The cloud is the newest frontier of the digital space, but with every new frontier comes new and unforeseen dangers. Businesses that depend on the cloud for storing their data have run into a number of problems regarding how to secure that data.
According to Gartner, as much as 95 percent of data breaches occurring on public cloud server through to 2022 are likely to be because of the customer. So how do we secure our cloud data to avoid ending up within this statistic?
Encrypting Data Regardless Of Where It Is
Encryption is a useful tool to ensure that data doesn't get waylaid on its way from server to client. Based on the definition by Digital Guardian, we can say that encryption is a method of garbling a message so that it can only be understood by someone who has the correct key to restructure that message and make sense of it.
Most of the data that we encrypt is stationary or "at-rest" data. This refers to data that is stored on local disks or physical storage. The more interesting usage of encryption is by using it with "in-flight" data or data that is being transferred over a network or stored on a cloud server. This ensures that the data is secure until the person who needs to access it presents it with the decryption key. Generally, encryption uses TLS/SSL connections or IPsec VPN tunnels to create encrypted channels of communication for in-flight data. Businesses can seek to utilize this methodology when securing their data on the cloud.
Closed Access Security Broker (CASB) Methods
The direction that many companies decide to go when it comes to securing their cloud data is by employing a CASB, managed through an API. Because of the scalability of an API-based CASB, they tend to be adaptable, and able to be deployed in both small and large use cases. What a CASB seeks to do is to monitor network activity and to limit high-risk operations such as downloading of files and information distribution from the unsecured Internet.
Many cloud vendors have moved toward making CASBs available as part of their included offerings for business customers. The CASB system is defined on a per-user basis so that even if a user tries to access the data through their personal device, the same security measures would be applied to that device in keeping with what that particular user is allowed to access. Computer World notes that a CASB is especially useful in the case where a company's security perimeter only reaches the edge of the company's network and data from the business' server is being accessed outside of the company.
Micro-Segmentation And Limited Access Paradigms
One of the best ways to ensure security of data is to allow a user "just enough access" (JEA) to the devices and the data that they need to be functional. This is a useful methodology to implement in smaller companies where the amount of users is reasonable and the amount of data can be relatively small. However, as data and employee numbers grow, this methodology becomes unsustainable without a lot of investigation into which users need access to which data and why.
The benefit of this system is that it limits the area in which a breach can occur. The data within the breach during cloud computing attacks may be compromised, but the bulk of the data and network will be left untouched. Accounts that have privileged access tend to get extra scrutiny in this type of setup since those accounts have access to more of the data that the company holds than other types of accounts. This type of security is ideal for a small business, but as the business grows, the system will become untenable.
Monitoring Traffic And Domain Audits
The traffic in and out of a system as well as what is utilizing that traffic is of great significance when it comes to publicly held cloud data. A number of metrics can be tracked with regards to access, ranging from the type of user accessing the account to what sort of data is being used by a particular user at a particular time. By tracking these audits and comparing them to what is considered average, abnormal access can be found and limited.
The downside of this system is that it may lead to false positives if a user has to access a particular data set repeatedly in order to perform a task. Still, it can be very useful in determining where data beaches are occurring and tracing leaks before they become dangerous to the organization.
Cloud Resource Backups
A business should always have a plan of action for backing up cloud data. In the event of a breach, cloud data is not guaranteed to still be there at the end of it. Frequent backups are necessary to ensure that data is preserved even if the cloud is compromised. While not strictly a security measure (since the breach would still occur), it allows the company to be able to operate independently of the breached data, even ensuring that if ransomware were to propagate on the system, it could be removed completely with no ill-effects to the existing data.
Managing Risk In The Cyber Space
Just like any other frontier, the cloud space can be full of dangers. Taking proper precautions in securing data and access is necessary for any company that aims to ensure that their data remains unharmed. While there is no 100 percent guarantee of security, taking measures allows a company to feel a lot safer regarding its public cloud data. Knowing who accessed the data and when it was accessed is useful, but if there's no way to prevent unauthorized access, then is it even worth knowing these minor details?
