The relationship between cloud FinOps and security

The relationship between cloud FinOps and security

The current relationship between cloud FinOps and security can only evolve as fast as FinOps practices grow and develop in an organization. FinOps should be the initial focus of an organization that is just beginning to establish FinOps practices as part of its overall cloud management strategy. This process includes benchmarking KPIs that teams can continuously monitor for cloud consumption, cost efficiency and optimization.

Once FinOps teams develop and distribute reports that satisfy their finance team and business stakeholders, the next step is to iterate alerts and reports to meet the cybersecurity team's needs. For example, the FinOps team should count cybersecurity as an internal stakeholder for sharing data about wasted and overprovisioned cloud services, which can help minimize security risks.

Established FinOps and cybersecurity teams should annually evaluate their working relationship as part of continuous improvement. This collaboration helps ensure that, as practices and tools evolve, the correct FinOps data is available to cybersecurity teams as part of their monitoring, incident response and post-incident forensics.

The FinOps Foundation doesn't mention cybersecurity in its FinOps Maturity Model. But, in all rights, FinOps and cybersecurity collaboration indicates a maturing organization in the model's Run phase. Ideally, moves to establish such collaboration should show themselves in the Walk stage. Teams can write FinOps and cybersecurity collaboration into their cloud management practices and refine them with lessons learned as teams experience joint decision-making, governance, incident response and related activities.

Build the relationship between FinOps and cybersecurity teams

Building a relationship between the FinOps and cybersecurity teams should start early when an organization chooses a FinOps tool. A FinOps team can better forecast expenses, plan budget allocation and avoid unnecessary costs by understanding security requirements and constraints. These forecasts result in a more cost-effective and financially efficient cloud operation, so plan for some level of cross-training between the teams.

The next step is to create communications and collaboration channels to support continuous team feedback. This step could be as simple as a reporting view in a cloud management platform or a cloud cost optimization initiative that's augmented with a group chat channel. Regular meetings shouldn't be a default option for collaboration unless corporate culture or processes demand it. Instead, prioritize open communications between the teams.

The most valuable step is integrating the FinOps tools with the cybersecurity team's security information and event management system to correlate cost data and security events, providing a comprehensive view of the cloud environment.

FinOps as a security and compliance differentiator

This relationship guides organizations to a fiscally sound and secure cloud enterprise. The more an organization understands its cloud spending patterns, the more it can allocate staffing and tools to cloud security.

The budget controls and alerts that FinOps tools provide can help better align cloud spending practices with compliance because organizations have a more holistic view of their cloud environments. These best practices can improve the organization's overall security posture and financial accountability.

FinOps tools generate financial documentation, which can be valuable during compliance audits. Such reports can be integral to demonstrating financial controls and compliance with regulatory requirements.

Data breaches

FinOps tools and practices can add another layer of security against data breaches. Consider the following examples:

• FinOps tools provide detailed insights into cloud cost management, especially unexpected spikes in spending, which are potentially indicative of a data breach.
• The cybersecurity team can use the same resource tags a FinOps team implements to track department or project spending to monitor and control access to sensitive corporate resources.
• Budget alerts from a FinOps tool take on a new meaning when FinOps and security collaborate because these alerts might signal a data breach.
• By integrating security policies with financial controls, teams can ensure that only approved resources and configurations are in use, reducing the risk of misconfigurations that might lead to vulnerabilities and data breaches.
• Cloud FinOps tools often provide insights into user activity and resource utilization, which is invaluable for security teams in monitoring for any unusual or unauthorized activities that might indicate a security threat.

Fraud and identity issues

A FinOps team might detect signs of fraud and identity issues via their FinOps reporting, such as the following:

• Attackers with unauthorized access to cloud accounts can manipulate financial settings and launch unauthorized services without the knowledge of the account owner. Mature FinOps practices can help indicate when such anomalies appear in reporting.
• Identity theft enables attackers to impersonate a legitimate user, such as a CFO, or an entity, such as the FinOps team. This impersonation enables an attacker to make unauthorized changes to cloud resources.
• Policy enforcement from FinOps tools and practices can defend against the unauthorized resource provisioning of VMs and storage by malicious attackers, which leads to unexpected costs for an organization. This enforcement can also help guard against bill skimming attacks where a malicious attacker manipulates cloud billing information, such as diverting changes to different accounts or reducing the visibility of certain cloud costs through billing manipulation.

Such attacks show the need to continuously improve an organization's monitoring and logging of activities across the cloud environment to detect and respond to fraudulent activities.

Misconfiguration

The misconfiguration of cloud services is a leading predictor of cloud cost overruns and potential cloud security issues. Because a FinOps tool supports collaboration between finance and DevOps teams, it's ideal for addressing misconfiguration issues.

Certain FinOps data is essential to mitigating misconfigurations, such as the following:

• Showback and chargeback data can help pinpoint which teams or projects have misconfigurations in their cloud services.
• Cost visualization and reporting are crucial to identifying anomalies that signal potential misconfigurations.
• Budget alerts set to spending thresholds alert about potential misconfigurations in cloud services.

Will Kelly is a technology writer, content strategist and marketer. He has written extensively about the cloud, DevOps and enterprise mobility for industry publications and corporate clients and worked on teams introducing DevOps and cloud computing into commercial and public sector enterprises.