printer friendly version

Security and cloud computing

Improving security is a strong motivation to accelerate the move from traditional IT architectures to modern, cloud ones.

Dragan Petkovic

Traditional IT involves assembling multiple architectures from several vendors, creating environments that are both complex and brittle. Human IT operators are then ultimately responsible for ensuring proper configuration and that patches are up to date. As a result, they have to be good at a lot of different things at the same time, which increases the risk of human error.

By comparison, modern clouds are managed by small, specialised teams using the best tools available, backed by uniformly strong process controls, which means the likelihood of error is low. That said, cloud requires policies and processes to be adhered to by both the vendor and customer for effective security.

A recent Oracle survey of 730 IT professionals found that almost two-thirds (63%) of South African respondents agree that cloud adoption offers the ability to better meet customer demands, enable greater collaboration, improve scalability and agility. However, concerns over security remain a barrier; 39% feel there are major security issues in moving IT operations and data to the cloud.

Here are three steps to ensure organisational data is kept secure:

1. Employee education: Industry estimates put nearly half of all security breaches down to human error, and educating employees on how to spot suspicious emails is critical. This can help cut down on phishing, whaling and other attacks that rely on unsuspecting end-users to click on links to infected websites, or open attachments that install malware or ransomware.

2. Encryption a quick win: No cloud service should be without data encryption. Encryption is one of the easiest technical controls to implement and a number of organisations opt for it as a quick win since it requires minimum human intervention. It has been used for decades and it is a matter of concern that some organisations are still not using it to protect their confidential data. Oracle has made major efforts to make its encryption solutions transparent to implement with no or minimum overhead. Even on an individual level, several encryption solutions are available. We see trends; for example, moving key stores from files to central-based solutions such as Oracle Key Vault, that make it easier to manage and ultimately safer.

3. Understand user behaviour: To combat modern security threats, many enterprises are turning to security solutions that leverage user behaviour analytics (UBA). By analysing user behaviour and forming a baseline definition of normal, these solutions can notify IT administrators when deviations occur.

Traditional security measures based on protocol analysis and virus signatures continue to be part of every enterprise’s defence system. However, these solutions are more applicable to legacy threats than the modern threats designed to target specific enterprises. Traditional solutions alone simply cannot keep up with the increasing sophistication of today’s attacks and hackers. Nor can they cope with savvy users who, for sake of productivity and convenience, often attempt to bypass existing security measures and company policies.

Unfortunately, many IT administrators lose their security precautions with the adoption of cloud services; there is no longer any perceived network separation, physical separation, or unique login procedures. Losing the controlled administrative access the IT teams are accustomed to can represent a significant void in the security posture.

UBA solutions fill this void by acting as another layer of security beyond simple credentials. By continually assessing the normal behaviour of users, any deviations—including upgrading user privileges, accessing sensitive security settings, and changing security settings - can alert the IT administrator.

In addition, it is crucial for organisations to have an incidence response process that includes everyone involved, from the IT security team to the legal, communications, and executive teams. In 2019, companies should have cybersecurity fire drills to simulate how they’re going to react and communicate in the event of an attack. The ideal scenario is to find the inevitable hackers and stop them before they steal an enterprise’s data, but if that doesn’t happen, clear guidelines should be in place and the organisation must be trained to follow them.

With security at the core of modern organisations; good governance for managing systems and people effectively is critical, while strong authentication and encryption becomes a necessity.

Share this article:

Further reading: