A cloud computing platform hosts software, hardware, network and data storage technologies virtually, enabling organisations to reduce costs and expect greater reliability. The policies, controls and technologies involved in protecting data and infrastructure stored in the cloud are called cloud security.
There are many benefits of using a cloud-based service: organisations can expect greater scalability, lower maintenance costs and faster deployment cycles, in addition to taking advantage of built-in security services. Furthermore, since the cloud provider, or host, and the customer share the cloud security responsibilities, it reduces the overhead maintenance for organisations. For example, the cloud provider is responsible for the security of the physical systems that store the organisation’s technology, such as through patching or restricting access. However, the security of the infrastructure stored on the cloud itself is the organisation’s responsibility through identity and access management to systems, privacy protection such as encryption, and compliance with regulations.
The nature of the provider or organisation’s responsibilities depends on individual contexts. However, the security threats to an organisation’s cloud-based infrastructure are still prevalent in comparison to proprietary data centres despite the benefits of the cloud. In keeping infrastructure on the cloud secure, organisations may consider:
- Strong Identity and Access Management system
- Zero-trust network
- Intrusion detection and monitoring
- Malware and web application protection
- Embedding threat intelligence
- Cloud compliance
Cyber resilience in a multi-cloud environment
Most organisations are now developing a multi-cloud, multi-year strategy, leveraging IaaS (Infrastructure as a Service), SaaS (Software as a Service), and PaaS (Platform as a Service). While this multi-cloud approach brings diversification benefits, the cyber risks become more complex because ascertaining the identity of a person, service or machine to provide access to the relevant data or capability becomes harder.
Sandy Bird, CTO and Co-Founder of Sonrai Security, a cloud security company, was right when he told Silicon Angle that identity is about more than people: “When we talk about identity, we always think of people. But it’s not, of course. Sometimes, it’s a machine; sometimes, it’s a cloud service. It could be many different things.” The question for companies, he argued, is to efficiently and safely ensure all those ‘identities’ can access a resource and plan for what happens when a bad actor takes over an identity.
Bad actors can infiltrate cloud systems by targeting the identification gaps between them. As application teams sprint ahead, they often leave the security and compliance teams scrambling to protect their digital footprint across several clouds. As cloud complexity and identities increase, organisations fall further behind in ensuring that clouds are properly configured and monitored.