Cybersecurity Essentials For Cloud Environments

As of 2022, over 60% of all corporate data is stored in the cloud. This is up from just 30% in 2015, according to Statista. While cloud migration is being embraced by organizations the world over, many companies are struggling when it comes to cloud security, both during transition time and throughout their entire cloud journey.

In this article, we’ll delve into some of the common challenges and look at what makes a robust cloud security strategy.  

What Do We Mean By Cloud Security?

The natural starting point here is to evaluate how cloud security differs from that of a traditional, on-premise system. This largely comes down to what we call the shared responsibility model. If all of your business assets are on-premise, you are accountable for the physical security of the building they are in, maintaining the health of the servers as well as the performance and security of the infrastructure.

However, with the cloud it’s broken down into two parts - the security of the cloud and the security in the cloud.

The cloud service provider, like AWS or Azure, is responsible for the former, so all you need to worry about is the security of your resources within the cloud. There are cloud provider tools and utilities to help you manage that.

Common Cloud Security Challenges

One of the most important things to watch out for in cloud security is misconfiguration. Companies have had decades of experience managing infrastructure on-premise, so they have had time to really understand all of the ins and outs. However, the cloud is still relatively new, so people are still grappling with the complexities and sheer number of configuration options.  

Identity and access management (IAM) is an example of an area that is commonly misconfigured. This is mainly because of simple things not being accounted for, like not having multi-factor authentication enabled, misapplication of permissions, or being overly permissive.

This comes down to the key cloud principle of least privilege. There aren’t many companies where one individual requires access to the whole network, but businesses still frequently give individuals network-wide permissions. In the event of a compromise, you would want the attacker to have the lowest possible level of access.

It’s important to ensure that authorised employees/users only have access to what is required to perform their roles. 

There are also smaller misconfigurations that happen often, such as having unsecured S3 buckets (a type of file server). On their own, these may not be critical, but small issues like this can still evolve into bigger ones. For example, a lack of encryption on the S3 bucket can lead to sensitive data being made available in a publicly accessible realm.

Key Considerations When Moving To The Cloud 

Migration is key - it’s make or break: Migration periods are still one of the highest risk points in time for an organization, especially when the migration is so big that companies spend a significant amount of time in a hybrid setup (both on-premise and cloud). It’s a misconception with hybrid environments that if everything is well segregated, there’s no route between on-premise and the cloud. In a lot of cases they are in fact closely intertwined and attackers can find their way between the two. It’s therefore important to treat them as one environment. 

Secure configuration: It’s essential to exercise due diligence when placing anything in the cloud. Frequently, companies will test and deploy quickly without taking the time to ensure that the content is secure. Before long, they will find that it has been compromised. 

Governance structures: You need to understand the right governance structure for your organization in order to manage things effectively. Fortunately, whether it’s ISO 27001 or CSF, these are baked into the cloud service providers themselves. 

Good architecture: This is just as important as in an on-premise environment. If you are considering moving to the cloud, sit down with a cloud architect or engineer and get your architecture right from the start. Otherwise, it can be really difficult to unpick and rebuild later on when there are interdependencies between software and services. 

The Importance Of Team Buy-In

Let’s say you are part-way through moving to the cloud and you have three teams that have each started to use a different cloud provider. You want to define a company-wide strategy, but how do you bring those pieces of the jigsaw together? First of all, make sure you get buy-in from your teams. Consult with them on what they’re trying to achieve and why they’re using the providers they are.

It’s no good just coming along and enforcing a policy if it makes their jobs more difficult - quite frankly, they just won’t comply with it. 

Often, businesses assume that everything is secure because monitoring tool like Cloudtrail or Cloudwatch are enabled. While that will tell you what’s happening to resources (i.e. who is modifying or changing them), it won’t give insights into what’s happening within those resources. For that you will need a separate solution that will increase visibility and keep your cloud services secure. 

Hugh Raynor is Senior Cybersecurity Consultant at SureCloud 

You Might Also Read: 

Cloud Computing & Security: What Enterprises Should Know:

 

« Github Supply Chain Attack
AI Driven Anomaly Detection In The Oil & Gas Industry »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

ON-DEMAND WEBINAR: What Is A Next-Generation Firewall (and why does it matter)?

ON-DEMAND WEBINAR: What Is A Next-Generation Firewall (and why does it matter)?

Watch this webinar to hear security experts from Amazon Web Services (AWS) and SANS break down the myths and realities of what an NGFW is, how to use one, and what it can do for your security posture.

Alvacomm

Alvacomm

Alvacomm offers holistic VIP cybersecurity services, providing comprehensive protection against cyber threats. Our solutions include risk assessment, threat detection, incident response.

Perimeter 81 / How to Select the Right ZTNA Solution

Perimeter 81 / How to Select the Right ZTNA Solution

Gartner insights into How to Select the Right ZTNA offering. Download this FREE report for a limited time only.

BackupVault

BackupVault

BackupVault is a leading provider of automatic cloud backup and critical data protection against ransomware, insider attacks and hackers for businesses and organisations worldwide.

NordLayer

NordLayer

NordLayer is an adaptive network access security solution for modern businesses — from the world’s most trusted cybersecurity brand, Nord Security. 

SonicWall

SonicWall

SonicWall provide products for network security, access security, email security & encryption.

IT Governance

IT Governance

IT Governance is a leading global provider of information security solutions. Download our free guide and find out how ISO 27001 can help protect your organisation's information.

Smart Protection

Smart Protection

Smart Protection are experts in brand and trademark protection - we fight against counterfeits and unauthorized usages of brands with machine learning technology.

INVISUS

INVISUS

INVISUS protects businesses against the latest cyber risks – including business and employee identity theft, data breaches, and cybersecurity compliance.

Cyber Range Solutions (CRS)

Cyber Range Solutions (CRS)

CRS provides cyber security training and improve security team performance by providing a hyper realistic, virtual training environment.

SecureTech360

SecureTech360

SecureTech360 is a cybersecurity and IT consulting firm whose principals have extensive experience in Cybersecurity and Information Technology.

QuantiCor Security

QuantiCor Security

QuantiCor Security is one of the world’s leading developers and manufacturers of quantum computer resistant security solutions for IT infrastructures and the Internet of Things (IoT).

Comparitech

Comparitech

Comparitech strives to promote cyber security and privacy for all. We are committed to providing detailed information to help our readers become more cyber secure and cyber aware.

Cyberi

Cyberi

Cyberi provide specialist technical consultancy and cyber advisory services, from penetration testing and assurance to incident management and response, and technical security research.

Mailinblack

Mailinblack

Mailinblack protects your organisation against email threats with an innovative solution that meets your security requirements.

Datapac

Datapac

Datapac is one of Ireland’s largest and most successful ICT solutions and services providers. We have been at the forefront of technology innovation in Ireland for the past three decades.

Keytos

Keytos

Keytos has revolutionized the Identity Management and PKI industry by creating cryptographic tools that allow you to go password-less by making security transparent to the user.

Zafran

Zafran

Zafran is a Risk & Mitigation Platform that defuses threat exploitation by mobilizing existing security tools.

Viatel Technology Group

Viatel Technology Group

Viatel Technology Group is a complete digital services provider. We have over 26 years’ experience delivering fully managed security, networking, cloud and communications services.

Scalarr

Scalarr

Scalarr is an innovative, next-generation cyber security firm focused on automation and AI to detect and prevent threats in mobile and Edge/IoT infrastructures.

Strategic Security Solutions (S3)

Strategic Security Solutions (S3)

S3 is a leading provider of Cybersecurity consulting services for Identity and Access Governance (IAG), Zero Trust, and Enterprise Risk and Compliance.