cloud security Archives

Imagine a safety deposit box, nestled inside a wall of identical repositories, stretching on for infinity. Inside this safe are all the documents confirming your banking arrangements, bills and your personal identity. The safety deposit box will only unlock with one type of key, copies of which not only reside with your person, but every single member of your family. There are, naturally, rules, explaining how, when and why the material in the safe needs to be accessed – but, of course, there’s no guarantee that your uncle, aunt, or cousin once-removed will adhere to them completely. A similar dilemma is faced by all those businesses with a presence in the cloud. It’s never been more convenient or affordable for companies of all stripes to open an account with a hyperscale provider like Amazon’s AWS and Microsoft’s Azure to host their data and software applications. But as with any online venture, risks abound. Like the dreamer confronted by an endless wall of safety deposit boxes, there is no guarantee that your firm’s key to the cloud might not be stolen, or mislaid by colleagues, or that the architecture of the safe itself isn’t vulnerable to being cracked open by opportunistic thieves. The consequences for businesses of any one of these scenarios happening can run from the mundane to the catastrophic. The personal data of some 530 million users, for example, was exposed in 2019 after Facebook suffered a major cloud security breach. Healthcare organisations, too, have suffered disproportionately from cyberattacks on their cloud holdings, with 61% of respondents in a recent survey saying that they had experienced such an attack in the past year. Then there are the more exotic phenomena, like the suborning of thousands of corporate cloud accounts to mine cryptocurrency – a trend that Canalys CEO Steve Brazier recently pronounced was the “biggest scandal growing in the industry this year”. The pressures on businesses to maintain high levels of cloud security are only set to increase in the coming months, as inflation continues to bite down on profit margins and internal investment. There’s also a more fundamental problem, explains ESET’s global cybersecurity advisor Jake Moore, in how thousands of SMEs perceive their cloud security responsibilities, as opposed to those of hyperscalers. “They’ve got this misconception that… cloud service providers themselves are the ones that are responsible for cloud security,” says Moore. “I just wish more people would think about it and actually understand the risk that goes with it.” An AWS cloud server room. While cloud security among hyperscalers is - despite some occasionally embarrassing faults and vulnerabilities - largely strong, businesses are still failing to take necessary precautions to safeguard their data on their end. (Photo by AMP Tracks/Shutterstock) At the business end of cloud security The aftermath of a cloud security breach can be a nightmare to handle for any business, says Moore - not least because cloud forensics specialists are searching for clues that can’t be examined in stasis. “You can’t go and turn off these clouds, because they might need to continue,” he says. “So, you’re already changing evidence, which in the policing world is never allowed to occur.” After that comes the inevitable process of revising internal security processes. This should begin with revisiting core company attitudes toward cloud security – which, in some of the cases Jim Reavis has witnessed, can be completely off-kilter. “There’s a lot of immaturity” when it comes to ideas among businesses about their level of responsibility for securing their data in the cloud, says Reavis, the president of the Cloud Security Alliance (CSA). “Some of it really comes down to the definition and understanding of what the cloud really is.” There are, after all, multiple ways in which a business depends on the cloud. It might start with infrastructure-as-a-service (IaaS) or software-as-a-service (SaaS) options, wherein cloud servers are utilised to store customer data depending on how much responsibility the company wants to have for running operating systems, for example, or middleware, as opposed to a dedicated service provider. However, access to the business’s cloud holdings may also extend outward to various third-party applications. As such, while your typical hyperscale provider will supply a strong security regime that walls-off threats to your data and services from their end, “it ends up being, maybe, 20% of what a typical organisation needs” to fully secure themselves from attack, says Reavis. Such distinctions, Moore argues, are sometimes lost on some companies that are new to cloud computing, including those who sign up with hyperscale providers. “They tend to win their business by talking about security,” he explains. “Yet, if you look in the fine print, it’s a two-way street.” The importance of this observation was underscored in a recent survey from the CSA, which found that all of the top threats to cloud security were not coming from vulnerabilities among hyperscalers, but leaders within the business, customers and third-party organisations. !function(){"use strict";window.addEventListener("message",(function(e){if(void 0!==e.data["datawrapper-height"]){var t=document.querySelectorAll("iframe");for(var a in e.data["datawrapper-height"])for(var r=0;r

cloud security

Here are all the mistakes your business is making in cloud security

Five Questions with… Polyrize CEO Nati Hazut

Imperva Hacked: Customer API Keys, SSL Certificates Stolen

Netskope enhances Cloud Security capabilities for enterprises

Why cloud computing is key to help implement better security methods

Cisco extends Tetration platform with cloud security

Cloud security fears leave IT decision makers asking, ‘Who has access to my data, and why?’

Cloud-based security market to hit $9bn in 2020

Changelog