective of the environment
- Test their backups and recoveries across environment boundaries
Ongoing Hybrid Environment Reviews
Organizations perform periodic assessments of the following:
- Consistency of policies in both on-premises and cloud infrastructures
- Security of data movement points between the systems
- Gaps in visibility when monitoring does not cover the hybrid environment fully
Periodic assessments allow organizations to ensure that their hybrid cloud protection is consistent as their infrastructure evolves.
Common Hybrid Cloud Data Protection Mistakes
Managing Environments in Separate Silos
Operating on premises and cloud security systems in silos without any coordination of policy and visibility.
Overlooking Data Transfer Points
Applying security to each environment individually but overlooking the critical period during which the data transfer happens.
Inconsistent Backup Strategies
Having different ways to do backups for each environment without an integrated plan for recovery.
Poor Cross-Team Coordination
Lack of teamwork in between:
- Teams running on-premises infrastructure
- Teams running cloud systems
- Security teams tasked with the comprehensive data protection strategy
Ineffective inter-departmental teamwork could result in problems that are not owned by either side.
Bottom Line
The protection of hybrid clouds is highly varied, taking into account the factors like enforcing a common policy, securing data transit, gaining unified visibility, performing backups across environments, and creating reports about compliance.
In light of the ease with which different teams and solutions can create visibility silos in their respective environments, it makes much more sense for enterprises to develop governance and monitoring that will work across the whole hybrid environment.