printer friendly version

Cloud can cut your security risks

It may seem counter-intuitive, but organisations can better guard against today’s constant wave of security threats – or at least reduce some of their risk burden – by accelerating their move to the cloud rather than stalling it. Simply put, using public cloud services shifts some of the responsibility for the underlying infrastructure onto the providers. And all of them are highly motivated to keep on top of security.

Furthermore, public cloud environments attract greater scrutiny from vulnerability hunters than private ones do, and this bolsters the fight to stay protected. The way your organisation runs patching in the cloud can also make security easier, as some aspects can be shifted to the provider altogether and others can take place without impacting your service availability.

This last point about patching is particularly important. The statistics on the root cause of major incidents that used software vulnerabilities to succeed show that it’s common to see exploits of vulnerabilities that are more than 12 months old. In fact, almost half of the organisations that had a data breach in the last two years said it had occurred because a patch was available but not applied, according to research from Ponemon/IBM.

Ignoring patches

This tells us that, even though organisations know that patching is important, many are ignoring specific, non-critical risks and instead are choosing to keep their software several releases behind the latest version. There are many understandable reasons for this, such as a lack of capacity for testing, concerns about service interruptions or simply being overwhelmed by the sheer number of patches released by vendors. But moving to the cloud is an opportunity to change this pattern without incurring any of these less desirable results.

When you work in the cloud you can shift the accountability for patching some aspects of your infrastructure to your service providers. Often, they use software-defined mechanisms for patching which don’t interrupt your services. You may not even notice updates happening.

Equally, where you’re using the cloud to run software that you’re accountable for, there are ways to keep critical services up to date more easily. You can use the elasticity of the cloud to take individual components out of service without impacting availability – if they’re designed correctly.

Patching alone, however, is not enough to protect against attack. It’s common for the attackers to set up alternative access methods in preparation for the next stage in the intrusion to achieve persistence or maintain their foothold. When an organisation is dealing with ‘a hole in the fence’, such as the 2021 Microsoft Exchange Server vulnerabilities, of course patching is important. But that’s not the only thing to do, or even the most important element.

The incentive of public scrutiny

Understanding whether you have been compromised in any way is critical. In general, the large common cloud systems bring two clear positives. First, that such systems are public and accessible to all, and second, that the incentive to fix them if something goes wrong is very high. Often, this makes them safer than personal or organisation-specific cloud systems.

One of the key strengths for the cloud provider’s defending team is the responsible disclosure process, where researchers from the security research community give the vendor advance notice of their findings (typically three months). This gives the vendor time to investigate the issue and issue a fix. Then the researcher can go public with their work.

Secondly, with so many of their customers reliant on shared common systems, the pressure on vendors to fix their systems – either proactively before an attack or very quickly afterwards – is immense.

The service model

To gain real advantage from operating in a cloud-based world, though, organisations need to reimagine their solutions, building them out of reusable Platform-as-a-Service (PaaS) components or Software-as-a-Service (SaaS) modules. No matter where you are on your journey to the cloud or what your current level of cyber maturity is, it’s important to start by recognising two factors:

• Securing the cloud is not the same as securing your own infrastructure.

• Traditional security architectures don’t translate well to an edge-based, connect-from-anywhere, cloud-first model.

Additionally, it’s important to understand that not all the risks and responsibilities shift to the cloud provider. For example, you will still need to bring in external tools and services to assess and report on the security of your cloud services, while continuing to keep a clear overview of where and how your data and assets are stored.

As such, we’re not advocating a ‘rip and replace’ strategy to hitch your organisation to the latest security technology bandwagon. It’s important to realise that many of your existing security controls will remain effective. Rather, you should focus on the gaps that are a priority for your organisation and leverage a move to the cloud to secure these.

Share this article:

Further reading: