Introduction

As cloud computing and networks increase in size and complexity, it is important to consider the design of these cloud networks and architectures. While many of these networks are designed with scale and usability in mind to ensure maximum efficiency, security has not been a priority for many of these networks. This blog post emphasizes the value of a cloud security architecture review for clients and security teams.

Cloud Architecture Example

The following diagram shows a sample Amazon Web Service (AWS) architecture designed for a large enterprise. The components shown in the diagram are typically found in an AWS network, and similar components may be present in other popular cloud platforms such as Microsoft Azure and Google Cloud Platform.

Image

Figure 1: AWS Architecture (Source: Wondershare Edraw Max)

Below, we provide some guidelines to keep in mind for gaining stakeholder buy-in to conduct a security architecture review, in addition to performing the review.

Benefits of a Cloud Network Security Architecture Review

How to Perform a Cloud Network Security Architecture Review

Image

Figure 2: Process Diagram

What Cloud Network Security Architecture Reviews Help Solve

→ Organizations often neglect to review the system design process and fail to ensure the overall security, scalability, performance and cost-efficiency for their cloud platforms. The architecture review not only focuses on improving the security of the overall network, but also on enhancing the scalability and reducing the overall operating costs of the cloud environment.

→ Technology Rationalization - Organizations sometimes do not have a clear goal for the development or operation of a cloud environment. For instance, User Acceptance Testing (UAT) environments may be identical to pre-production environments. Hence, it costs more to maintain two environments to achieve the same functions. Cloud architecture reviews can help consolidate the environments and reduce the overall operating cost of the application and network development process.

→ High-Availability Environment Transitions - Certain organizations heavily rely on the high availability of the environment. Cloud networks, for the purpose of resiliency, will have primary zone and a secondary zone that acts as a failover network. The secondary network is configured identically to the primary network. In case the primary network goes down, the secondary network will be brought online or failover will be conducted. This is to improve business continuity and disaster recovery (BCDR). However, if the sync process of such an environment breaks, then a technician might only initiate a fix when the primary environment goes down. Attackers usually seek out high-availability environments as prime attack surfaces for gaining initial access to vulnerable systems. The cloud architecture review can make sure the sync process is clear and consistent, so that it is a simple process to switch environments at any time in the case of an attack or network outage. Optiv’s architecture review team can also tackle the passive environment and scale it up to the point where it can be ready to act as a primary environment in the event of a quick transition.

→ On-Premises vs. Cloud Architecture Migration – Migration from on-prem to cloud environments is usually a result of configuration changes, which make the overall environment vulnerable. The architecture review can help organizations review the cloud configurations to ensure that default values are not carried over to the new cloud environment. The review might also include suggestions for hardening the on-prem environment based on the existing setup. The architecture review is a core component of security, scalability and cost-performance for both on-prem and cloud environments.

→ Secure Automation - Certain ad-hoc deployments need a specialized, containerized environment that does not create flaws during the automation process. For instance, a developer might deploy a specialized Docker container to run the segment of the code library, which they can treat as a micro-service for the main application. The architecture review process can ensure that these automated components are always deployed with specific security standards and meet the security baseline policy of the organizations.

→ Monitoring for Unauthorized Changes – Organizations – specifically the security operations center (SOC) – may struggle with a lack of auditing within their cloud environment. This can result in high costs, low performance and a lack of controls and accountability. The architecture review reduces the overall SOC cost and streamlines the process of handling the cloud environment to produce the maximum results.

→ Architecture Documentation Management – A lack of documentation within a cloud environment is a primary concern for organizations. Small yet significant changes are not always documented in the process of change management. This gap impacts the environment and the changelog. The architecture review will ensure that the documentation and processes are up-to-date.

Compliance Frameworks

Companies can aim to be compliant with the following cloud compliance frameworks:

Companies can also refer to and implement the following Well-Architected frameworks when building cloud architectures.

Conclusion

This blog aimed to show how to perform a cloud network security architecture and demonstrate the benefits that a company can see in their cloud infrastructure. Please reach out to us at Optiv for any questions about conducting a a cloud security architecture review.