Why a Cloud First Strategy Leaves the Door Open to Hackers

Why a Cloud First Strategy Leaves the Door Open to Hackers

Kicking off a cloud-first strategy without considering security measures can cloud your judgement

"Cloud first" has been the mantra of the better part of the last decade for many businesses. The argument, as it goes, is that the only way forward is to focus on building your business with cloud computing at the forefront of your efforts. And while the cloud may be paramount in offering previously unavailable efficiencies and capabilities, kicking off a cloud-first strategy without considering security measures can cloud your judgement.

Many companies operate with a tunnel vision, quickly jumping to adopt cloud technologies without understanding the nuances and implications. Saving on equipment and administration costs are tempting features for any business' bottom line, but with eyes on this prize, they often gloss over a critical aspect: security. For a business that has never been hacked, existing security protocols seem sufficient, but moving to the cloud presents a new range of security challenges. Companies that opt for a cloud-first strategy risk leaving themselves exposed.

Before making the leap to the cloud, there are several facets of cloud technologies that companies need to understand so that the benefits—reduced costs, ease of use, lower IT overhead, easy scalability and more—are not realized at the peril of potentially business-ending breaches.

From the Ground Up

Businesses don’t need to reinvent the wheel by forging their own cloud computing environment. They just need a firm understanding around today’s technology. The cloud is named such because it spreads data over many servers housed in different locations, like water droplets in a cloud. The ones and zeros that make up your spreadsheets, intellectual property and compute live in various places in massive, climate-controlled server farms. Whether you are using Infrastructure-as-a-Service (IaaS), like cloud storage and compute, or Software-as-a-Service (SaaS), such as productivity apps, these server farms communicate through networks, responding to requests for compute resources, data, sharing and storage. Because these server farms use networks, vulnerabilities inherently exist.

While cloud technology companies have gone to great lengths to secure data and connections, there is an ongoing battle against hackers. Some cloud security risks are due to a provider's mistake, like last year's $30 million Ethereum theft, while others are not a provider’s fault with the onus elsewhere, like the recently discovered Meltdown and Spectre bugs in processor chips. And then there are the many connections between users and data that can be compromised, exacerbated by a roaming workforce, mobile devices and malware that arrives through email, web or other routes. These alternative entry points don't require hacking into networks because users can unwittingly open the door for them through infected email attachments.

Security First

Cloud providers often market their products as upgrades from the vulnerability and intense labor of in-house servers and this is true to a great extent. But, they openly warn users of these services that cloud services, of any type, is a shared responsibility model for security and compliance. The service provider is responsible for the security of their platform, but not the security of your information, guest operating systems and instances that reside on their platform. That is your responsibility!

As many businesses are undergoing digital transformations, a growing number of professionals are turning to specialized certifications in cloud security. Organizations like the Cloud Security Alliance and others offer trainings and up to date news on pressing cloud security issues as well as techniques to protect cloud environments. Cloud security pro's need to understand technologies such as virtual private clouds, security groups, administrative APIs, micro-segmentation, serverless apps,  microservices, instance and formation templates, CloudTrail and Stackdriver to name a few.

Whether your company hires or contracts out, it is important that any cloud security personnel you bring on board has the right credentials and has studied the unique challenges that your digital changes present. A proper cloud security strategy should correspond to your company’s actions, risk tolerance, and take into account the benefits offered by any of your cloud providers. Then this strategy should be supplemented with a layered approach involving in-house and SaaS solutions dedicated to maintaining the integrity and safety of your data and information.

Visibility Driven Cloud Security

The most important step in moving anything to the cloud is to prioritize security in tandem with a migration. The cloud environment requires constant visibility, monitoring and vigilance. Breaches can come from anywhere at any time. For example, the Sony breach came from an employee pulling an email out of their junk folder and opening the infected attachment. And the Target breach came from a subcontractor's connection to the payroll system. More recently, organizations are suffering from data exposure in the cloud due to open shares, such as the Verizon partner incident. Adversaries have taken note as well, adopting cloud infrastructure providers as their C2 nodes, cloud storage providers as their exfil location, and microservices and serverless apps to perform actions that are difficult at best to perform incident response and forensics against.

With the cloud spreading data over a wide range of providers, solutions that look only at one aspect of a system are of little value providing limited visibility and creating a security gap. Effective monitoring looks at all the connections via network monitoring, computing resources via logs and the data itself. Breach analytics solutions that monitor the perimeter (north/south), the traffic within your infrastructure (east/west), your workforce, whether they are in or out of the office, as well as the application provider layer is the only standard going forward and needs to be put in place to digitally transform securely.

Cloud First Missing Security

A cloud first strategy is understandable, but it isn’t smart. Making the most of the cloud’s cutting edge technologies can save money and time, but jumping in without first laying the proper groundwork for security leaves businesses vulnerable to breaches and data loss. Instead, prioritize security by arming yourself with information about the cloud and its vulnerabilities then take measures to keep your data secure through ongoing monitoring.

Featured

  • Allegion, Comfort Technologies Implement Mobile Credentials at the Artisan Apartment Homes in Florida

    Artisan Apartment Homes, a luxury apartment complex in Dunedin, Florida, recently transitioned from mechanical keys to electronic locks and centralized system software with support from Allegion US, a leading provider of security solutions, technology and services, and Florida-based Comfort Technologies, which specializes in deploying multifamily access control, IoT devices and software management solutions. Read Now

  • Mall of America Deploys AI-Powered Analytics to Enhance Parking Intelligence

    Mall of America®, the largest shopping and entertainment complex in North America, announced an expansion of its ongoing partnership with Axis Communications to deploy cutting-edge car-counting video analytics across more than a dozen locations. With this expansion, Mall of America (MOA) has boosted operational efficiency, improved safety and security, and enabled more informed decision-making around employee scheduling and streamlining transportation for large events. Read Now

  • Security Industry Association Launches New “askSIA” AI Tool

    The Security Industry Association (SIA) has unveiled a brand-new SIA member benefit – askSIA, a conversational AI agent designed to help users get the most out of their SIA membership, easily access SIA resources and find the latest information on SIA’s training and courses, reports and publications, events, certification offerings and more. SIA members can easily find askSIA by visiting the SIA homepage or looking for the askSIA icon in the top left of webpages. Read Now

    • Industry Events
  • Industry Embraces Mobile Access, Biometrics and AI

    A combination of evolving workplace dynamics, technology innovation and new user expectations is changing how people enter and interact with physical spaces. Access control is at the heart of these changes. Combined with biometrics and AI, mobile access control has become increasingly crucial for deploying entry solutions that are seamless, secure and adaptive to user needs. Read Now

  • Sustainable Video Solution Delivered for Landmark City of London Office Development

    An advanced, end-to-end video solution from IDIS, with a focus on reducing waste and costs, has helped a major office development in the City of London align its security with sustainability objectives. Read Now

New Products

  • HD2055 Modular Barricade

    Delta Scientific’s electric HD2055 modular shallow foundation barricade is tested to ASTM M50/P1 with negative penetration from the vehicle upon impact. With a shallow foundation of only 24 inches, the HD2055 can be installed without worrying about buried power lines and other below grade obstructions. The modular make-up of the barrier also allows you to cover wider roadways by adding additional modules to the system. The HD2055 boasts an Emergency Fast Operation of 1.5 seconds giving the guard ample time to deploy under a high threat situation.

  • A8V MIND

    A8V MIND

    Hexagon’s Geosystems presents a portable version of its Accur8vision detection system. A rugged all-in-one solution, the A8V MIND (Mobile Intrusion Detection) is designed to provide flexible protection of critical outdoor infrastructure and objects. Hexagon’s Accur8vision is a volumetric detection system that employs LiDAR technology to safeguard entire areas. Whenever it detects movement in a specified zone, it automatically differentiates a threat from a nonthreat, and immediately notifies security staff if necessary. Person detection is carried out within a radius of 80 meters from this device. Connected remotely via a portable computer device, it enables remote surveillance and does not depend on security staff patrolling the area.

  • Camden CV-7600 High Security Card Readers

    Camden CV-7600 High Security Card Readers

    Camden Door Controls has relaunched its CV-7600 card readers in response to growing market demand for a more secure alternative to standard proximity credentials that can be easily cloned. CV-7600 readers support MIFARE DESFire EV1 & EV2 encryption technology credentials, making them virtually clone-proof and highly secure.