According to Sophos, 70% of organizations hosting data in the public cloud experienced a security incident in 2020 with multi-cloud organisations reporting twice as many incidents as single-platform users. 61% of South African businesses were hit by a public cloud security incident with the majority of the attacks using stolen credentials.
There is no doubt that COVID-19 had something to do with these scary statistics. Consider these headlines:
- Bizjournals.com: “Cyberattacks on the rise during the Covid-19 pandemic“
- Government Technology: “How Is Covid-19 Creating Data Breaches?“
- BBC: ”Coronavirus: How the world of work may change forever“
- Interpol. int: “INTERPOL report shows an alarming rate of cyberattacks during COVID-19“
- Techxplore.com: “Ransomware surge imperils hospitals as pandemic intensifies“
- PR Newswire: “Top Cyber Security Experts Report: 4,000 Cyber Attacks a Day Since COVID-19 Pandemic“
- ZDNet: ”COVID-19 pandemic delivers an extraordinary array of cybersecurity challenges“
- Maritime Executive: ”Maritime Cyberattacks Up by 400 Percent“
Many businesses have already made the move to the public cloud and haven’t looked back. Especially in the age of remote working. However, the rapid move there has brought with it what cyber-security experts are calling a growing “cyber pandemic”. According to CNBC, the UAE had an astounding 250% increase in cyber-attacks.
As the dominance of cloud computing grew in businesses globally during 2020, so did the security risks. Businesses worldwide moved everything from infrastructure to applications to full outsourcing using cloud providers such as Microsoft and Google.
As SC Magazine points out in this piece, “As companies scramble to the cloud, security takes centre stage.”
Businesses that run any of their IT in the cloud need to desperately evaluate their cloud security. One of the methods is to look at the 4 pillars of Cloud Security as outlined by GCN, an America Public ICT Sector Publication.
Covered in this article:
The 4 Essential Pillars of Cloud Security
As businesses increase their cloud adoption, they need to take the same approach to security as they do for their on-premise IT infrastructure. Understanding these 4 pillars, as mentioned by GCN, and how they work together are essential for businesses to create robust cloud security in their organisations.
Visibility and Compliance
An effective cloud security solution should give continuous insight into the businesses cloud environment. 3 key steps should be followed here:
- Asset Inventory – every business should have an inventory of what it has in the cloud: servers, users, cloud tools, cloud provider services etc. This becomes increasingly important when businesses are using multi-cloud solutions from various providers.
- Use available security frameworks such as ISO/IEC 27001, an internationally recognised framework and controls designed to implement and maintain IT security.
- Data Security – every effective security solution should accurately label data according to its level of sensitivity, where it may be stored, if it is publicly exposed and who may access it. Most cloud providers, like Microsoft, provide these tools within their platforms.
Compute-based Security
Businesses need to provide security for end systems, managed services and different workloads running in the cloud. This has 2 key components to it:
- Automated vulnerability management – identifying and preventing vulnerabilities across the application lifecycle.
- Ongoing operational security – effective cloud security requires inspecting activity automatically and ongoing detection of anomalies or malicious activity. The Turrito network monitoring service does exactly this.
Network Protection
Protecting cloud environments is equally as important as protecting on-premises environments. There are 2 aspects to network protection:
- Micro-segmentation – micro-segmentation is a method of creating zones to isolate workloads from one another and secure them individually. By doing this, businesses make it difficult for attackers to move from one infected host to another.
- User-level protection – rather than having one “border” around the cloud as you would with a traditional on-premises infrastructure, user-level network protection extends the border down to the user. This means that only authorised users can access cloud data that they need while providing threat visibility on the activities they are doing.
Identity Security
Identity security requires mapping users and machine identities to what they are authorised to do on the cloud network. A good cloud security solution would include user access and authority levels only on applications and files that the user requires to do their job.
During this unpredictable time of remote work, as businesses are increasing cloud adoption, shifting IT practices, while continuing to face persistent cyber adversaries, implementing a holistic framework that includes each pillar is key for greater cloud security and achieving a zero-trust network. Speak to Turrito today about your cloud-based security needs.
