The Risks & Benefits Of Cloud Security

Cloud computing  has become a widely used term part of  daily conversations, usually  about moving photos and other data into the cloud. Indeed, Cloud computing is now over 30 years old but is still considered a new technology for many organisations and involves relying on  a cloud service provider (CSP), to store and process your vital data, which requires trust and a willingness to give up control.

Cloud users can reduce costs and increase efficiencies through storage and management of large amounts of data and systems and with the cloud they are apparently cheaper to maintain and they are secure. 

Given the growing rush by organisations to move to the cloud, it’s no surprise that some policymakers are calling for regulation of this disruptive technology. 

A Report published by the Carnegie Endowment aims to give lawmakers and regulators a basic understanding of what’s happening in the cloud arena, with a particular focus on the security of these vast reservoirs of information. Cloud Security: A Primer for Policymakers argues that the “debate about cloud security remains vague and the public policy implications [are] poorly understood.”

From a public policy perspective, “the image of a cloud obscures as much as it explains,” the report states. “A more nuanced picture emerges when the cloud is considered in terms of its layers, from the physical data centers and network cabling that form its foundation to the virtual software environments and applications that everyday users interact with.”

However, as the paper says, cloud services ares concentrated in the hands of a few providers including AWS, Microsoft Azure, and Google Cloud, so-called “hyper scale” cloud service providers, with firms like Alibaba Cloud and Tencent playing a similar role in China. “The rising cost of cyber-attacks means that most companies can’t effectively defend themselves, leaving organisations “better off entrusting their security to these external firms’ security teams.” However, that solution raises a new problem which is “the systemic risk associated with a centralised approach.”

The Report says there are two key policy concerns that have to be balanced.

  • The first one is the current and known problem of cyber insecurity," Maurer says. "Most organisations still struggle to effectively protect themselves against hackers.”
  • The second concern is the systemic risk cloud providers pose, namely that allowing so much data to be stored in the hands of giants could invite rare but catastrophic events.

The report quotes a study carried out by insurance market Lloyds of London that estimates a three to six-day outage of a major cloud service provider could cause economic losses. Moreover, cloud services could become an excellent target for attackers because of the amount of commercial data they contain.

Looking ahead, cloud security would benefit from a collaborative approach among the giant providers,given that the breakneck competition among them stands in the way of protecting against threats that affect all of them. 

Although some critics of a collaborative cloud security initiative might raise antitrust concerns, there are models of similar approaches in other industries, including finance and aviation. “If you look at other highly competitive industries like the financial industry, like the aviation industry, they have all formed specific industry consortia that are designed to help address security because they recognise the risks in the entire industry and not just individual companies.” notes the Report.

“It will be much more important in the future for the major cloud service providers to come together to share and compare notes…and to also potentially share data about threat actors that may be targeting them...That is likely to pay off more in the future than a regulatory framework would, which is down the road.”

Due diligence requires that cloud consumers fully understand the security implications of deploying or moving applications and systems to a CSP. Consumers must understand how CSP services should be used to support business activities while protecting information.

Carnegie Endowment:      CSO Online:     Carnegie Mellon University:     ARN.net:

You Might Also Read: 
 
Six Reasons To Move Your SIEM To The Cloud:

 

« New Zealand's NZX Stock Market Hit Five Times
Cyber Attacks On Norway’s Parliament »

Infosecurity Europe
CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

CYRIN

CYRIN

CYRIN® Cyber Range. Real Tools, Real Attacks, Real Scenarios. See why leading educational institutions and companies in the U.S. have begun to adopt the CYRIN® system.

North Infosec Testing (North IT)

North Infosec Testing (North IT)

North IT (North Infosec Testing) are an award-winning provider of web, software, and application penetration testing.

Alvacomm

Alvacomm

Alvacomm offers holistic VIP cybersecurity services, providing comprehensive protection against cyber threats. Our solutions include risk assessment, threat detection, incident response.

Resecurity

Resecurity

Resecurity is a cybersecurity company that delivers a unified platform for endpoint protection, risk management, and cyber threat intelligence.

XYPRO Technology

XYPRO Technology

XYPRO is the market leader in HPE Non-Stop Security, Risk Management and Compliance.

National Cyber Security Centre (CNCS) - Portugal

National Cyber Security Centre (CNCS) - Portugal

CNCS is the operational coordinator and Portuguese national authority in cybersecurity working with State entities, and digital service providers

MonsterCloud

MonsterCloud

MonsterCloud is a leader in managed cyber security services. Our cyber security team constantly monitors and protects businesses from cyber threats.

LSEC

LSEC

LSEC is a global innovator and facilitator for the Cybersecurity industry. It is a non-profit membership organisation supporting further maturing the industry through its end users.

Invensity

Invensity

INVENSITY is an interdisciplinary technology and innovation consulting company. Centres of excellence include Cyber Security and Data Privacy.

Cytomic

Cytomic

Cytomic is the business unit of Panda Security specialized in providing advanced cybersecurity solutions and services to large enterprises.

Bradley-Morris

Bradley-Morris

Bradley-Morris is a leading recruiting firm specializing in transitioning military and veteran talent into civilian careers including Cybersecurity.

MONITORAPP

MONITORAPP

MONITORAPP is responsible for complete web security. Protect your business environment with Application Security Solutions from MONTORAPP.

Netsurion

Netsurion

Netsurion powers secure and agile networks for highly distributed and small-to-medium enterprises and the IT providers that serve them.

e-Careers

e-Careers

e-Careers is an edtech institution that provides industry recognised courses and up-skilling solutions to individuals and organisations.

LTIMindtree

LTIMindtree

LTIMindtree is a new kind of technology consulting firm. We help businesses transform – from core to experience – to thrive in the marketplace of the future.

Futurae Technologies

Futurae Technologies

Futurae - enabling trust and invisible security for your users on all devices and applications. Strong customer authentication (SCA) made easy.

Seemplicity

Seemplicity

Seemplicity revolutionizes the way security teams work by automating, optimizing and scaling all risk reduction workflows in one workspace.

AccountabilIT

AccountabilIT

AccountabilIT is a full spectrum information technology services firm for enterprises with complex information technology needs seeking relief from those challenges.

SquareX

SquareX

Squarex secures your online activities without compromising productivity.

Sphinx

Sphinx

Sphinx provide advanced security consulting services and cyber solutions to federal and private industry.

Norwegian Data Protection Authority (Datatilsynet)

Norwegian Data Protection Authority (Datatilsynet)

The Norwegian Data Protection Authority (Datatilsynet) is the national data protection authority for Norway.