Digital Transformation - It's the buzzword these days. Everyone is on the bandwagon. Everyone wants to move to the "Cloud". But like everything in life, there's a right way of doing it, and a wrong way. In my years of working with various clients, I have learned a few good practices, a few bad, and a few outrageous. I have also been fortunate to work with a lot of brilliant minds and learned a lot from them along the way. This post is not a step-by-step manual to Digitally Transform your Enterprise or your Life, but I hope it helps as a high-level guide to what things you should bear in mind on your journey to and amongst the Clouds.
I appreciate my time and yours, so I will keep this post succinct.
Cloud Migration - Almost there but not yet
The Don’ts
Let's start with things you shouldn't be doing:
Do not be in a rush to migrate to the Cloud – If you do, you will certainly make mistakes, skip best practices, and compromise. Take your time, have a plan, dot your I’s and cross your T’s. The business always wants to rush to see ROI (Return on Investment) or cost-savings. “Turn it on, and we will put controls in place later” – that never happens soon enough.
Please do not give out individual access – This is a plea. It becomes an unmanageable nightmare; I can guarantee it. Instead, tie access to groups/roles and then periodically certify the access using Identity Governance tools. More on this later.
The Dos
Establish Ownership - Identify the owner of every entity you have in your Cloud infrastructure. Use tags religiously for this, and use policies to enforce tagging. Once things are out there, it will be a huge ordeal chasing the owners. And the business will never let you abruptly shut down resources or access that isn't "owned", for fear of breaking things in Production.
Have an Identity Governance Model in place - Besides establishing ownership, you need to have a robust, repeatable and enforceable Identity Governance model in place. There are a lot of third-party tools out there besides what the Cloud Providers offer; pick one that suits your needs. Run access certification cycles, and run them more often for privileged accounts. You should always have almost real-time information as to who has access to what, why, when and by whom. Always follow the principle of least privilege. I usually take product or vendor documentation with a grain of salt. The permissions they ask for are almost always excessive. Question everything.
Implement a RACI Matrix - It's existential for your business's Cloud Infrastructure to have an associated RACI (Responsible, Accountable, Consulted and Informed) matrix. You can model it on your on-premises RACI matrix, but remember it’s not always an apples-to-apples comparison. Your Information Security and Audit teams should definitely play an active part in whatever is deployed. While InfoSec approval should be required, periodic audits by GRC should be enforced.
Infrastructure as Code - Implement everything you deploy to the Cloud as code, and I mean everything: groups, roles, policies, networks, virtual machines etc. Implement this as a part of your DevSecOps rollout. You will avoid mistakes and skipped best practices, and instead have a defined, secure, reviewable process to create, update or delete infrastructure. AWS CloudFormation has its limitations, but it’s better than manual changes. Azure ARM templates are a bit too verbose for my taste, but they get the job done. I do like Terraform, but that's a personal preference. Your Infrastructure as Code implementation can be Declarative (Templates) or Imperative (Scripts), or a combination of both. A suggestion: avoid putting thousands of lines of declarative templates in a single file.
Defense in Depth - Besides the processes and controls, abide by the philosophy of Defense in Depth. Allowlist IPs, put network security rules in place, and enforce Multi-Factor Authentication (MFA) and conditional access. The list goes on, but note there's a thin line here. Too many security controls lead to an inconvenient, if not terrible, user experience. That hurts productivity, and it pushes users toward compromises and bad choices to avoid jumping through the security hoops you have put in place. Cyber Security should be a business enabler, not a business hinderer.
Educate - I cannot stress this enough. Educate everyone in your enterprise on good security practices. Training, short videos, posters, banners, and notices all help. Constantly, yet subtly, remind your users about the threats enterprises face in today's environment. Short videos or articles on recent security incidents, their impact, and the methods used are a great way to keep users interested and educated. Broadcast these to everyone.
For further reading, I suggest the OWASP DevSecOps Maturity Model.