Securing the Cloud: How to Protect Your Business’ Data

The number of businesses moving operations into the cloud is continuing grow. Recent figures estimate that 96 per cent of organisations use the cloud one way or another.

Platforms like Amazon Web Services (AWS) and Microsoft Azure plus cloud services such as Office 365 and G-Suite are more widely utilised than ever.

However, as more and more organisations utilise cloud environments they need be aware of the cyber security risks. Here we take a look at why a business might move to the cloud, and some of the challenges of protecting data and assets there.

The advantages of moving to the cloud

Many companies could still be making better use of cloud services and integrating them into their current infrastructure to enjoy a huge range of benefits. Whether you are looking to reduce costs, increase productivity or a quick and easy way to scale up infrastructure, these are all things that using cloud platforms can offer.

On average, businesses currently spend a large proportion of their IT budget on maintaining their internal systems. Paying for servers and in-house IT specialists can become prohibitively expensive, especially as the needs of your organisation change over time. With cloud servers and storage, you only pay for what you need and the maintenance is taken care of by your provider. This can see a huge reduction in cost for your IT services, as well as having the benefit of making your infrastructure more easily scalable.

New security challenges

Many organisations moving operations to the cloud are doing so without fully considering the implications for their cyber security however. Indeed, many organisations naturally assume that any data they upload to the cloud is automatically secure – assuming that their cloud provider takes full responsibility for data security. However, this is not the case. Take the example of AWS – under its Shared Responsibility model, Amazon physically secures its infrastructure, but customers are still responsible for the overall security of their data and applications.

Another problem for businesses is that many don’t employ experts experienced in cloud security. This can lead to data and assets being unnecessarily exposed. One common security issue affecting AWS customers, for instance, is misconfigured S3 buckets. This is a common vulnerability which can be very easily identified, however, often goes unaddressed because of a lack of awareness.

Complying with the GDPR

With GDPR compliance so important, organisations must stay mindful of security risks. Under the GDPR, providers of cloud infrastructure are considered Data Processors whereas companies using cloud infrastructure and services are Data Controllers, and must therefore maintain control over any personal data hosted.

Steps you can take to protect your data in the cloud

To ensure the security of your data in the cloud, there are a number of key steps that your business can take. It is often advisable to work with experienced cyber security professionals, as every organisation will have different needs dependent on the platforms and systems in use. Nevertheless, here are some things that your business can do to help keep data secure:

– Regular vulnerability scanning – these scans allow you to identify and remediate weaknesses before cyber criminals can exploit them. A vulnerability scan across your cloud environments will help to identify assets at risk and vulnerabilities, such as those resulting from misconfigurations
– Penetration testing – cyber security experts use the same human-driven techniques employed by criminal hackers. Penetration tests can be used to evaluate networks, systems, web applications and the effectiveness of incident response procedures
– Proactive cloud monitoring – it’s no longer enough to be reactive to cyber threats. Security monitoring technologies such as SIEM help organisations to detect threats in their infancy by analyse cloud network traffic and event logs in order to identify indicators of compromise. Some SIEM solutions can centralise your public cloud, private cloud, virtual and on-premises security monitoring through a single security solution.

“Tailored to your business requirements, ThreatDetect enables your business to benefit from powerful cloud security technologies including SIEM, Intrusion Detection and Vulnerability Scanning, and Endpoint Analytics.
Combined with certified security expertise and integrated threat intelligence, these systems can help maximise your organisation’s ability to detect and respond to the latest cyber threats as well as achieve compliance with regulations such as PCI DSS and the GDPR.”
Cloud security monitoring and monitoring specialists, Redscan.

– Employee training – it is important to provide your staff with the security knowledge and guidance they need. To protect both themselves and your business. Employees are an important line of defence against cyber-attacks, and if they don’t understand best practices, it can leave gaping holes in your security

– User management – where possible, you should enable role-based access control features to restrict access to cloud environments and files (based on segregation of employee duties). Use of multi-factor authentication can also help to minimise the risk of staff accounts being used for malicious activity.