Where are you using WebAssembly?
Wasm promises to let developers build once and run anywhere. Are you using it yet?
At work, for production apps
At work, but not for production apps
I don’t use WebAssembly but expect to when the technology matures
I have no plans to use WebAssembly
No plans and I get mad whenever I see the buzzword
Cloud Native Ecosystem / Cloud Services / Security

How to Secure Your Cloud Environment Beyond Your Cloud Vendor’s Tools

There are important steps that users of cloud services need to take to secure their cloud-based environments and workloads — especially those that cloud vendors themselves cannot effectively secure.
Jan 8th, 2019 3:00am by
Featued image for: How to Secure Your Cloud Environment Beyond Your Cloud Vendor’s Tools

Twistlock sponsored this post.

Ever since the cloud became a thing about a decade ago, we’ve been inundated with warnings (such as here, here and here) about how the cloud can pose security risks.

In reality, the cloud is not inherently insecure, despite what some people may imply. Nonetheless, there are important steps that users of cloud services need to take to secure their cloud-based environments and workloads — especially those that cloud vendors themselves cannot effectively secure.

This article walks through those steps by highlighting what cloud vendors do to improve security, and which extra precautions users need to take.

Your Cloud Vendor’s Security Responsibility

Maame Efua Boham
Maame is a third-year student at Ashesi University in Ghana pursuing a degree in computer science. Boham is deeply interested in Python as a tool for global technological leaps in various fields. She has worked in the areas of data science, web development and software engineering.

The security your cloud vendor provides will vary depending on exactly which type of cloud service you use.

If you’re using an infrastructure-as-a-service (IaaS) like AWS EC2 or Azure Virtual Machines, your cloud vendor is only responsible for the underlying infrastructure. The OS, middleware and other runtimes fall on the client.

For PaaS platforms, such as Google App Engine, a client builds their own application; however, tasks such as data storage and management are abstracted away.

With software as a service (SaaS), cloud vendors host, manage and offer infrastructure as well as applications that companies can purchase and use. With all these cloud computing categories, however, the client is responsible for the data that is involved.

End-Users’ Cloud Security Responsibilities

No matter which type of cloud service you use, the burden of securing certain types of workloads falls on you and not your cloud vendor.

In general, you’ll want to keep the following pointers in mind to maximize the security of your cloud environment.

Review Default Cloud Settings

The first thing you need to remember is that while certain settings are automatically set by the provider, some of these must be manually activated. It’s always better to have your own set of security policies than to assume that the cloud vendor is taking care of a particular aspect of your cloud security.

Adapt Data Storage and Authentication Configurations to your Organization

All locations where data will be uploaded should be password-protected. In addition, password expiration policies should be carefully selected to suit the needs of your organization.

Don’t Assume Your Cloud Data is Safe

Never assume that cloud vendor-encrypted data is totally safe. Some cloud vendors provide encryption services before upload, and some do not. Whatever the case, make sure to encrypt your data using your own keys. Keep in mind, too, that data should be encrypted in transit and at rest.

Integrate with your Cloud’s Data Retention Policy

Understanding your cloud vendor’s data retention and deletion policy is essential in ensuring the safety of your data. What happens when you delete data from the cloud? Is it still accessible to the cloud vendor? Are there any places where it might have been cached or copied? These are some of the things you should verify up front when hopping onto a new cloud environment. It’s also important to have multiple copies of your data and have a fixed data retention period.

Set Appropriate Privileges

Appropriate settings for privilege levels go a long way to make your cloud environment more secure. By using Role-Based Access Controls for authorization, you can ensure that every person who views or works with your service only has access to the things that are absolutely necessary. Alternatively, a Rule-Based Access Control service, such as Twistlock, simplifies this process.

Keep Cloud-Based Software Up-to-Date

Your cloud vendor may provide infrastructure, and in some cases, a prebuilt software environment. But anything that you add is on you to secure.

Thus, it’s your responsibility as a user of a cloud service to ensure that your security patches, OS, etc. are up-to-date. The simplest way to prevent technical debt and backlogs is to automate the updates.

Build Security Policies and Best Practices into Your Cloud Images

Leaving the security of your cloud environment to different developers on your DevOps team might result in discrepancies in policy. A good way to combat this is to create cloud images with security tools configured and policies applied so that developers can simply create instances of them and work with those.

Isolate Your Cloud Resources

To reduce the risk of hackers gaining complete control over your system, it is advisable to have separate admin accounts for development, deployment, testing, etc. That way, if a hacker accesses one account, he or she cannot hop on to other aspects of the environment.


Your cloud vendor will do what it can to secure resources you run in the cloud, but the fact is that your cloud provider cannot protect you on their own. Your collaboration is critical for securing services and resources that the cloud vendor either does not manage, or may not have configured in a way that ideally suits your organization’s needs.

Feature image via Pixabay.

Group Created with Sketch.
TNS owner Insight Partners is an investor in: Pragma.
THE NEW STACK UPDATE A newsletter digest of the week’s most important stories & analyses.