How Organizations Can Use Cloud Services Securely

At least 70 percent of global businesses presently operate, either fully or partly, on the cloud — according to data from Cloud Security Alliance. This is not a big surprise given that the cloud offers numerous benefits such as lower fixed costs, automatic software updates, higher flexibility, freedom to work from anywhere, and increased collaboration.

Still, the cloud has many security issues with Bitglass’ Report revealing that 90 percent of US-based organizations are concerned, at some level, about public cloud security. These concerns range from malicious insiders and hijacked accounts to full-scale data breaches. Although the advent of cloud services and storage has ushered a new age of data transmission and storage, many companies remain hesitant to make a move without a sound security plan — and with good reason.

Cloud computing has unique security challenges and issues. Here, your data is accessed over the internet and stored by a third-party provider. Ergo, your control over the data is limited as opposed to storing it on your premises. So naturally, this raises the question of how your data can be securely stored.

Cloud security is a shared responsibility, and it is treated as such by many cloud service providers (CSPs). Essentially, the cloud service provider ensures the security of the cloud itself, while you must ensure security on your end. In every cloud service environment such as infrastructure-as-a-service or software-as-as-service, you are responsible for not only protecting your data from security threats but also controlling access to it.

Security Issues Related to SaaS

Almost all shared security responsibility models leave data and access as the responsibility of customers, which is why security issues related to SaaS applications are centered on the two. It is in your best interest as an organization to understand and control what data you put in the cloud, what level of protection your CSP has applied, and who has access to it.

Below are some of the security-related issues experienced with SaaS:

• Lack of visibility of your data in the cloud
• Theft of your data by a malicious actor
• Incomplete control over who has access to your sensitive data
• Lack of skilled and experienced staff to manage security for your cloud applications
• The inability of your CSP to maintain regulatory compliance such as SOC2 / SOC3, COBIT, and HITRUST frameworks
• Inability to monitor or secure data in transit within cloud applications
• Inability to prevent misuse, illegal access, and theft of data
• Advanced attacks against your CSP

Always factor in the role of your SaaS provider in your organizations’ cloud security protocols since they are a potential access point to your data and processes. Cloud insecurity developments such as GoldenEye and XcodeGhost ransomware show that hackers recognize the value of cloud and software providers as possible vectors in launching attacks on larger assets.

To secure your organization’s data, always ensure that you scrutinize your CSP’s security programs. Also, insist on predictable third-party auditing with all your shared reports as well as breach reporting terms. Remember that no cloud service provider can ever guarantee 100 percent security; thus, do not store extremely sensitive data in the cloud.

Security Issues Related to IaaS

The protection of your organization’s data is crucial in IaaS. As your customer responsibility extends to operating systems, applications, and network traffic, new threats arise. Of late, there has been a revolution in the nature of attacks, which extend beyond data risk. Malicious individuals are perpetrating hostile takeovers of organizations’ computing resources and repurposing these resources as attack vectors against other elements of third parties and enterprise infrastructure.

Some security issues experienced with IaaS include the following:

• Incomplete control over who can gain access to your sensitive data
• The creation of cloud workloads and accounts outside of IT visibility (think shadow IT)
• Lack of consistent security control protocols over on-premise and multi-cloud environments
• Inability to monitor your cloud applications and workload systems for vulnerabilities
• Lateral spread of attacks among cloud workloads
• Lack of skilled staff to secure your cloud infrastructure
• Inability to prevent unauthorized data access and theft

When outsourcing IaaS services, look for a competent provider who has put in place security measures to limit access of data, prevent theft, control who can enter or retrieve data on the cloud, track resource modifications to catch abnormal behaviors, secure and harden orchestration tools, and monitor their traffic for attacks or system compromise.

Security Issues Related with the Private Cloud Environment

An increasingly growing bone of contention among the cloud services environment is the public vs. private cloud debate. The private cloud offers a fine-tuned control environment where higher levels of data protection and control compensate for its limitations.

Some security issues experienced with private cloud include:

• The lack of consistent security controls that span over the virtualized private cloud and traditional server infrastructures
• The private cloud’s increasing infrastructure complexity results in more time and effort used for implementation and maintenance
• Advanced attacks and threats targeting these environments
• Lack of a skilled staff to manage security for your organization’s software-defined data center (for instance virtual compute, storage, network)
• Incomplete visibility over the security protocol used for your software-defined data center

The private cloud, in its attempt to provide control and data protection, creates a complex structure that requires more effort to maintain. You can reduce this complexity and simplify cloud security management through abstraction of controls. This essentially unifies private and public cloud platforms across virtual, physical, and hybrid entrainments.

How to Mitigate Cloud Computing Security Issues

Assume Responsibility: Always pay attention to potential security issues and take steps to prevent them such as deploying an automated security monitoring software that identifies attempted unauthorized access, outside threats, and unusual access patterns.

Encryption: Always encrypt your data in your server before sending it to the cloud. This prevents hackers who succeed in getting inside your firewall from editing, reading, copying or deleting your files.

Secure Access: Here, use multi-factor authentication to make it harder to gain unauthorized access, limit the access of data using admin levels to prevent data mismanagement and accidents, and secure all your endpoints including mobile devices. This also provides protection from SaaS-related security issues.

Data Protection: Your data is vulnerable to damage or deletion while on the cloud. Therefore, you need to secure it using backups and snapshots. You also need to secure both copies of your working and backup data using erasure or replication coding. Finally, do not store sensitive information in the cloud.

Use the Right CSP: Shop around for the best cloud service provider that takes all possible precautions to keep your organization’s data secure. Look out for compliance and certifications to industry frameworks such as HITRUST or COBIT.

The cloud has opened an exciting new frontier for access, storage, productivity, and flexibility, which comes with a new set of security concerns. Securing your cloud services is not the sole responsibility of your CSP. You need to take steps to protect your data on your end and hire a CSP that complies to industry-set security regulations.

You can learn more about cloud security and vendor management at ReciprocityLabs.com.