Navigating the Cloud Landscape: Significant Advantages Meet Serious Challenges

Navigating the Cloud Landscape: Significant Advantages Meet Serious Challenges | Featured on ZDNet

Image: Getty Images/Maskot

Shifting applications and infrastructure over to cloud computing services can make life easier in some ways, it doesn’t automatically mean you can give up all responsibility for keeping your organisations’s data secure.

Special Feature

Securing the Cloud Cloud computing is now a business essential, but keeping your data and applications secure is vital. Find out more about cloud security in this ZDNet special report. Read now

Cloud computing continues to grow at a fantastic rate, even though it’s been around for quite some time; the most recent data from tech analyst Gartner shows that the infrastructure as a service market grew more than 40% just last year and it noted that ‘cloud-native becomes the primary architecture for modern workloads .”

Then it’s perhaps no surprise that cloud security is the fastest growing segment of the security market , with spending jumping from $595 million in the US in 2020 to $841 million last year, largely because companies are discovering that it’s a more complicated topic than they realised.

Most businesses use multiple cloud services and cloud providers, a hybrid approach that can support granular security options where vital data is kept close (perhaps in a private cloud) while less sensitive applications run in a public cloud to take advantage of big tech’s economies of scale.

But the hybrid model also introduces new complications, as every provider will have a slightly different set of security models that cloud customers will need to understand and manage.

That takes time and (often elusive) expertise across multiple cloud vendors systems. And it’s also a dynamic environment; applications and data are often switched between on- and off-premise and between cloud services, all of which are opportunities for errors and data leaks.

All of this can extend the enterprise threat surface , while making it harder for organisations to ensure their assets are secured. As a result, misconfigured services are high on the list of root causes for security incidents - along with even more basic failures like poor passwords and identity controls.

ZDNET SPECIAL FEATURE: SECURING THE CLOUD

According to one recent piece of research half of companies had experienced some kind of cloud security breach in the last 12 months, while almost one in three had been forced to issue a breach notification to a government agency, customer, partner or employees according to the research by Thales.

Little surprise that companies are evaluating tools to automate much of this.

That’s leading to interest in new technologies such as Cloud Security Posture Management (CSPM) tools, which can help security teams spot and fix potential security issues around misconfiguration and compliance in the cloud, so they know the same rules are being enforced across their cloud services.

Another area of growth has been Cloud Access Security Brokers (CASBs) , which also aim to guarantee that an enterprise’s security policies are being enforced across its portfolio of services. Other security technologies that cloud users are interested in, according to industry research, include zero trust and artificial intelligence , and machine learning. However, many technologies that hold out the promise of improving cloud security are still at an early stage.

None of this is to say that the cloud is inherently less secure. Indeed, because cloud vendors have the scale to invest in skills and capabilities that are beyond the reach of most customers, cloud services and applications are likely to be more secure than those hosted by companies for whom tech is far from their core competency.

But as well as looking at technical innovations it’s also worth scrutinising the levels of service and understanding offered by cloud service providers in the first place. The UK’s National Cyber Security Centre (NCSC) has a good set of general principles for cloud computing security that’s worth considering, which can help you judge the security posture of a supplier. There are 14 principles in total, including:

Your data should be protected against tampering and eavesdropping as it transits networks inside and external to the cloud.
A malicious or compromised customer of the service should not be able to access or affect the service or data of another.
The service needs to be operated and managed securely in order to impede, detect or prevent attacks, using vulnerability management, protective monitoring, configuration and change management.
If service provider personnel have access to your data and systems, you need a high degree of confidence in their trustworthiness and the technical measures in place that audit and constrain the actions of those personnel.
Cloud services should be designed, developed and deployed in a way that minimises and mitigates threats to their security, including a robust software development lifecycle
All external or less-trusted interfaces of the service should be identified and defended appropriately, including external APIs, web consoles and command line interfaces.
You should be able to identify security incidents and should have the information necessary to find out how and when they occurred. The service will need to provide you with audit information, and issue security alerts when attempted attacks are detected.

Developing the right security posture is hard: some companies worry about sophisticated hacking groups, others struggle to stop staff using ‘1234’ as a password. Covering the fundamentals of security, understanding where the market is going, and asking cloud providers tough questions about their own security, is a good path to follow.