Managing security in the cloud

April 2018 Editor's Choice, Information Security, Security Services & Risk Management

According to BT’s CEO 2017 survey, cloud computing is cited as one of four critical technology trends (others include Internet of Things, mobile computing and social media) that are likely to have the most significant impact on business over the next two to three years. But, is it secure?

Alessandro Postiglioni.
Alessandro Postiglioni.

It’s also important to note that cloud computing is founded on a virtual environment, where the threats that apply to virtualisation also apply in the cloud computing space. Added to this, as cloud computing expands to cover data stored in private and public clouds, and on numerous roaming mobile devices, security is expanding out of the data centre. This leaves security decision-makers without visibility or control of cloud applications used within their environments – and new threats are inevitable.

Some of the main issues that businesses face when it comes to cloud security, include:

• Visibility – businesses can’t ‘see’ sanctioned and unsanctioned cloud applications, so they have no visibility of the cloud applications used by employees within the business (or the risk associated with them).

• Threats – whether from compromised accounts, insider threats and/or malware attempting to move data to and from the cloud, businesses are constantly at risk from cyber criminals. Below I’ve listed seven major potential threats that BT has identified.

1. Virtualisation and hypervisor based attacks.

2. Insider threat across the Cloud Service Provider (CSP) and the business.

3. Malware and data movement and remnants.

4. Phishing attacks to compromise accounts.

5. Legal and jurisdictional threats.

6. Threats to physical infrastructure.

7. Threats to shared infrastructure.

• Compliance – data-leak prevention solutions in data centres can’t protect businesses against data exfiltration by remote or bring-your-own-device (BYOD) users.

• Collaboration – businesses have no visibility of whose files are shared with or who has access to them, and they can’t apply policy around secure collaboration.

• Data security – there is no way to consistently apply encryption across sanctioned applications, or control access to sensitive data from unmanaged devices.

• Inconsistent security policy – businesses can’t consistently apply policy across all cloud applications users are collaborating with.

With the above in mind; any business considering cloud services should reflect the following questions, so as to better understand who needs to take ultimate responsibility for security at the end of the day.

• Who’s really responsible for my data? The short answer is, the client/business is. As the owner, it is their responsibility, and not the CSPs to secure their clients’ data.

• Where is my data? Although it’s in the cloud, it must also reside in a physical location. This must be discussed with the CSP as to which country/countries the data will reside in – and businesses should be aware that different countries have difference requirements and controls placed on access.

• Who has access to my data and my code? Insider attacks are a huge risk, and a potential hacker can be someone with approved access to the cloud. The client/business will need to know who will be managing their data and the types of control applied to these individuals.

• What is the current maturity and long-term viability of my chosen CSP? How long have they been in business? What’s their track record? Are they operationally effective and secure? If they go out of business, what happens to the data?

• What happens if there’s a security breach? What support will the client/business receive from the CSP?

• What is the disaster recovery/business continuity plan? The data is physically located somewhere, and all physical locations face threats, such as fire, storms, natural disasters, and loss of power, for example. It’s therefore important for a client/business to understand how their chosen CSP will respond, and what guarantee of continued services they promise.

A business’ data can actually be safer in the cloud – if cloud is used effectively and securely, and the business has solid endpoint protection measures in place. And, possibly even more safe when partnering with a reputable CSP who is able to offer a managed cloud solution through advanced self-service IaaS capability; allowing businesses to manage their own virtual infrastructure and cloud solutions – from virtual machines to the network, storage and security – from the cloud.





Share this article:
Share via emailShare via LinkedInPrint this page



Further reading:

Data security and privacy in global mobility
Risk Management & Resilience Information Security
Data security and privacy in today’s interconnected world is of paramount importance. In the realm of global mobility, where individuals and organisations traverse borders for various reasons, safeguarding sensitive information becomes an even more critical imperative.

Read more...
Sophos celebrates partners and cybersecurity innovation at annual conference
News & Events Information Security
[Sponsored] Sun City hosted Sophos' annual partner event this year, which took place from 12 to 14 March. Sophos’ South African cybersecurity distributors and resellers gathered for an engaging two-day conference.

Read more...
Enhance control rooms with surveillance and intelligence
Leaderware Editor's Choice Surveillance Mining (Industry)
Dr Craig Donald advocates the use of intelligence and smart surveillance to assist control rooms in dealing with the challenges of the size and dispersed nature common in all mining environments.

Read more...
A long career in mining security
Technews Publishing Editor's Choice Mining (Industry) Risk Management & Resilience
Nash Lutchman recently retired from a security and law enforcement career, initially as a police officer, and for the past 16 years as a leader of risk and security operations in the mining industry.

Read more...
A constant armed struggle
Technews Publishing XtraVision Editor's Choice Integrated Solutions Mining (Industry) IoT & Automation
SMART Security Solutions asked a few people involved in servicing mines to join us for a virtual round table and give us their insights into mine security today. A podcast of the discussion will be released shortly-stay tuned.

Read more...
Risk management: There's an app for that
Editor's Choice News & Events Risk Management & Resilience
Zulu Consulting has streamlined the corporate risk management process with the launch of Risk-IO, a web-based app designed to consolidate and guide risk managers through the process, monitoring progress as one proceeds.

Read more...
Integrated information platform for risk management
Editor's Choice News & Events Risk Management & Resilience
Online Intelligence recently launched version 7 of its CiiMS risk and security platform. Speaking to SMART Security Solutions after the launch event, the company’s Arnold van den Bout described the enhancements in version 7.

Read more...
Unlocking Africa's AI potential
Editor's Choice News & Events AI & Data Analytics
Africa's AI market is set to grow exponentially; by investing in AI education, training, and ethical practices, African nations can harness the power of AI to transform the continent and create a brighter future for its people.

Read more...
The CIPC hack has potentially serious consequences
Editor's Choice Information Security
A cyber breach at the South African Companies and Intellectual Property Commission (CIPC) has put millions of companies at risk. The organisation holds a vast database of registration details, including sensitive data like ID numbers, addresses, and contact information.

Read more...
Global Identity Fraud Report revealing eight-month ‘mega-attack’
Editor's Choice Risk Management & Resilience
AU10TIX recently released its Q4 Global Identity Fraud Report, with the research identifying two never-before-seen attack patterns, with the worst case involving 22 000+ AI-generated variations of a single U.S. passport.

Read more...