As the use of cloud among companies grows , the amount of data stored in it naturally also increases. Those who use cloud services, regardless of the model they use ( IaaS, PaaS, or SaaS ), must always remember that data security is primarily their responsibility, not of the cloud provider.
In addition to the possibility of compromising data, other risks can be linked to cloud services and should not be overlooked. Citrix , which designs and promotes new ways of working through digital and secure workspaces, highlights the main five aspects that every company must consider when deciding to adopt cloud technologies.
1 - The failure of data governance
Managing data in a cloud environment is like managing it in an on-premise environment. In both cases, in fact, the goal is to prevent access to unauthorized users. Cloud service providers tend to develop perimeter firewalls, control access and offer encryption and monitoring tools to protect data in their systems. However, it is the customer's responsibility to understand and implement the necessary security measures. Furthermore, the place where data resides relative to geographical boundaries can play a key role in cloud strategy and governance. For example, the GDPR, the new European law for privacy and security, requires that data controllers apply due care when using them within the European Union and non-compliance may result in a substantial fine. Cloud service providers must ensure that data resides within the geographical borders of the European Union. In the event that the data should instead be stored across the border, this must be clearly stated and the holder must give its consent.
Managing data in a cloud environment is like managing it in an on-premise environment. In both cases, in fact, the goal is to prevent access to unauthorized users. Cloud service providers tend to develop perimeter firewalls, control access and offer encryption and monitoring tools to protect data in their systems. However, it is the customer's responsibility to understand and implement the necessary security measures. Furthermore, the place where data resides relative to geographical boundaries can play a key role in cloud strategy and governance. For example, the GDPR, the new European law for privacy and security, requires that data controllers apply due care when using them within the European Union and non-compliance may result in a substantial fine. Cloud service providers must ensure that data resides within the geographical borders of the European Union. In the event that the data should instead be stored across the border, this must be clearly stated and the holder must give its consent.
Another often overlooked aspect of data management in the cloud is their conservation lifecycle. The storage components held by the providers are offered to customers as part of the service. Data is usually distributed over several storage units for reasons of redundancy, but in this fragmented scenario, the customer cannot be sure that the provider has correctly deleted the data. In fact, most providers struggle to offer a secure method of deleting data and, in any case, the responsibility is ultimately the owner.
2 - Greater complexity and lack of training
Cloud service providers must be able to provide their customers with ease of use and a quick return on costs. However, migrating from an on-premise environment to a cloud results in a higher level of operational complexity for the IT departments of companies. IT staff may not have experience in managing and servicing cloud services and this would require specific and adequate training.
Cloud service providers usually offer an encryption solution for customer IT departments. These solutions are different from each other. Microsoft Azure offers Azure Storage Service Encryption, while Amazon Web Services offers EBS Volume Encryption. All this complexity in the learning curve can lead to security gaps in cloud and multi-cloud hybrid implementations and therefore it is necessary to adequately train IT teams and push the provider to install their solution in the most effective and efficient way. In addition, the corporate IT team should develop a strong operational policy before moving to a cloud-based model.
2 - Greater complexity and lack of training
Cloud service providers must be able to provide their customers with ease of use and a quick return on costs. However, migrating from an on-premise environment to a cloud results in a higher level of operational complexity for the IT departments of companies. IT staff may not have experience in managing and servicing cloud services and this would require specific and adequate training.
Cloud service providers usually offer an encryption solution for customer IT departments. These solutions are different from each other. Microsoft Azure offers Azure Storage Service Encryption, while Amazon Web Services offers EBS Volume Encryption. All this complexity in the learning curve can lead to security gaps in cloud and multi-cloud hybrid implementations and therefore it is necessary to adequately train IT teams and push the provider to install their solution in the most effective and efficient way. In addition, the corporate IT team should develop a strong operational policy before moving to a cloud-based model.
3 - Configuration errors
The incorrect configuration of a system is a rather common security risk. To differentiate themselves from the competition, cloud service providers use one-click deployment models, where the complexities of the configuration are hidden. Since the configuration at the customer must be done after deployment, a lack of technical understanding can cause errors or omissions.
This type of risk can be strategically managed by planning security before deployment, and not thinking of it as something to be added later. Client companies must obtain design and deployment assistance from the provider to ensure that cloud services are configured in the best way. Constant auditing and testing should be part of the strategy to discover any security gaps and ensure good health of cloud services.
4 - Multi Tenant and lack of availability
Cloud service providers offer different cloud-based architectures like private clouds, hybrid or multi-cloud couds. This variety normally has the goal of having multiple clients in a single physical cloud architecture, or data centers located in different locations. Regardless of the type of architecture, the providers strive to confine each tenant in its enclave and to ensure that the use of common resources does not harm others.
An important fact is that it is impossible to draw a clear line between technical and business aspects because they tend to influence each other and the failure of one of them can cause a domino effect. Cloud service providers provide all the logical and physical security controls that are needed, a secure enclave for each tenant and multiple domains to mitigate the risks we've talked about. Users should perform their due diligence to understand the potential impact of a multi tenant environment and the risk mitigation strategies offered by the provider.
5 - Cryptojacking
The recent growing trend of cryptocurrencies brings with it a new kind of threat called cryptojacking. Cryptocurrencies such as Bitcoins indeed require high processing capacity and this has led cyber criminals to target cloud service providers. These new attack vectors operate in a hidden way, exploiting the processing resources to enrich malicious users.
Although this may in some ways seem harmless because no data of any kind is compromised or deleted, it is nevertheless a danger because the security boundaries of the cloud are eroded to insert malicious code by opening the doors to other similar and potentially harmful methods. Cryptojacking attacks have grown by 141% since 2017, with the most serious affecting Tesla's account on Amazon Web Services with illegal cryptocurrency mining access embedding the script in AOL's advertising platform. Incorrect configurations and social engineering are the two methods used by cyber criminals to transfer the cryptojacking code to the target.
The incorrect configuration of a system is a rather common security risk. To differentiate themselves from the competition, cloud service providers use one-click deployment models, where the complexities of the configuration are hidden. Since the configuration at the customer must be done after deployment, a lack of technical understanding can cause errors or omissions.
This type of risk can be strategically managed by planning security before deployment, and not thinking of it as something to be added later. Client companies must obtain design and deployment assistance from the provider to ensure that cloud services are configured in the best way. Constant auditing and testing should be part of the strategy to discover any security gaps and ensure good health of cloud services.
4 - Multi Tenant and lack of availability
Cloud service providers offer different cloud-based architectures like private clouds, hybrid or multi-cloud couds. This variety normally has the goal of having multiple clients in a single physical cloud architecture, or data centers located in different locations. Regardless of the type of architecture, the providers strive to confine each tenant in its enclave and to ensure that the use of common resources does not harm others.
An important fact is that it is impossible to draw a clear line between technical and business aspects because they tend to influence each other and the failure of one of them can cause a domino effect. Cloud service providers provide all the logical and physical security controls that are needed, a secure enclave for each tenant and multiple domains to mitigate the risks we've talked about. Users should perform their due diligence to understand the potential impact of a multi tenant environment and the risk mitigation strategies offered by the provider.
5 - Cryptojacking
The recent growing trend of cryptocurrencies brings with it a new kind of threat called cryptojacking. Cryptocurrencies such as Bitcoins indeed require high processing capacity and this has led cyber criminals to target cloud service providers. These new attack vectors operate in a hidden way, exploiting the processing resources to enrich malicious users.
Although this may in some ways seem harmless because no data of any kind is compromised or deleted, it is nevertheless a danger because the security boundaries of the cloud are eroded to insert malicious code by opening the doors to other similar and potentially harmful methods. Cryptojacking attacks have grown by 141% since 2017, with the most serious affecting Tesla's account on Amazon Web Services with illegal cryptocurrency mining access embedding the script in AOL's advertising platform. Incorrect configurations and social engineering are the two methods used by cyber criminals to transfer the cryptojacking code to the target.
