Webinar Recording

Organisations are moving to the cloud, and this is bringing fresh new challenges, including how to secure the data and applications they have in the cloud.


The webinar is organised in collaboration with Sophos, a cybersecurity partner of Chess since 1998, and a key player in the industry.


Furthermore, more than 200 customers have entrusted Chess and Sophos with their cybersecurity, including NHS, government and education organisations, corporation as well as charities.


Our portfolio is not limited to cybersecurity. We enable the digital transformation of 35k customers, whom we have provided with network consultancy, connectivity and development capabilities.

 


There are different reasons businesses and organisations want to move their infrastructure to the public cloud.


The main being that they want to trade CapEx for OpEx: a private cloud infrastructure requires significant investments for serves, virtualisation and internet pipes. However, by transitioning to the public cloud, these expenses are replaced with monthly bills, according to the usage – no need to predict or guess capacity requirements, instead they now grow (and pay) as they need.


The ability to spin servers up quickly is another advantage because of the public cloud agility. This means that even start-up organisations or small businesses can go global in a matter of minutes, a massive benefit for organisations with restricted budgets.


However, among the common misconceptions and myths is that that if a business moves to the public cloud, security is then the responsibility of the cloud provider. On their website, Microsoft outline what you still need to consider to ensure the security of your data:


• Firewalling
• Intrusion detection/intrusion prevention
• Vulnerability management
• Application control
• Network-based anomaly detection
• Web filtering
• Antivirus
• Botnet protection


Source: Microsoft


From this, it becomes obvious that the rules don’t necessarily change when you move your data to the public cloud. Instead, you should continue having the same cybersecurity concerns as you did for private infrastructure.


The public cloud provider is responsible for the security of the cloud (i.e. the data centres), but they are not responsible for what is in the cloud. As not many people realise that, 1 in 6 of Amazon’s S3 storage buckets is leaking sensitive data and company secrets. This is the result of organisations moving to the public cloud but not adding the necessary measures to secure their information.

 


Sophos recently released a whitepaper on Public Cloud Security. During the research they spun ten honeypots in different locations across the world, using RDP servers and their default settings – the time it took for people on the internet to force their way in was 52 seconds.


Therefore, Cloud Optix is aimed at providing you with a better understanding of what you are doing on the public cloud. The product slogan is ‘if you can’t see it, you can’t secure it.” It can help you in three main areas – visibility, compliance and response.


Visibility
Assets in AWES MS Azure, Google Cloud Platform


After the migration to the public cloud, businesses can end up paying more than they need to. One of the main benefits of Sophos Optix is that it provides visibility of the assets on the cloud and helps to keep tabs on the consumption.


Compliance
Reporting and adherence based on behaviours and best practices


Sophos Optix allows users to continuously look at the posture in the public cloud and ensures they are compliant with GDPR and more.


Response
Instant remediation and incident response


Cybercriminals are constantly trying to force their way in servers and steal valuable information. However, if the breach happens in the middle of the night, your team are unlikely to be able to react immediately. What Sophos Optix does is that it has automated this process and an immediate response is deployed.


If you are already a Sophos customer, you would be aware of the Synchronised Security Platform. While Optix is not currently a part of it, Sophos plan to integrate the solution by the end of this year. The transition is expected to be seamless as the look and feel of Optix is already very similar to the Synchronised Security Platform.


Questions from the webinar:


In your opinion, do the regulatory bodies have a good grasp of cloud migration best practices?

Overall, most of the security rules followed for on-premise infrastructures need to stay the same when a business migrates to the public cloud. As cloud services grow, an organisation needs to have visibility of what is on the public cloud, which can also ensure the company is compliant.

How does Cloud Optix compare to some of the native controls within those platforms (AWS, Microsoft Azure and Google?

These platforms do not have the depth of the security aspects required currently. The advantage that Optix has is that it leverages APIs that exist within the public cloud infrastructure, gathers data from those providers, presents it in a useful tangible way and uses the remediation functionalities to write back to those APIs to make configuration changes - automatic remediation.

Can I add Optix to my existing Sophos license and how is it priced?

Sophos Optix allows you to link to all three public cloud providers and you can connect up to 3 dashboards and link up to 100 assets on one licence. However, if you have more than that, you would need more than one licence. From experience, we have noticed that a lot of the customers are not aware of how many assets they have. As part of the scoping exercise we perform during the Optix demo, you would be provided with a better idea what you’ve got, and your quote would be based on that.

How difficult is Optix to deploy?

Optix takes between 5 and 10 minutes to run the script for the demo and the data to start collecting. As compliance templates are built in, their deployment is a matter of on and off switch. If you decide to use every single feature of the solution, it will not take the team more than a day to set up.

If you are interested in learning more about Sophos Cloud Optix or need advice about migrating to the public cloud, give our experts a call on 0330 107 1860.