Zero trust strategy: cloud security by design
0 likes745 views
Accenture moved 95% of its applications to the cloud over six years by prioritizing security from the start. It redefined its security model and rules to align with cloud capabilities and adopted a zero trust approach. This involved sharing security responsibilities with cloud vendors, using cloud-based security solutions, continuously adapting to maintain compliance, and making identity the basis for access and trust. Accenture's holistic cloud security strategy provides effective security policies across its multi-cloud infrastructure.
Zero trust strategy: cloud security by design
- 1. STORIES The benefits of a security- first approach to cloud Make cloud secure by design
- 2. Copyright © 2022 Accenture. All rights reserved Secure by design Call for change As we have seen in the last 18 months, cloud opens the door to organizational agility on an unprecedented scale. But security is essential to take advantage of cloud’s potential. Accenture, with our size, scale and complexity, has experienced first- hand the power of cloud security. Six years ago, Accenture initiated the move into the cloud. While our recent research has identified that security and compliance risk is seen as one of top two pain points of cloud adoption, we were clear from the outset that cloud security would be a critical component to supporting our business needs. Moving from on-premise infrastructure where we had complete control, to collaborating in the cloud with vendors and needing to rely on their technology and environment was a big shift. Infrastructure and new service capabilities in the cloud are different; we couldn’t simply replicate what we had on-premise directly into the cloud. We needed to reimagine the approach to implementing our security model to harness the capabilities of cloud native solutions. We evolved core security guiding principles to meet the requirements of operating in the cloud. We redefined our security rules to flex around the updated cloud-based infrastructure. Today, when we look at our security approach we think beyond just infrastructure to an application, data and code level as well. From the initial migration, we are now running 95% of our applications in the cloud. Our strategy was to be secure from the start, reframing our security in terms of cloud capabilities, which has helped us to see how our cloud solutions can support every element of security needed within the business.
- 3. Copyright © 2022 Accenture. All rights reserved Principles in practice When tech meets human ingenuity Copyright © 2022 Accenture. All rights reserved Early on in our cloud continuum journey, we recognized the need to evolve our security practices to accommodate our core security values for the cloud. We wanted to be powered by code, securing our application and infrastructure code from the start. We infused analytics that were behavior-driven, using automated artificial intelligence (AI) behavioral analytics to identify anomalies faster and with more accuracy when working across our cloud platforms. It was important to us to be cloud agnostic, fit for a multi-cloud environment, so that the security framework and principles apply to any cloud vendor with auditability. What’s more we embedded robust defense, relying on multiple layers of security at varying depths: cloud, network, access, data and endpoints. We centered our strategy on a zero trust approach, protecting every aspect of the cloud security journey by treating everything as untrusted. With the focus on zero trust, we followed an identity-centric approach, basing all access on identity where every request is explicitly verified.
- 4. Copyright © 2022 Accenture. All rights reserved Cloud security is not a one-size-fits-all; it’s multi-faceted. By taking a comprehensive view across access, applications, services and data we’ve created a truly holistic cloud security approach. PENELOPE PRETT Chief Information Officer, Accenture When tech meets human ingenuity Five core functions contributed to a successful cloud security journey: We shared responsibilities. As we increased our software as-a-service (SaaS) and platform as-a- service (PaaS) consumption in the cloud, we focused on and trusted in a shared responsibility model with our cloud vendors. Our partnerships with Microsoft, Amazon and Google cloud services took advantage of their experience in the market, their wide security certifications, and the fact that they value security as much as we do. We sought out cloud-based solutions. Cloud providers are investing heavily in their innovation offerings and security. By using cloud native and cloud-based policies, controls, processes and technologies we were able to tap into an inherent agility and scale when it came to supporting our own cloud security. We enabled compliance. Partnering with our providers, our cloud security strategy anchors to industry-recognized standards and continuously adapts to enterprise business needs. We adhere to industry defined policies, using alerts, following the zero trust principle and managing security through code to maintain compliance. We increased visibility. We took a multi-layered approach, enhancing security through cloud vendors’ technology and advanced threat detection solutions. We gained visibility not only for our own actionable management, but also external auditability. We baked in trust. We believe identity is the new firewall. Our identity-centric approach means we have adopted a zero trust strategy in which we embed proper and continuous identity validation. Trust is now fundamentally going to be driven by identity and role.
- 5. Copyright © 2022 Accenture. All rights reserved Evolving holistic security A valuable difference We have taken a comprehensive view across the various components of operating in the cloud to create a truly holistic cloud security strategy. As we implement this transformational approach to security across a multi-cloud infrastructure, we can continue to enforce highly effective security policies, resources and services. Here are some of our lessons learned around effective cloud security: • Design in terms of the cloud: A cloud continuum journey requires a very different operating model to any on-premise solution. Reimagine your security principles, to unlock the power of security in the cloud and transform your business. • Make the cultural shift: Bridge the cultural gap to cloud native services from the top down. Education and training can help to change mindsets so that people understand the benefits of cloud and why your security posture is important. • Promote partnership: It’s important to build trusted relationships with your providers and to look at the ownership of security as shared. Also, keep in mind that the investments in security made by the major cloud providers are far in excess of what’s feasible for most IT organizations—offering an advantage to those who collaborate more effectively. Going forward, to secure and manage access controls across a multi-cloud environment, we have our sights set on cross-platform alignment so that all identities align across all platforms and vendors. Using data as the key driver, our cloud security will continue to be comprehensive as our cloud capabilities grow across platforms. And we want to discover new solutions and augment our security with AI for threat detection and machine learning to remediate our code to prevent potential vulnerabilities. This combined with our Prevent, Protect, Detect, and Recover strategy can strengthen our zero trust imperative. There's some exciting things on the horizon. As our AI and machine learning capabilities grow, we’ll be able to detect anomalies in behavior and make rapid decisions to act on security threats in the cloud. Having a more highly automated response is a powerful proposition and could reinvent cloud security as we know it. DON GALZARANO Managing Director—Global IT, Enterprise Technology, Intelligent Cloud & Networks, Accenture
- 6. Copyright © 2022 Accenture. All rights reserved Copyright © 2022 Accenture. All rights reserved. Accenture and its logo are trademarks of Accenture. About Accenture Accenture is a global professional services company with leading capabilities in digital, cloud and security. Combining unmatched experience and specialized skills across more than 40 industries, we offer Strategy and Consulting, Interactive, Technology and Operations services — all powered by the world’s largest network of Advanced Technology and Intelligent Operations centers. Our 699,000 people deliver on the promise of technology and human ingenuity every day, serving clients in more than 120 countries. We embrace the power of change to create value and shared success for our clients, people, shareholders, partners and communities. Visit us at www.accenture.com. Contact Merim Becirovic Managing Director Global IT Enterprise Technology Don Galzarano Managing Director Global IT Enterprise Technology, Intelligent Cloud & Networks /merim-becirovic /don-galzarano