The cloud allows access to resources on demand, delivers easy scalability, and saves costs. Containers enable packaging and applications with dependencies to run in any environment. The combination of cloud and containers offers businesses unparalleled speed, agility, and flexibility.

But traditional security approaches no longer suffice with the cloud and containers. Conventional deployments do not work with the cloud, where most traffic comes from outside the network. Firewalls cannot operate in changing and dynamic container and microservices resource pools. 

Also, cyber threats and attacks have become sophisticated of late. Cybercriminals use Artificial Intelligence to launch sophisticated threats. These attacks target personally identifiable information, intellectual property, and trade secrets. Cybercriminals use such stolen information for ransom or financial fraud. Or they may target critical infrastructure with malware to wreak havoc.

Enterprises face the challenge of gaining the trust of customers and partners in the new, changed digital ecosystem. Without establishing trust, users will not use digital systems. The digital ecosystem will fail, taking down the company with it. 

So what is digital trust?

Digital trust is the confidence customers, and other stakeholders have in the company’s digital transactions. It involves the assurance that the company protects digital data, applications, and services, and only authorized entities can access such digital assets.

In the era of hybrid cloud workloads, machine-to-machine communications, microservices, and big-data analytics, digital trust is fast replacing network perimeter apparatuses as the basic security tools.

The conventional network security approach tries to safeguard the enterprise from attacks. Sophisticated cyber-attacks and complex enterprise systems make a defensive approach impossible. Such realization shifts the cyber security approach to digital trust. Enterprises that gain digital trust remain resilient to withstand the attack without damage. 

How can enterprises build digital trust?

1. By adopting a “shared responsibility” approach

Cloud providers offer robust security features. But relying exclusively on them for security is treading dangerous ground. 

Cloud providers do not customize their environments to the special needs of each customer. They do not accept responsibility for cyber-attacks outside their normal service-level agreements either. The onus is on the enterprise to safeguard itself against attacks. 

The best enterprises adopt a shared approach. They co-opt the security measures the cloud service providers offer and add their layers.

Also, most enterprises today often rely on multiple cloud service providers. They design an integrated security approach that covers all providers.

2. By implementing security by design.

Most businesses are busy re-imagining and re-inventing their processes to gain digital trust. Digital trust requires going beyond integrating a piecemeal security approach. It requires embedding security into the development process. 

• Co-opt DevSecOps practices, such as continuous security testing and code reviews. Such tools help to identify and remediate security vulnerabilities fast.
• Bring all project stakeholders to identify the internal process and user experience. Ensure all processes make the right trade-off between user experience and security. 

3. By segmenting communities of trust

The old-world approach of deploying network firewalls no longer works. It is impossible to mediate access rules on cloud-based elastic microservices. 

Digital segmented communities of trust allow dynamic allocation of assets and application workloads. Such allocation takes place on a need basis. 

Such communities of trust offer network admins greater control and improve user experience. The process becomes more convenient and transparent.

The core of such digital segmentation is access control of various resources. The hybrid nature of cloud services involves multiple stakeholders. They use identity and digital capabilities across private and public subscription services, private workloads, hosted data centers, and virtualized workloads. Identity and access management (IAM) tools manage user identities, authenticate access, and authorize resource permissions for such varied stakeholders. 

Many enterprises reuse conventional IAM and security information and event management (SIEM) tools for the hybrid cloud. Such an approach requires less training and less staffing but also increases costs. Depending on the event rates and storage rates, costs for cloud uses for SIEM in the cloud environment could cost 2X or more.

The more popular approach of late is using microservices security fabrics native to cloud workloads and integrating these with existing IAM, SIEM, and non-cloud workloads. Such an approach allows consistent security services across the board. It also costs less than taking client-server security to the cloud. But system admins would need additional training and go through a steep learning curve. API-based “as a service” versions of IAM and SIEM have different operating, scalability, speed, and financial characteristics than on-premises versions. Using pre-packaged security appliances from security experts is the best way to proceed with this approach friction-free. 

4. By implementing effective data protection and privacy measures. 

Perimeter protection is obsolete in the cloud since most traffic comes from external sources. 

Encryption is a primary mechanism to safeguard data in transit and at rest. Other security measures include data anonymization and pseudonymization techniques. Anonymization scrubs the data of any identifier information. Pseudonymization reduces the link of a dataset with the identity details of individuals enclosed in the data.

These approaches minimize the risks associated with data breaches.

5. By improving threat detection and incident response capabilities.

The core of the digital trust approach is having mechanisms to detect and respond to suspicious events and incidents. An incident response plan minimizes the impact of security incidents. A well-defined recovery plan restores operations fast.

Enterprises need to:

• Monitor data. Ensure continuous network visibility to monitor real-time network behavior and make systems transparent. Automated monitoring allows response to potential security breaches in real time.
• Understand potential vulnerabilities. Identify and mitigate vulnerabilities and risks through robust risk assessment and management policies. 
• Develop contingency plans for the worst-case scenarios. The best plans are flexible, capable of addressing everything from breaches to major compromises.

Maintaining digital trust depends on maintaining business continuity during an attack. Advanced threat detection mechanisms, intrusion prevention systems, and SIEM solutions mitigate potential threats.

6. By establishing strong governance 

Set up a robust governance framework to:

• Define security policies and procedures, and fix responsibilities.
• Ensure compliance with HIPAA, GDPR, and other applicable regulations. Compliance is the gold standard for establishing digital trust credentials. 

Enterprises would do well to adopt state-of-the-art platforms such as SUSE to strengthen digital trust. SUSE NeuVector offers detailed visibility of live traffic in a containerized environment. It employs automated behavioral learning to identify “good behavior” and whitelist such behaviors. The tool also identifies suspicious behavior and blocks access to malicious platforms. 

In today’s competitive business environment, businesses add new levers for differentiation. The traditional levers include price and cost. Another lever gaining ground is operational excellence. Digital trust is a key component of operational excellence. Enterprises ignoring digital trust risk becoming obsolete, while those embracing and co-opt it as part of the customer experience will thrive.