Cloud computing has become a prevalent force, bringing economies of scale and breakthrough technological advances to modern organisations, but it is more than just a trend. Cloud computing has evolved at an incredible speed and, in many organisations, is now entwined with the complex technological landscape that supports critical daily operations.
This ever-expanding cloud environment gives rise to new types of risk. Business and security leaders already face many challenges in protecting their existing IT environment. They must now also find ways to securely use multiple cloud services, supported applications and underlying technical infrastructure.
The need to use cloud services securely
The surge in business processes supported by cloud services has been well evidenced by organisations using cloud services store confidential data in the cloud environment. But when using cloud services, organisations are still unsure whether to entrust cloud service providers (CSPs) with their data. CSPs generally provide a certain level of security as substantiated by multiple surveys, but cloud-related security incidents do occur.
CSPs cannot be solely responsible for the security of their customers’ critical information assets. Cloud security relies equally on the customer’s ability to implement the right level of information security controls. Nevertheless, the cloud environment is complex and diverse, which hinders a consistent approach to deploying and maintaining core security controls. It is vital that organisations are aware of and fulfill their share of the responsibility for securing cloud services to successfully address the cyber threats that increasingly target the cloud environment.
Key features of cloud services
Organisations have rapidly adopted cloud services, attracted by the ease of procurement, relatively low set-up cost and the opportunity to replace legacy technology that no longer meets business needs. Yet, managing security is no simple task due to the unique and varied features intrinsic to using multiple cloud services.
Cloud services cover a vast range of offerings such as business applications, document storage solutions, databases and virtual servers, which can all be purchased on-demand from a selection of CSPs through a public network, most commonly the internet.
As organisations move to cloud computing to enhance their business operations, they tend to favor the acquisition of cloud services over the expansion of conventional, on-premises IT data centers. Often described as a cloud-first policy, this approach has been adopted by countless organisations. For many organisations, this means that almost their entire IT Infrastructure will eventually be hosted in the cloud environment.
The rise of the multi-cloud environment
As organisations acquire new cloud services, they typically choose these from a selection of multiple CSPs and therefore need to deal with a multi-cloud environment, which is characterised using two or more CSPs.
Organisations favor a multi-cloud environment because it allows them to pick and choose their preferred cloud services across different CSPs (e.g. AWS, Microsoft Azure, Google Cloud, Salesforce). However, each individual CSP adopts its own jargon, its own specific technologies and approaches to security management. The cloud customer therefore needs to acquire a wide range of skills and knowledge to use different cloud services from multiple CSPs securely.
Organisations require a range of different users to securely access cloud services from within the organisation’s network perimeter through secure network connections (e.g. via a gateway). However, organisations also need their cloud services to be accessed from outside the internal perimeter by business partners and users travelling off-site or working remotely, all connecting through a selection of secure network connections as dictated by the organisation.
Overcoming cloud security challenges
While CSPs provide a certain level of security for their cloud services, organisations need to be aware of their security obligations and deploy the necessary security controls. This requires organisations to understand and address the many security challenges presented by the complex and heterogeneous aspects of the cloud environment.
Our ISF members have identified several obstacles to operating securely in the cloud environment. The main challenges include:
- Identifying and maintaining the appropriate security controls
- Balancing the shared responsibility for security between the CSP and the cloud customer
- Meeting regulatory requirements to protect sensitive data in the cloud environment
The rapid explosion of cloud usage has accentuated these challenges and, in some instances, left organisations insufficiently prepared to tackle the security concerns associated with using cloud services.
Balancing the shared responsibility for security between the CSP and the cloud customer
Securing the use of cloud services is a shared responsibility between the CSP and the cloud customer. The security obligations incumbent on the CSP are to protect the multi-tenant cloud environment, including the backend services and physical infrastructure, as well as to prevent the commingling of data between different customers.
While the CSP maintains much of the underlying cloud infrastructure, the cloud customer is responsible for securing its data and user management. Whether the customer’s responsibility extends to performing security configurations for applications, operating systems and networking will depend on the cloud service model selected.
This shared responsibility for security can create confusion and lead to over-reliance on the CSP to mitigate threats and prevent security incidents. It is essential that the cloud customer does not depend wholly on the CSP to deploy the appropriate security measures, but clearly understands how responsibility for security is shared with each CSP in order to identify and deploy the requisite security controls to protect the cloud environment.
Meeting regulatory requirements to protect sensitive data in the cloud environment
An organisation using an on-premises IT data centre will know exactly where its critical and sensitive data resides and can exert full control over the movement of its data. This helps considerably when implementing security controls, whereas in the cloud environment, data moves in and out of an organisation’s perimeter more freely. This can obscure where critical and sensitive data is located, and how it can be protected, which can hinder an organisation’s ability to effectively enforce the requisite security controls across all of its cloud services in line with compliance requirements.
While it is the cloud customer’s responsibility to ensure the security of its data in the cloud environment, the customer’s control over its data is intrinsically limited since the data is stored by an external party – the CSP – in an off-site location, often in a different country. Moreover, the CSPs will often leverage several data centers in geographically distinct locations to ensure the organisation’s data is stored on more than one server for reasons of resilience.
This creates additional complexity in terms of managing data across borders, understanding where it is located at a given moment in time, determining the applicable legal jurisdiction and ensuring compliance with relevant laws and regulations – an obligation that rests fully with the cloud customer, not the CSP.
Maximise potential and take responsibility
Modern organisations must operate at a fast pace, delivering new products and services to stay ahead of the competition. Many are therefore choosing to move ever further towards cloud computing, as the elasticity and scalability offered by cloud services provide the desired flexibility needed to compete. For an organisation to have confidence that it can move to the cloud whilst ensuring that vital technological infrastructure is secure, a robust strategy is required.
The cloud environment has become an attractive target for cyber attackers, highlighting the pressing need for organisations to enhance their existing security practices. Yet consistently implementing the fundamentals of cloud security can be a complicated task due to the diverse and expanding nature of the cloud environment.
This is but one of many challenges that organisations need to overcome to use cloud services securely. Organisations cannot rely purely on CSPs to secure their critical information assets but must accept their own share of responsibility. This responsibility calls for a combination of good governance, deployment of core controls and adoption of effective security products and services. Controls that cover network security, access management, data protection, secure configuration and security monitoring are not new to information security practitioners, but they are critical to using cloud services securely.
Moving forward, organisations can select from a variety of trends and technologies that will enable them to use cloud services securely – from the adoption of new products to the embedding of improved processes, such as a focus on secure containers, where security is given greater emphasis during development.
Assuring that services are used securely will provide business leaders with the confidence they need to fully embrace the cloud, maximising its potential and driving the organisation forward into the future.
Interested in hearing industry leaders discuss subjects like this and sharing their experiences and use-cases? Attend the Cyber Security & Cloud Expo World Series with upcoming events in Silicon Valley, London and Amsterdam to learn more.
