Strategia di resilienza informatica per ambienti ibridi
Why hybrid infrastructure poses heightened risk – and how to build a cyber resilience framework to protect yours.
Panoramica
Garantire la continuità operativa e il Recovery rapido
In a dangerous and unpredictable world, a cyber resilience strategy is your organization’s digital survival kit. Designed to for rapid recovery and business continuity following a cyberattack – and to prevent such incidents in the first place – the right cyber resilience framework can turn potential catastrophes into momentary inconveniences. But first, you have to address the unique cyber resilience challenges that hybrid environments pose.
We’ll explain how to build and implement an effective cyber resilience framework to keep your hybrid environments up and running for your business.
definizione
Comprendere gli ambienti ibridi
To understand what makes cyber resilience difficult to achieve in hybrid infrastructure, let’s first take a closer look at those environments. In a hybrid IT strategy, the organization uses a mix of on-premises and cloud-based solutions to develop and deploy applications, run workloads, store data, and deliver services. In one common version, legacy applications remain in the datacenter while DevOps teams build new applications in the cloud. In other cases, IT may decide to migrate some or all existing on-premises applications to a cloud provider’s infrastructure, or even rebuild them entirely as cloud-native versions. Companies can also choose to leverage cloud providers’ services for IT and security functions traditionally handled locally, such as software-defined networking, detection and response, and serverless computing.
A hybrid IT strategy offers considerable advantages – especially around flexibility and agility. Organizations can distribuire strategicamente la propria infrastruttura IT su diversi ambientiin base alle esigenze specifiche dei singoli carichi di lavoro; ad esempio, ospitando in loco applicazioni critiche o dati soggetti a normative rigorose, mentre si ricorre al cloud per altri carichi di lavoro.
La scalabilità può essere quasi istantanea senza la necessità di procurarsi hardware aggiuntivo, e le risorse possono essere spostate facilmente tra diverse sedi per ottenere prestazioni e disponibilità ottimali. Anche il costo è un fattore chiave, poiché le organizzazioni passano da costosi investimenti di capitale, manutenzione in loco e cicli di aggiornamento infiniti a risorse completamente gestite su richiesta.
However, the cloud presents a number of drawbacks as well. Foremost is complexity, as IT teams work to manage and integrate disparate systems across on-premises and cloud platforms. An expanded attack surface – much of it inaccessible within the cloud provider’s own infrastructure – increases the potential for security incidents. That’s especially true given the gaps in security controls that can come with a decentralized infrastructure. Depending on your industry, cloud resources can introduce major regulatory headaches, and simply won’t be an option for some types of data and applications.
You’ll notice that several of these drawbacks are related to security and risk. That brings us to cyber resilience.
Gestione del rischio
Utilizzo dei modelli di resilienza informatica per ridurre i rischi
Whatever type of infrastructure a business uses – on-premises, all-cloud, or hybrid – building cyber resilience takes more than throwing together an assortment of security measures. To enable coherent protection and preparation across every part of the environment, mature organizations adopt a cyber resilience framework spelling out a comprehensive approach to managing cyber risk. The best practices detailed in these frameworks can help you minimize disruptions, protect your reputation, align with regulatory requirements, and stay agile in the face of evolving threats.
Tra i quadri di riferimento consolidati che guidano le organizzazioni nella costruzione della resilienza informatica figurano:
• NIST Cybersecurity Framework – A set of requirements organized around five core functions: identify, protect, detect, respond, and recover.
• MITRE Cyber Resilience Engineering Framework (CREF) – Specific resilience techniques like adaptive response, deception, and dynamic positioning.
• UK Cyber Assessment Framework (CAF) – 14 principles supporting four primary objectives: managing security risk, protecting against cyberattacks, detecting cybersecurity events, and minimizing incident impact.
Questi framework rappresentano un punto di partenza fondamentale per lo sviluppo della propria strategia di resilienza informatica. Tuttavia, la loro applicazione in un ambiente ibrido comporta un certo grado di difficoltà.
Sfide
Sfide informatiche in un ambiente ibrido
L’approccio alla resilienza informatica potrebbe risultare più semplice in un ambiente IT completamente virtualizzato o on-premise. Tuttavia, in un ambiente ibrido, la resilienza informatica diventa particolarmente impegnativa a causa della diversità delle tecnologie on-premise e cloud in uso. I team di sicurezza devono ora tenere conto di:
• Increasing complexity – With resources spread across multiple environments, there are more potential entry points for attackers. Cloud services and on-premises systems may call for different security measures, making it harder to take a holistic approach to protection.
• Data movement and access – In hybrid environments, data flows constantly between systems and cloud platforms, often over public networks. Secure data transfer and consistent access management are mission-critical.
• Visibility and monitoring – Gaining a complete, unified view of systems and data across on-premises and cloud-based resources is anything but simple. To identify anomalies and potential threats, SecOps teams have to correlate data from multiple sources, environments, and tools.
• Incident response and recovery – Incident response plans have to account for both on-premises and cloud-based components. Enabling consistent and rapid data recovery across diverse environments takes careful planning and specialized tools.
• Compliance and governance – On-premises and cloud data can fall under different regulations, adding to the compliance burden. In many industries and regions, data security and data sovereignty requirements place strict rules on where data may be stored and processed.
• Flexibility and scalability – Shifting workloads between on-premises and cloud environments can alter security requirements. Your cyber resilience strategy has to be able to keep pace.
Azienda ibrida
Sviluppare una strategia di resilienza informatica per un’impresa ibrida
With these factors in mind, we can break down the key elements of a cyber resilience strategy – including special considerations for hybrid environments.
• Risk Assessment
Risk assessment focuses on identifying and evaluating potential threats and vulnerabilities. By analyzing their likelihood and impact, you can prioritize resources and effort where they’re most urgently needed. In a hybrid environment, this begins with taking a comprehensive inventory of all assets, both on-premises and in the cloud, including physical hardware, di macchine virtuali, cloud services, and data repositories. You’ll also need to evaluate the risks associated with data movement between environments, including the potential for inconsistent security controls across platforms and any differences in compliance between local and cloud-hosted data.
I test di sicurezza sono una parte fondamentale della valutazione dei rischi, poiché aiutano a comprendere quanto efficacemente i dati siano protetti da vari tipi di minacce. I test di penetrazione possono aiutare a identificare le vulnerabilità nei sistemi, nelle reti e nelle applicazioni prima che possano essere sfruttate dagli aggressori. L’intelligenza artificiale può aiutare ad automatizzare alcuni aspetti dei test di sicurezza, come la scansione delle vulnerabilità, e ad analizzare i risultati dei test di penetrazione per identificare modelli e tendenze.
• Prevention
Prevention takes the form of proactive measures and defensive technologies to stop potential attacks across your diverse environments. This includes deploying robust security controls such as firewalls, intrusion prevention systems, and encryption for both on-premises and cloud-based assets. A unified identity and access management (IAM) system that works seamlessly across platforms can support zero trust by enforcing the principle of least privilege across all your resources wherever they reside. Network segmentation, another element of zero trust, is more complex in a hybrid environment – but no less critical.
Per colmare tempestivamente le lacune di sicurezza, i team IT devono assicurarsi di coordinare l’applicazione delle patch e degli aggiornamenti su tutti i sistemi, anche quando ciò comporta processi diversi per le infrastrutture on-premise e cloud. Una gestione sicura delle configurazioni su tutti i componenti del proprio ambiente ibrido può aiutare a verificare che gli standard di sicurezza di base siano mantenuti in modo coerente.
• Detection
Detection in a hybrid environment calls for a unified approach to monitoring and threat intelligence across on-premises and cloud infrastructures. You’ll need an advanced security information and event management (SIEM) system capable of collecting and correlating data from diverse sources, including on-premises servers and network devices as well as cloud services.
Gli algoritmi di rilevamento delle anomalie alla base dei controlli di sicurezza dovranno essere sufficientemente sofisticati da comprendere i modelli di comportamento normali nell’intera infrastruttura ibrida, compresi i cambiamenti improvvisi come il comportamento di auto-scaling nel cloud. Il monitoraggio continuo dovrebbe concentrarsi sui movimenti di dati o sui modelli di accesso insoliti tra gli ambienti on-premise e cloud. L’infrastruttura ibrida richiede inoltre strumenti di rilevamento e risposta per la rete e gli endpoint (NDR/EDR) in grado di operare efficacemente in entrambi i tipi di ambiente.
• Response
Response strategies in a hybrid environment need to be agile and coordinated across all infrastructure components. To prevent organizational silos from impeding resilience, incident response plans should clearly define roles and responsibilities for team members dealing with both on-premises and cloud-based incidents. These plans must account for the potential complexity of containing threats that may move between different environments.
Man mano che sviluppate e potenziate la vostra capacità di risposta, assicuratevi che i vostri strumenti funzionino senza soluzione di continuità in tutti gli ambienti. Ad esempio, le funzionalità di risposta automatizzata possono accelerare la risoluzione degli incidenti, ma prestate particolare attenzione a come interagiscono con le diverse parti dell’infrastruttura ibrida. Gli strumenti e le procedure forensi devono essere adattati per raccogliere e analizzare le prove provenienti sia dagli ambienti fisici che da quelli virtuali.
• Recovery
Recovery – restoring operations and data following an incident – can be an especially delicate matter in a hybrid environment. You’ll need the ability to back up and restore data quickly and securely regardless of its original location, which may involve cross-platform data migration tools. Recovery plans should prioritize critical business functions and consider dependencies between on-premises and cloud services. Testing recovery procedures regularly is crucial, simulating scenarios that affect different parts of the hybrid infrastructure.
Il cloud offre alcuni vantaggi che facilitano la Recovery, come la possibilità di effettuare il failover verso i servizi cloud se i sistemi on-premise sono compromessi o viceversa.
• Testing
When an incident occurs – not if – you don’t want your security and IT teams to be overwhelmed by the complexity of incident response in a hybrid environment. Regular testing of your security controls, including penetration tests, will individuare eventuali vulnerabilità e contribuirà a migliorare la Readiness operativa. Le esercitazioni teoriche e gli attacchi simulati contribuiranno a identificare le lacune nel piano di risposta agli incidenti e a confermare che tutti i membri del team comprendano i propri ruoli. Il piano dovrebbe inoltre includere procedure per l’analisi post-incidente, al fine di trarre insegnamenti da ogni evento e migliorare le risposte future.
• Adaptation
Cyber resilience is an ongoing process, not a moment in time. You’ll need to continuously assess and evolve your strategy and security measures to address new threats and changes to your infrastructure, applications, and data storage strategy. This can include adopting new cloud security tools, updating on-premises security measures, or implementing new integration strategies between the two.
Le informazioni sulle minacce possono aiutarvi ad adeguare in modo proattivo le difese sulla base della comprensione di come i nuovi vettori di attacco potrebbero sfruttare le caratteristiche specifiche del vostro ambiente ibrido. Dovreste inoltre promuovere una cultura del miglioramento continuo, incoraggiando il feedback da parte dei team di sicurezza e incorporando gli insegnamenti tratti dagli incidenti per migliorare la resilienza complessiva.
• Employee Training
A key but often overlooked element of any security strategy, employee training in a hybrid environment is critical to maintain cyber resilience across diverse platforms. Your programs should cover security best practices for both on-premises and cloud-based systems, including how to securely access and handle data across different environments by using VPNs, multi-factor authentication, and secure file sharing methods.
In a zero-trust environment, employees need to understand why they may be required to repeatedly authenticate themselves. Phishing awareness training should include scenarios specific to hybrid environments, such as recognizing attempts to steal cloud credentials. Regular simulations and exercises should be conducted to test employees’ ability to identify and respond to threats in both on-premises and cloud settings. IT and security staff should receive specialized training on managing and securing hybrid environments.
Attuazione
Funzionalità chiave per l’implementazione del piano di resilienza informatica ibrida
Sebbene la resilienza informatica dipenda da controlli di sicurezza completi, esistono alcune funzionalità chiave di particolare rilevanza per gli ambienti ibridi.
• On-demand Cleanrooms
Isolated, malware-free environments will allow you to test recovery processes, conduct forensic analysis, and perform actual recoveries as part of a cyber resilience strategy. Delivered on-demand, these cleanrooms offer un accesso rapido a spazi controllati senza la necessità di costose infrastrutture dedicate. Questa funzionalità è particolarmente preziosa per le configurazioni ibride, poiché fornisce uno spazio sicuro e scalabile, separato sia dagli ambienti di produzione on-premise che da quelli cloud.
• Continual Recovery Testing
The dynamic and complex nature of hybrid environments makes continual, automated testing essential. By validating your ability to recover critical systems and data across both on-premises and cloud infrastructures, you can identify gaps in recovery processes, maintain the integrity of backed-up data, and build confidence in your ability to respond to cyber incidents.
• Unified Monitoring and Threat Detection
Silos and proliferating screens can slow response and impair understanding. Analysts need a comprehensive monitoring solution that incorporates advanced SIEM, anomaly detection, and threat intelligence across on-premises and cloud environments. With effective visibility across your entire hybrid infrastructure, security teams can quickly identify potential security incidents, correlate events from different sources, and respond to threats more effectively.
• Automated Response and Orchestration
Automated incident response capabilities that work across hybrid environments can significantly reduce response times and minimize the impact of cyberattacks, regardless of where an incident originates. This includes automated containment measures, orchestrated recovery processes, and integration with both on-premises and cloud-based security tools.
• Secure data Backup and Recovery
Robust backup and recovery solutions designed for hybrid environments are essential. These should include features like air gapping, l’immutabilitàe la crittografia per proteggere i backup da manomissioni o danneggiamenti. La capacità di ripristinare rapidamente dati e sistemi sia in ambienti on-premise che nel cloud offre flessibilità nelle opzioni di Recovery e contribuisce a mantenere la continuità operativa.
Building cyber resilience in a hybrid environment can seem daunting, and for good reason. But by focusing on the core principles of cyber resilience, and understanding how they apply in a more complex, dynamic, and diverse hybrid infrastructure, security and risk management leaders can develop and implement the right strategy to enable continuous business. It takes work – but for the organization, it can mean the difference between life and death.
Raggiungere la resilienza informatica per i carichi di lavoro ibridi
Perché la resilienza informatica nel cloud ibrido?
