* [Topics](/en/topics "Topics") * [Security](/en/topics/security "Security") * What is hybrid cloud security? What is hybrid cloud security? ============================== Published February 5, 2019•*5*-minute read Copy URL Jump to section --------------- OverviewChallengesComponentsPhysical controlsTechnical controlsAdministrative controlsIT Security takes time Overview -------- Hybrid cloud security is the protection of the data, applications, and infrastructure associated with an IT architecture that incorporates some degree of workload portability, orchestration, and management across multiple IT environments, including at least 1 cloud—[public](/en/topics/cloud-computing/what-is-public-cloud) or [private](/en/topics/cloud-computing/what-is-private-cloud). Hybrid clouds offer the opportunity to reduce the potential exposure of your data. You can keep sensitive or critical data off the public cloud while still taking advantage of the cloud for data that doesn’t have the same kinds of risk associated with it. [E-book: Boost hybrid cloud security](/en/resources/hybrid-cloud-security-ebook) ### Why choose hybrid cloud for enhanced security? Hybrid clouds let enterprises choose where to place workloads and data based on compliance, audit, policy, or security requirements. While the various environments that make up a [hybrid cloud](/en/topics/cloud-computing/what-is-hybrid-cloud) remain unique and separate entities, migrating between them is facilitated by [containers](/en/topics/containers-v1-old) or encrypted [application programming interfaces (APIs)](/en/topics/security/api-security) that help transmit resources and workloads. This separate—yet connected—architecture is what allows enterprises to run critical workloads in the private cloud and less sensitive workloads in the public cloud. It’s an arrangement that minimizes data exposure and allows enterprises to customize a flexible IT portfolio. [Start your hybrid cloud security assessment](/en/engage/hybrid-cloud-security-assessment "Five-minute hybrid cloud security preparedness assessment") What are some hybrid cloud security challenges? ----------------------------------------------- ### Protecting your data Limit data exposure for your organization through encryption. The same data will be either in transit or at rest at different moments in time. You need a variety of security to limit data exposure during either of these states. ### Compliance and governance If you work in a highly regulated sector like healthcare, finances, or government, hybrid cloud infrastructure may present additional considerations. Know how to check your distributed environments to make sure that they are compliant; how to implement custom or regulatory security baselines; and how to prepare for security audits. ### Security in the supply chain Hybrid cloud environments often include products and software from multiple vendors in a complicated ecosystem. Know how your vendors test and manage their software and products.  Understand when and how your vendors have inspected source code, how and which implementation guidelines they follow, and how and when vendors can provide updates and patches. Red Hat resources ----------------- [Keep reading](/en/resources "Keep reading") The components of hybrid cloud security --------------------------------------- Hybrid cloud security, like computer security in general, consists of three components: physical, technical, and administrative. Physical controls are for securing your actual hardware. Examples include locks, guards, and security cameras. Technical controls are protections designed into IT systems themselves, such as encryption, network authentication, and management software. Many of the strongest security tools for hybrid cloud are technical controls. Finally, administrative controls are programs to help people act in ways that enhance security, such as training and disaster planning. [Checklist: 6 security benefits of cloud computing environments](/en/resources/developers-guide-to-supply-chain-security-ebook "Cloud security checklist") Physical controls for hybrid cloud security ------------------------------------------- Hybrid clouds can span multiple locations, which makes physical security a special challenge. You can’t build a perimeter around all your machines and lock the door. In the case of shared resources like a public cloud, you may have Service Level Agreements (SLAs) with your cloud provider that define which physical security standards will be met. For example, some public cloud providers have arrangements with government clients to restrict which personnel have access to the physical hardware. But even with good SLAs, you’re giving up some level of control when you’re relying on a public cloud provider. This means other security controls become even more important. Technical controls for hybrid cloud security -------------------------------------------- ![hybrid management diagram](/rhdc/managed-files/diagram-hybrid-mgmt-400x404.png "Hybrid management") Technical controls are the heart of hybrid cloud security. The centralized management of a hybrid cloud makes technical controls easier to implement. Some of the most powerful technical controls in your hybrid cloud toolbox are encryption, automation, orchestration, access control, and endpoint security. ### Encryption Encryption greatly reduces the risk that any readable data would be exposed even if a physical machine is compromised. You can encrypt data at rest and data in motion. Here’s how: #### Protect your data at rest: * Full disk (partition encryption) protects your data while your computer is off. Try the [Linux Unified Key Setup-on-disk (LUSK)](https://en.wikipedia.org/wiki/Linux_Unified_Key_Setup) format which can encrypt your hard drive partitions in bulk. * Hardware encryption that will protect the hard drive from unauthorized access. Try the [Trusted Platform Module (TPM)](https://en.wikipedia.org/wiki/Trusted_Platform_Module), which is a hardware chip that stores cryptographic keys. When the TPM is enabled, the hard drive is locked until the user is able to authenticate their login. * Encrypt root volumes without manually entering your passwords. If you have built a highly [automated cloud](/en/topics/automation/what-is-cloud-automation) environment, build upon that work with automated encryption. If you are using [Linux](/en/topics/linux), try the Network Bound Disk Encryption (NBDE), which works on both physical and virtual machines. Bonus: make TPM part of the NBDE and provide two layers of security (the NMDE will help protect networked environments, while the TPM will work on premises). #### Protect your data in motion: * Encrypt your network session. Data in motion is at a much higher risk of interception and alteration. Try the [Internet Protocol Security (IPsec)](https://en.wikipedia.org/wiki/IPsec) which is an extension of the Internet Protocol that uses cryptography. * Select products that already implement security standards.  Look for products that support the [Federal Information Processing Standard (FIPS) Publication 140-2](https://en.wikipedia.org/wiki/FIPS_140-2) which uses cryptographic modules to protect high-risk data. ### Automation To appreciate why automation is a natural fit for hybrid clouds, consider the drawbacks of manual monitoring and patching. Manual monitoring for security and compliance often has more risks than rewards. Manual patches and configuration management risk being implemented asynchronously. It also makes implementing self-service systems more difficult. If there is a security breach, records of manual patches and configurations risk being lost and can lead to team in-fighting and finger-pointing. Additionally, manual processes tend to be more error prone and take more time. Automation, by contrast, allows you to stay ahead of risks, rather than react to them. [Automation](/en/topics/automation) gives you the ability to set rules, share, and verify processes which ultimately make it easier to pass security audits. As you evaluate your hybrid cloud environments, think about automating the following processes: * Monitoring your environments * [Managing your data](/en/topics/data-services/what-is-data-management) * Checking for compliance * Implementing patches * Implementing custom or regulatory security baselines ### Orchestration Cloud orchestration goes a step further. You can think of automation as defining specific ingredients, and orchestration as a cookbook of recipes that bring the ingredients together. Orchestration makes it possible to manage cloud resources and their software components as a single unit, and then deploy them in an automated, repeatable way through a template. Orchestration’s biggest boon to security is standardization. You can deliver the flexibility of the cloud while still making sure the systems deployed meet your standards for security and compliance. ### Access control Hybrid clouds also depend on access control. Restrict user accounts to only the privileges they need and consider requiring two-factor authentication. Limiting access to users connected to a Virtual Private Network (VPN) can also help you maintain security standards. ### Endpoint security Endpoint security often means using software to remotely revoke access or wipe sensitive data if a user’s smartphone, tablet, or computer gets lost, stolen, or hacked. Users can connect to a hybrid cloud with personal devices from anywhere, making endpoint security an essential control. Adversaries may target your systems with phishing attacks on individual users and [malware](/en/topics/security/what-is-malware) that compromises individual devices. We’re listing it here as a technical control, but endpoint security combines physical, technical and administrative controls: Keep physical devices secure, use technical controls to limit the risks if a device falls into the wrong hands, and train users in good security practices. Administrative controls for hybrid cloud security ------------------------------------------------- Lastly, administrative controls in hybrid cloud security are implemented to account for human factors. Because hybrid cloud environments are highly connected, security is every user’s responsibility. Disaster preparedness and recovery are an example of an administrative control. If part of your hybrid cloud is knocked offline, who’s responsible for what actions? Do you have protocols in place for data recovery? Hybrid architecture offers significant advantages for administrative security. With your resources potentially distributed among on-site and off-site hardware, you have options for backups and redundancies. In hybrid clouds that involve public and private clouds, you can fail over to the public cloud if a system on your private data center cloud fails. [What are SPIFFE and SPIRE?](/en/topics/security/spiffe-and-spire) IT security doesn’t happen all at once -------------------------------------- [IT security](/en/topics/security) takes time and needs iteration. The security landscape is always changing. Instead of putting pressure on yourself to get to a state of perfect security (which does not exist), focus on placing one foot in front of the other and taking reasonable, well-thought-out actions to make you more secure today than you were yesterday. [E-book: Manage security and compliance risk on open source Linux](/en/engage/manage-security-compliance-s-202010120658) Recommended for you E-book The state of Kubernetes security report: 2024 edition ----------------------------------------------------- Read about new, emerging trends in container, Kubernetes, and cloud-native security in this latest edition of the State of Kubernetes security report. [Read the e-book](https://www.redhat.com/en/engage/state-kubernetes-security-report-2024?percmp=RHCTG0250000455234) All Red Hat product trials -------------------------- Our no-cost product trials help you gain hands-on experience, prepare for a certification, or assess if a product is right for your organization. [Keep reading](/en/products/trials "All Red Hat product trials") Keep reading ------------ ### What are SPIFFE and SPIRE? SPIFFE and SPIRE are a pair of open source projects for identity management in dynamic and varied computing environments. Together they solve many security problems. [Read the article](/en/topics/security/spiffe-and-spire "article | what are spiffe and spire?") ### Red Hat Enterprise Linux security Red Hat Enterprise Linux is a world’s leading open source Linux platform, enabling you to mitigate risk, enforce security configuration and policy, and streamline compliance strategy. [Read the article](/en/technologies/linux-platforms/enterprise-linux/security "product article | Red Hat Enterprise Linux security") ### What is zero trust? Find out more about zero trust, an approach to designing security architectures based on the premise that every interaction begins in an untrusted state. [Read the article](/en/topics/security/what-is-zero-trust "article | what is zero trust?") Security resources ------------------ ### Related content * Overview [Red Hat Enterprise Linux: An ideal operating system for cloud](/en/resources/ideal-operating-system-brief) * Detail [Advance your security maturity with Red Hat OpenShift](/en/resources/advance-security-maturity-openshift-detail) * Blog post [Your Red Hat OpenShift AI models are waiting at the door. Who’s knocking?](/en/blog/your-red-hat-openshift-ai-models-are-waiting-door-whos-knocking) * Datasheet [Red Hat Technical Account Management services for product security](/en/resources/tam-services-product-security-datasheet) ### Related articles * [What are SPIFFE and SPIRE?](/en/topics/security/spiffe-and-spire) * [Red Hat Enterprise Linux security](/en/technologies/linux-platforms/enterprise-linux/security) * [What is zero trust?](/en/topics/security/what-is-zero-trust) * [What is AI security?](/en/topics/ai/what-is-ai-security) * [What is cloud migration? And how can automation help?](/en/topics/automation/what-is-cloud-migration) * [Why run Linux on AWS?](/en/topics/linux/linux-on-aws) * [What is hybrid cloud?](/en/topics/cloud-computing/what-is-hybrid-cloud) * [Functional safety and continuous certification on Linux](/en/topics/open-source/functional-safety-and-continuous-certification-on-linux) * [What is serverless?](/en/topics/cloud-native-apps/what-is-serverless) * [What is access control?](/en/topics/security/what-is-access-control) * [Why choose Red Hat Enterprise Linux on Azure?](/en/technologies/linux-platforms/enterprise-linux/why-choose-red-hat-enterprise-linux-on-azure) * [What's the difference between cloud and virtualization?](/en/topics/cloud-computing/cloud-vs-virtualization) * [Why choose Red Hat Enterprise Linux on AWS?](/en/technologies/linux-platforms/enterprise-linux/why-choose-red-hat-enterprise-linux-on-aws) * [What is a CVE?](/en/topics/security/what-is-cve) * [What is CloudOps?](/en/topics/automation/what-is-cloudops) * [Linux on Azure](/en/topics/linux/linux-on-azure) * [Linux for cloud computing](/en/topics/linux/linux-for-cloud-computing) * [Why run Linux on Google Cloud?](/en/topics/linux/linux-on-google-cloud) * [What is secrets management?](/en/topics/devops/what-is-secrets-management) * [What is role-based access control (RBAC)?](/en/topics/security/what-is-role-based-access-control) * [What is kubernetes security?](/en/topics/containers/kubernetes-security) * [Shift left vs. shift right](/en/topics/devops/shift-left-vs-shift-right) * [Why choose Red Hat Enterprise Linux on Google Cloud?](/en/technologies/linux-platforms/enterprise-linux/why-choose-red-hat-enterprise-linux-google-cloud) * [Why are financial services slow to adopt the cloud?](/en/topics/financial-services/why-financial-services-are-slow-to-adopt-cloud) * [Red Hat Insights data and application security](/en/technologies/management/insights/data-application-security) * [What is CI/CD security?](/en/topics/security/what-is-cicd-security) * [What is an intrusion detection and prevention system (IDPS)?](/en/topics/security/what-is-an-IDPS) * [What is security information and event management (SIEM)?](/en/topics/security/what-is-SIEM) * [The increasing importance of cybersecurity in banking](/en/topics/financial-services/increasing-importance-cybersecurity-banking) * [Gain security with Red Hat Ansible Automation Platform](/en/technologies/management/ansible/gain-security-with-red-hat-ansible-automation-platform) * [What is edge security?](/en/topics/security/what-is-edge-security) * [What is Cloud Foundry?](/en/topics/application-modernization/what-is-cloud-foundry) * [What is the importance of operational resilience?](/en/topics/financial-services/what-is-operational-resilience) * [What is vulnerability management?](/en/topics/security/what-is-vulnerability-management) * [What is backup and recovery?](/en/topics/security/backup-and-recovery) * [What is the role of the cloud in embedded finance?](/en/topics/financial-services/the-role-of-cloud-in-embedded-finance) * [OpenShift vs. OpenStack: What are the differences?](/en/technologies/cloud-computing/openshift/openshift-vs-openstack) * [What is container security?](/en/topics/security/container-security) * [Cloud services for financial services](/en/topics/financial-services/cloud-services-for-financial-services) * [Kubernetes vs OpenStack](/en/topics/openstack/kubernetes-vs-openstack) * [What is DevSecOps?](/en/topics/devops/what-is-devsecops) * [What is compliance management?](/en/topics/management/what-is-compliance-management) * [What is telco cloud?](/en/topics/cloud-computing/what-is-telco-cloud) * [Why choose Red Hat for DevSecOps](/en/topics/devops/why-choose-red-hat-for-devsecops) * [What is cloud orchestration?](/en/topics/automation/what-is-cloud-orchestration) * [What is security automation?](/en/topics/automation/what-is-security-automation) * [What is cloud governance?](/en/topics/automation/what-is-cloud-governance) * [What is public cloud?](/en/topics/cloud-computing/what-is-public-cloud) * [What is software supply chain security?](/en/topics/security/what-is-software-supply-chain-security) * [Cloud vs. edge](/en/topics/cloud-computing/cloud-vs-edge) * [Why build a Red Hat cloud?](/en/topics/cloud-computing/why-choose-red-hat-cloud) * [What is multicloud?](/en/topics/cloud-computing/what-is-multicloud) * [Security in the software development lifecycle](/en/topics/security/software-development-lifecycle-security) * [What is cloud architecture?](/en/topics/cloud-computing/what-is-cloud-architecture) * [What is cloud automation?](/en/topics/automation/what-is-cloud-automation) * [Types of cloud computing](/en/topics/cloud-computing/public-cloud-vs-private-cloud-and-hybrid-cloud) * [Kubernetes security best practices](/en/topics/containers/kubernetes-security-best-practices) * [What is lightweight directory access protocol (LDAP) authentication?](/en/topics/security/what-is-ldap-authentication) * [How Red Hat OpenShift enables container security](/en/technologies/cloud-computing/openshift/security) * [What is SOAR?](/en/topics/security/what-is-soar) * [What's an insider threat?](/en/topics/security/what-are-insider-threats) * [Security for IoT devices](/en/topics/security/security-for-iot-devices) * [What is identity and access management (IAM)?](/en/topics/security/what-identity-and-access-management-iam) * [What is cloud-based digital banking?](/en/topics/cloud-computing/what-is-cloud-based-digital-banking) * [Advantages of Kubernetes-native security](/en/topics/containers/advantages-of-kubernetes-native-security) * [Intro to Kubernetes security](/en/topics/containers/intro-kubernetes-security) * [Container and Kubernetes compliance considerations](/en/topics/containers/compliance) * [Do banking APIs benefit from cloud technology?](/en/topics/api/banking-api) * [What is payments infrastructure?](/en/topics/financial-services/what-is-payments-infrastructure) * [What is multitenancy?](/en/topics/cloud-computing/what-is-multitenancy) * [What is private cloud?](/en/topics/cloud-computing/what-is-private-cloud) * [What is risk management?](/en/topics/management/what-is-risk-management) * [What is SELinux?](/en/topics/linux/what-is-selinux) * [What is IT infrastructure?](/en/topics/cloud-computing/what-is-it-infrastructure) * [What is cloud infrastructure?](/en/topics/cloud-computing/what-is-cloud-infrastructure) * [What is API security?](/en/topics/security/api-security) * [What is financial services security (and compliance)?](/en/topics/security/security-and-compliance-financial-services) * [What is malware?](/en/topics/security/what-is-malware) * [What is cloud storage?](/en/topics/data-storage/what-is-cloud-storage) * [What is cloud security](/en/topics/security/cloud-security) * [What is cloud management?](/en/topics/cloud-computing/what-is-cloud-management) [More about this topic](/en/topics/security "More about this topic")