4 Ways to Strengthen Your Cloud Security

COVID-19 has had an impact on budgets, with businesses on average allocating 27% of their budget to cloud security. If your leadership thinks the cloud is secure by default, a recent Sophos report highlighted that 70% of companies hosting data/workloads in the public cloud reported a security incident, with most attacks exploiting misconfigurations or using stolen credentials.

Ensuring that your cloud security is as complete as possible requires strong leadership as well as the knowledge from IT or partners to defend services and data. To achieve this, clarity of understanding, strength and depth in defense, and the ability to resolve all issues rapidly are key. What steps should you take to improve your cloud security posture management?

1. Understand and share knowledge of threats across the business

As with any enterprise effort, data and cloud security is best done as a cross-functional team, typically called a Cloud Center of Excellence (CCoE). This typically includes leadership, IT, security and networking specialists along with security partners or experts and other key roles.

The CCoE’s aim is to ensure that cloud services align to business needs, delivering scalability and cost-efficiency. It must set and meet enterprise success goals and provide clarity to leaders on all cloud issues, while defining and maintaining standards, and promoting cloud governance. Overall, this is badged as cloud security posture management (CSPM), which analyzes a firm’s cloud strategies and how their tools manage and policies orchestrate cloud security.

With the threats against cloud services growing, it must also deliver the strongest possible security posture against those threats and any additional issues that users and services currently and could face.

2. Understand the risks from the cloud and within your business

Our cloud security study revealed that nearly three-quarters (73.5%) of organizations are extremely concerned about the security aspect of cloud computing. As organizations migrate to the cloud, CIOs are likely to encounter some security challenges, including:

• Data breaches
• Risk of account or service hijack
• Malware attack
• Weak service configuration

And the list continues to grow as bad actors and automated attackers scour the internet for targets. This makes it a continuing challenge for all businesses and not something that can be signed-off and ignored once a first effort is complete.

Clarifying internal responsibilities across IT and security leaders ensures that a chain of command is built to respond to incidents. And that clear communication exists between centralized cloud security and operational teams. Much of the data they’ll respond to comes from reporting dashboards bringing live data to the CCoE.

Learning from other incidents is also key. Take the 2020 Twitter hack where workers gave out their passwords for internal tools, showing just how easy it is for even IT-reliant companies to fall victim. The CCoE needs to ensure regular information sharing and training is delivered to ensure that workers don’t fall for phishing attacks, trigger malware, use strong passwords and do all they can to mitigate threats across the business.

3. Track and trace your cloud resources

The cloud can seem like an endless void where data goes, but every byte and destination must be tracked to protect the business. Gaining visibility across your entire cloud environment (whether that’s hybrid or multi-cloud) is vital to building a strong cloud security posture.

With that visibility growing, it’s easier to identify risks and weak points, allowing for the creation of strong security controls. You can also use it to detect cloud misconfiguration events that create further vulnerabilities.

Due to the vast nature of cloud footprints, much of this can be automated by modern cloud security tools.

4. Deploy the right tools for cloud security

As the CCoE acquires solutions like next-generation firewalls, cloud access security brokers (CASBs), and web honeytraps, it must share best practices and understanding of the cloud, its benefits and weaknesses, across the workforce.

Cloud security requires a different toolset to the traditional on-premises set of firewall, antivirus, network intrusion and VPN tools. When data and services reside in the cloud, the focus switches to authentication of users, security of the devices they use to access data and protecting files from abuse.

Key tools for enterprise cloud security include:

• Endpoint defense
• Next-generation firewall
• Workload security
• CASB
• Cloud architecture and security assessment services

Providers often package several tools in a suite to provide a broader level of protection. They are often deployed as SaaS products, but some can be deployed on-premises for regulated industries or those who need closer control.

Most solutions are targeted at SMBs up to enterprise through various product tiers. But finding the right one requires a level of IT security expertise, either through highly-qualified internal resources or security professional partners that can deliver the key insights to make the cloud a safer place for the business to operate.

With the right tools, visibility into what goes on in the cloud and the rules to enforce good behavior, any company can thrive in the cloud. Not doing so will inevitably lead to problems that could cause major operational and reputational damage to a business.

Further reading:

• The Cloud Security Maturity Index: How Secure is Your Cloud?
• The State of Cloud Security 2021 [Infographic]
• Understanding Cloud Security Responsibilities and Best Practice
• Cloud Tokenization vs. Cloud Encryption: What's the Difference?