According to a recent Intel report, approximately 93% of companies have adopted some sort of cloud service, choosing Infrastructure as a Service (IaaS), Platform as a Service (PaaS), Software as a Service (SaaS), or a hybrid. This broad adoption of cloud services and the move from private clouds to public indicate better trust in the technology — according to the Intel report, for every person who distrusts the cloud, there are two who feel it’s safe.
Security Risks
However, this doesn’t mean that there are no longer any risks associated with the cloud. Approximately 62% of respondents have moved sensitive customer data to the cloud, which has increased the risk of a breach; almost half of companies have been able to track malware back to a SaaS application. Part of the problem falls on the people using the cloud: a lack of cybersecurity professionals in combination with employees using unsanctioned cloud services known as shadow IT. Even NASA isn’t exempt, with a recent audit discovering that government data has been uploaded to public cloud storage services.
Sensitive Data and Cybercriminals
The large-scale move of data to public cloud services has unfortunately attracted the attention of cybercriminals, who seek to exploit weak and vulnerable targets. According to the report, user credentials are the most likely point where cybercriminals will seek to access data. Shadow IT is also an area of concern, with 65% of IT professionals stating that the use of shadow IT is interfering with their efforts to keep cloud services secure.
What the Business Can Do
Businesses can be proactive in reducing security risks before they become a real problem. Using solutions that are integrated and/or unified will enable the business to reduce the majority of risk by giving IT professionals a full overview of the system and its permissions. Authentication best practices — biometrics, multi-factor authentication, and unique passwords — will help to prevent cybercriminals from accessing user and admin credentials. Businesses should also utilize security technologies, including:
- Cloud access security brokers
- Data loss prevention
- Encryption
The cloud is flexible and cost-effective, but the data uploaded to it needs to be safe and secure in order for businesses to reap the benefits. Whatever the service, whether individual or hybrid, businesses should be looking to increase their security by using available technologies, concentrating on keeping cybercriminals from accessing user credentials, and ensuring their IT department is ahead of the curve to prevent employees from using shadow IT.
The decentralization of IT management, brought about by more businesses moving to the cloud, brings with it growing concerns about vulnerabilities, according to a survey commissioned by virtualization vendor VMware. The purchase of non-secure solutions has led to new compliance and security issues, and IT managers must overhaul their measures in order to keep up with the move to the cloud.
In today’s vulnerable security landscape, data protection is of paramount importance. Organizations must strive to effectively secure both incoming and outgoing data. No truer is this than with General Data Protection Regulation (GDPR), which offers additional security for encrypted technologies and firewalls. As a form of legislation for mainly European entities, GDPR is designed to protect all forms of data for worldwide companies and private citizens.
Bring your own device (BYOD) has the benefit of allowing businesses to cut costs on providing devices to employees, but it also creates a number of security issues. This is an especially important factor to consider for government agencies, which often handle very sensitive data but may not have a focused, detailed policy for employees to follow. Employees aren’t necessarily creating security holes on purpose, but agencies should still have a firm policy in place — or make the decision not to allow employees to bring their own devices at all.