Cloud can cut your security risks

Issue 7 2022 Information Security, Infrastructure

It may seem counter-intuitive, but organisations can better guard against today’s constant wave of security threats – or at least reduce some of their risk burden – by accelerating their move to the cloud rather than stalling it. Simply put, using public cloud services shifts some of the responsibility for the underlying infrastructure onto the providers. And all of them are highly motivated to keep on top of security.

Furthermore, public cloud environments attract greater scrutiny from vulnerability hunters than private ones do, and this bolsters the fight to stay protected. The way your organisation runs patching in the cloud can also make security easier, as some aspects can be shifted to the provider altogether and others can take place without impacting your service availability.

This last point about patching is particularly important. The statistics on the root cause of major incidents that used software vulnerabilities to succeed show that it’s common to see exploits of vulnerabilities that are more than 12 months old. In fact, almost half of the organisations that had a data breach in the last two years said it had occurred because a patch was available but not applied, according to research from Ponemon/IBM.

Ignoring patches

This tells us that, even though organisations know that patching is important, many are ignoring specific, non-critical risks and instead are choosing to keep their software several releases behind the latest version. There are many understandable reasons for this, such as a lack of capacity for testing, concerns about service interruptions or simply being overwhelmed by the sheer number of patches released by vendors. But moving to the cloud is an opportunity to change this pattern without incurring any of these less desirable results.

When you work in the cloud you can shift the accountability for patching some aspects of your infrastructure to your service providers. Often, they use software-defined mechanisms for patching which don’t interrupt your services. You may not even notice updates happening.

Equally, where you’re using the cloud to run software that you’re accountable for, there are ways to keep critical services up to date more easily. You can use the elasticity of the cloud to take individual components out of service without impacting availability – if they’re designed correctly.

Patching alone, however, is not enough to protect against attack. It’s common for the attackers to set up alternative access methods in preparation for the next stage in the intrusion to achieve persistence or maintain their foothold. When an organisation is dealing with ‘a hole in the fence’, such as the 2021 Microsoft Exchange Server vulnerabilities, of course patching is important. But that’s not the only thing to do, or even the most important element.

The incentive of public scrutiny

Understanding whether you have been compromised in any way is critical. In general, the large common cloud systems bring two clear positives. First, that such systems are public and accessible to all, and second, that the incentive to fix them if something goes wrong is very high. Often, this makes them safer than personal or organisation-specific cloud systems.

One of the key strengths for the cloud provider’s defending team is the responsible disclosure process, where researchers from the security research community give the vendor advance notice of their findings (typically three months). This gives the vendor time to investigate the issue and issue a fix. Then the researcher can go public with their work.

Secondly, with so many of their customers reliant on shared common systems, the pressure on vendors to fix their systems – either proactively before an attack or very quickly afterwards – is immense.

The service model

To gain real advantage from operating in a cloud-based world, though, organisations need to reimagine their solutions, building them out of reusable Platform-as-a-Service (PaaS) components or Software-as-a-Service (SaaS) modules. No matter where you are on your journey to the cloud or what your current level of cyber maturity is, it’s important to start by recognising two factors:

• Securing the cloud is not the same as securing your own infrastructure.

• Traditional security architectures don’t translate well to an edge-based, connect-from-anywhere, cloud-first model.

Additionally, it’s important to understand that not all the risks and responsibilities shift to the cloud provider. For example, you will still need to bring in external tools and services to assess and report on the security of your cloud services, while continuing to keep a clear overview of where and how your data and assets are stored.

As such, we’re not advocating a ‘rip and replace’ strategy to hitch your organisation to the latest security technology bandwagon. It’s important to realise that many of your existing security controls will remain effective. Rather, you should focus on the gaps that are a priority for your organisation and leverage a move to the cloud to secure these.




Share this article:
Share via emailShare via LinkedInPrint this page



Further reading:

Highest increase in global cyberattacks in two years
Information Security News & Events
Check Point Global Research released new data on Q2 2024 cyber-attack trends, noting a 30% global increase in Q2 2024, with Africa experiencing the highest average weekly per organisation.

Read more...
Continuous security optimisation.
News & Events Information Security
Cymulate has announced its partnership with SentinelOne, a threat exposure validation and AI-powered cybersecurity platform. The collaboration delivers self-healing endpoint security that empowers businesses to increase protection for every endpoint on their network.

Read more...
Protect your smart home devices
Kaspersky IoT & Automation Information Security Smart Home Automation
Voice assistants, kitchen robots, smart lights and many other intelligent devices have become part of our everyday life. However, with the rise of smart technology comes the need for robust protection against potential vulnerabilities.

Read more...
ISPA’s take-down process protects from local scams
News & Events Information Security
During the recent school holidays, parents could rest a little easier knowing that ISPA, SA’s official internet industry representative body, is removing an average of three to four problematic websites from the local internet every week.

Read more...
NEC XON disrupts sophisticated cyberattack
Information Security
NEC XON recently showcased its advanced cyberthreat detection and response capabilities by successfully thwarting a human-operated ransomware attack targeting a major service provider.

Read more...
What’s your cyber game plan?
Information Security
“Medium-sized businesses are often the easiest target for cyber criminals, because they are just digital enough to be vulnerable, but not mature enough to be fully protected," says Warren Bonheim, MD of Zinia.

Read more...
Managing stock efficiently and cost-effectively
Asset Management Infrastructure Logistics (Industry)
Rina Redelinghuys, customer services executive at Cquential, a member of the Argility Technology Group, examines stock management across various industries, including retail, fast-moving consumer goods, food and dairy, automotive, apparel, industrial, accessories, paint and chemicals, and pharmaceuticals.

Read more...
Upgrade your PCs to improve security
Information Security Infrastructure
Truly secure technology today must be designed to detect and address unusual activity as it happens, wherever it happens, right down to the BIOS and silicon levels.

Read more...
Open source code can also be open risk
Information Security Infrastructure
Software development has changed significantly over the years, and today, open-source code increasingly forms the foundation of modern applications, with surveys indicating that 60 – 90% of the average application's code base consists of open-source components.

Read more...
DeepSneak deception
Information Security News & Events
Kaspersky Global Research & Analysis researchers have discovered a new malicious campaign which is distributing a Trojan through a fake DeepSeek-R1 Large Language Model (LLM) app for PCs.

Read more...










While every effort has been made to ensure the accuracy of the information contained herein, the publisher and its agents cannot be held responsible for any errors contained, or any loss incurred as a result. Articles published do not necessarily reflect the views of the publishers. The editor reserves the right to alter or cut copy. Articles submitted are deemed to have been cleared for publication. Advertisements and company contact details are published as provided by the advertiser. Technews Publishing (Pty) Ltd cannot be held responsible for the accuracy or veracity of supplied material.




© Technews Publishing (Pty) Ltd. | All Rights Reserved.