nobeastsofierce - Fotolia


How enterprises can ensure a secure cloud migration

Managing a secure cloud migration is an involved process for enterprises, but it can be made easier by carefully choosing what goes to the cloud and what stays on premises.

Cloud services have become widely used over the last couple of years and the current trend of their usage is rising. Because of its advantages, some enterprises are beginning to migrate all or part of their infrastructures to the cloud, but they aren't considering the less obvious disadvantages.

Moving to the cloud presents different risks than those in traditional IT environments, and the most important one is the disclosure of sensitive information. While keeping this problem in mind, the cloud also provides a number of benefits, including the low-cost setup. Considering the risks, organizations have to carefully choose what to migrate to the cloud and what might be better off left in a traditional, on-premises environment.

A secure cloud migration for nonsensitive systems and services

The first thing that needs to be decided is which systems, services or applications will be migrated to the cloud. The applications containing sensitive information can be stored anywhere -- even in the cloud -- but it's difficult to protect this information during the migration. It's also difficult to protect sensitive information in a traditional IT environment, but it has been widely researched over the last couple of years, so a lot of helper programs and documentation are available on how to do it properly. The problem with keeping data in the cloud is that the cloud service provider (CSP) has absolute access to it, so sensitive information either has to be encrypted on the client side before sending it to the cloud, or the organization has to trust the CSP to handle the data properly.

To avoid this problem and ensure a secure cloud migration, the organization can keep the sensitive information in its network and only migrate the noncritical systems, including the presentation websites of the company, the blog posts and news.

While migrating services to the cloud is fairly easy and requires only an active subscription to one of the CSPs providing a cloud system, having secure access to those systems is another story. Often when an enterprise orders a number of cloud systems that come with preinstalled operating systems and migrates applications to those systems it exposes access to those systems via SSH. While SSH by itself is secure, all the other services running on a cloud server may not be.

When an organization attempts a secure cloud migration, it relies on multiple data centers as well as its traditional IT environment, but the data centers and the tradition infrastructure are not connected to each other.

Services must be running and exposed externally to the entire Internet in order to be able to access them in the cloud. There are a number of options to avoid this -- including using a SSH tunnel to the service running locally and limiting access to only predefined IP addresses by using a firewall like IPTables -- but they are complicated and require a lot of maintenance. Instead, it's possible to use IPsec tunnels to establish secure encrypted tunnels between the networks, while having access to the local services running behind the tunnels on both endpoints.

This allows both endpoints of the tunnel to access the local services without exposing them to the outside world, but it's still important to place additional constraints on the connections coming from the cloud server that is trying to access one of the local services or applications.

Also consider the possibility that the cloud server could be hacked by a malicious attacker or by a disgruntled employee of the CSP -- remember the CSP has absolute access to the whole infrastructure, including organizations' servers. Once the tunnels are established, anybody with access to the cloud server will also be able to connect to the private services in the traditional IT network. Therefore, it's imperative to set up additional rules that prevent the cloud servers from being able to protect the local assets, while still allowing the private servers to access the services running in the cloud.

Companion article

See Infosec Institute's accompanying article on Establishing a Secure IPSec Connection to the Cloud Server

When an organization attempts a secure cloud migration, it relies on multiple data centers as well as its traditional IT environment, but the data centers and the traditional infrastructure are not connected to each other. Using a secure IPsec tunnel between the border gateways to interconnect all of the environments together to form a larger infrastructure network will solve this problem. It will allow access to the back-end local services and applications running in local environments without exposing them to the outside world.

There should also be a number of filtering rules applied to the border gateways to allow access to certain resources, while preventing access to the resources that contain sensitive information. One of the most important services to use in a secure cloud migration is a backup service. This would allow for a number of agents to be installed on the systems that need to be backed up all over our infrastructure, regardless of where the server is located. Then a single server within a traditional IT network can be authorized to perform backups of the other remote systems, which can be done securely and regularly without exposing anything to the external Internet.

Secure cloud migration
Secure cloud migration

This type of setup can also be turned into a high-availability cluster by interconnecting different networks into a single larger network. For high-availability on a single service, configure the service to run on different machines in different environments, in the traditional IT environment center as well as on multiple cloud environments. Once everything is set up correctly, if one server fails for whatever reason, another server can take over and still serve the users without them even knowing one of the servers went offline.

How to achieve a secure cloud migration

For a secure cloud migration, sensitive information should be stored in traditional IT networks -- which the organization will have total control over -- while other services can be migrated to the cloud without sacrificing security. It's hard to protect a service containing sensitive information during a move to the cloud, but a data compromise can be avoided by only moving the applications that do not contain any sensitive information.

Despite security concerns, the cloud is still beneficial for a number of reasons, like not having to think about the underlying hardware and the problems involved with it, as well as the cheap cost of renting the servers. The fact is that many of the problems organizations have in traditional IT environments disappear in the cloud, while other problems rear their ugly heads.

Next Steps

Check out this essential guide to enterprise cloud migration

Learn more about the evolution of hybrid cloud security

Find out how to piece together a private cloud migration strategy

Dig Deeper on Hybrid and Private Cloud Computing Security