Cloud can cut your security risks

Issue 7 2022 Cyber Security, IT infrastructure

It may seem counter-intuitive, but organisations can better guard against today’s constant wave of security threats – or at least reduce some of their risk burden – by accelerating their move to the cloud rather than stalling it. Simply put, using public cloud services shifts some of the responsibility for the underlying infrastructure onto the providers. And all of them are highly motivated to keep on top of security.

Furthermore, public cloud environments attract greater scrutiny from vulnerability hunters than private ones do, and this bolsters the fight to stay protected. The way your organisation runs patching in the cloud can also make security easier, as some aspects can be shifted to the provider altogether and others can take place without impacting your service availability.

This last point about patching is particularly important. The statistics on the root cause of major incidents that used software vulnerabilities to succeed show that it’s common to see exploits of vulnerabilities that are more than 12 months old. In fact, almost half of the organisations that had a data breach in the last two years said it had occurred because a patch was available but not applied, according to research from Ponemon/IBM.

Ignoring patches

This tells us that, even though organisations know that patching is important, many are ignoring specific, non-critical risks and instead are choosing to keep their software several releases behind the latest version. There are many understandable reasons for this, such as a lack of capacity for testing, concerns about service interruptions or simply being overwhelmed by the sheer number of patches released by vendors. But moving to the cloud is an opportunity to change this pattern without incurring any of these less desirable results.

When you work in the cloud you can shift the accountability for patching some aspects of your infrastructure to your service providers. Often, they use software-defined mechanisms for patching which don’t interrupt your services. You may not even notice updates happening.

Equally, where you’re using the cloud to run software that you’re accountable for, there are ways to keep critical services up to date more easily. You can use the elasticity of the cloud to take individual components out of service without impacting availability – if they’re designed correctly.

Patching alone, however, is not enough to protect against attack. It’s common for the attackers to set up alternative access methods in preparation for the next stage in the intrusion to achieve persistence or maintain their foothold. When an organisation is dealing with ‘a hole in the fence’, such as the 2021 Microsoft Exchange Server vulnerabilities, of course patching is important. But that’s not the only thing to do, or even the most important element.

The incentive of public scrutiny

Understanding whether you have been compromised in any way is critical. In general, the large common cloud systems bring two clear positives. First, that such systems are public and accessible to all, and second, that the incentive to fix them if something goes wrong is very high. Often, this makes them safer than personal or organisation-specific cloud systems.

One of the key strengths for the cloud provider’s defending team is the responsible disclosure process, where researchers from the security research community give the vendor advance notice of their findings (typically three months). This gives the vendor time to investigate the issue and issue a fix. Then the researcher can go public with their work.

Secondly, with so many of their customers reliant on shared common systems, the pressure on vendors to fix their systems – either proactively before an attack or very quickly afterwards – is immense.

The service model

To gain real advantage from operating in a cloud-based world, though, organisations need to reimagine their solutions, building them out of reusable Platform-as-a-Service (PaaS) components or Software-as-a-Service (SaaS) modules. No matter where you are on your journey to the cloud or what your current level of cyber maturity is, it’s important to start by recognising two factors:

• Securing the cloud is not the same as securing your own infrastructure.

• Traditional security architectures don’t translate well to an edge-based, connect-from-anywhere, cloud-first model.

Additionally, it’s important to understand that not all the risks and responsibilities shift to the cloud provider. For example, you will still need to bring in external tools and services to assess and report on the security of your cloud services, while continuing to keep a clear overview of where and how your data and assets are stored.

As such, we’re not advocating a ‘rip and replace’ strategy to hitch your organisation to the latest security technology bandwagon. It’s important to realise that many of your existing security controls will remain effective. Rather, you should focus on the gaps that are a priority for your organisation and leverage a move to the cloud to secure these.




Share this article:
Share via emailShare via LinkedInPrint this page



Further reading:

Industrial control systems under attack
News Cyber Security
According to Kaspersky ICS CERT statistics, from January to September 2022, 38% of computers in the industrial control systems (ICS) environment in the META region were attacked using multiple means.

Read more...
OSINT: A new dimension in cybersecurity
Cyber Security
The ancient Chinese strategist Sun Tzu noted, you should always try to know what the enemy knows and know more than the enemy.

Read more...
Sasol ensures Zero Trust for SAP financials with bioLock
Technews Publishing Editor's Choice Cyber Security Security Services & Risk Management
Multi-factor authentication, including biometrics, for SAP Financials from realtime North America prevents financial compliance avoidance for Sasol.

Read more...
Building a holistic application security process
Altron Arrow Cyber Security
Altron Arrow asks what it means to build a holistic AppSec process. Learn what’s involved in a holistic approach and how to get started.

Read more...
Managing data privacy concerns when moving to the cloud
Cyber Security
While the cloud offers many business benefits, it can also raise concerns around compliance, and some organisations have taken the approach of staying out of the cloud for this reason.

Read more...
Accelerating your Zero Trust journey in manufacturing
IT infrastructure Cyber Security Industrial (Industry)
Francois van Hirtum, CTO of Obscure Technologies, advises manufacturers on a strategic approach to safeguarding their businesses against cyber breaches.

Read more...
The democratisation of threats
Cyber Security
Bugcrowd looks at some of the primary vulnerabilities the world faced in 2021, and the risks moving forward with growing attack surfaces and lucrative returns on crime.

Read more...
Protecting yourself from DDoS attacks
Cyber Security Security Services & Risk Management
A DDoS attack, when an attacker floods a server or network with Internet traffic to prevent users from accessing connected online services, can be costly in both earnings and reputation.

Read more...
Exploiting Android accessibility services
Cyber Security
Pradeo Security recently neutralised an application using Android accessibility services that exploits the permission to perform fraudulent banking transactions.

Read more...
Cyber resilience is more than cybersecurity
Technews Publishing Editor's Choice Cyber Security Integrated Solutions IT infrastructure
Hi-Tech Security Solutions held a round-table discussion focusing on cyber resilience and found that while the resilience discipline includes cybersecurity, it also goes much further.

Read more...