Cloud can cut your security risks

SMART Cybersecurity Handbook 2022 Information Security

It may seem counter-intuitive, but organisations can better guard against today’s constant wave of security threats – or at least reduce some of their risk burden – by accelerating their move to the cloud, rather than stalling it. Simply put, using public cloud services shifts some of the responsibility for the underlying infrastructure onto the providers. And all of them are highly motivated to keep on top of security.

Furthermore, public cloud environments attract greater scrutiny from vulnerability-hunters than private ones do and this bolsters the fight to stay protected. The way your organisation runs patching in the cloud can also make security easier, as some aspects can be shifted to the provider altogether and others can take place without impacting your service availability.

This last point about patching is particularly important. The statistics on the root cause of major incidents that used software vulnerabilities to succeed show that it’s common to see exploits of vulnerabilities that are more than 12-months old. In fact, almost half of the organisations who had a data breach in the last two years said it had occurred because a patch was available but not applied, according to research from Ponemon/IBM.

Ignoring patches

This tells us that, even though organisations know that patching is important, many are ignoring specific, non-critical risks and instead are choosing to keep their software several releases behind the latest version. There are many understandable reasons for this – such as a lack of capacity for testing, concerns about service interruptions or simply being overwhelmed by the sheer number of patches released by vendors. But moving to the cloud is an opportunity to change this pattern without incurring any of these less desirable results.

When you work in the cloud you can shift the accountability for patching some aspects of your infrastructure to your service providers. Often, they use software-defined mechanisms for patching which don’t interrupt your services. You may not even notice updates happening.

Equally, where you’re using cloud to run software that you’re accountable for, there are ways to keep critical services up to date more easily. You can use the elasticity of cloud to take individual components out of service without impacting availability – if they’re designed correctly.

Patching alone, however, is not enough to protect against attack. It’s common for the attackers to set up alternative access methods in preparation for the next stage in the intrusion to achieve persistence or maintain their foothold. When an organisation is dealing with ‘a hole in the fence’, such as the 2021 Microsoft Exchange Server vulnerabilities, of course patching is important. But that’s not the only thing to do, or even the most important element.

The incentive of public scrutiny

Understanding whether you have been compromised in any way is critical. In general, the large common cloud systems bring two clear positives. First, that such systems are public and accessible to all and second, that the incentive to fix them if something goes wrong is very high. Often, this makes them safer than personal or organisation-specific cloud systems.

One of the key strengths for the cloud provider’s defending team is the responsible disclosure process, where researchers from the security research community give the vendor advance notice of their findings (typically three months). This gives the vendor time to investigate the issue and issue a fix. Then the researcher can go public with their work.

Secondly, with so many of their customers reliant on shared common systems, the pressure on vendors to fix their systems – either proactively before an attack, or very quickly afterwards – is immense.

The service model

To gain real advantage from operating in a cloud-based world, though, organisations need to re-imagine their solutions, building them out of reusable Platform as a Service (PaaS) components or Software as a Service (SaaS) modules. No matter where you are on your journey to the cloud or what your current level of cyber maturity is, it’s important to start by recognising two factors:

• Securing the cloud is not the same as securing your own infrastructure.

• Traditional security architectures don’t translate well to an edge-based, connect-from-anywhere, cloud-first model.

Additionally, it’s important to understand that not all the risks and responsibilities shift to the cloud provider. For example, you will still need to bring in external tools and services to assess and report on the security of your cloud services, while continuing to keep a clear overview of where and how your data and assets are stored.

We’re as such not advocating a ‘rip and replace’ strategy to hitch your organisation to the latest security technology bandwagon. It’s important to realise that many of your existing security controls will remain effective. Rather, you should focus on the gaps that are a priority for your organisation and leverage a move to the cloud to secure these.




Share this article:
Share via emailShare via LinkedInPrint this page



Further reading:

Highest increase in global cyberattacks in two years
Information Security News & Events
Check Point Global Research released new data on Q2 2024 cyber-attack trends, noting a 30% global increase in Q2 2024, with Africa experiencing the highest average weekly per organisation.

Read more...
There is a SaaS for everything, but at what cost, especially to SMEs?
Editor's Choice Information Security Security Services & Risk Management
Relying on SaaS platforms presents significant cybersecurity risks as the number of providers in your landscape increases, expanding your attack surface. It is important to assess the strength of the SaaS providers in your chain.

Read more...
Addressing today’s mining challenges: cyber risks beyond IT
Editor's Choice Information Security Mining (Industry)
Despite the mining industry’s operational technology systems being vulnerable to cyberattacks, many decision-makers still see these threats as purely an IT issue, even though a breach could potentially disrupt mining operations.

Read more...
Get proactive with cybersecurity
Information Security
The ability to respond effectively to a cybersecurity breach is critical, but the missing piece of the puzzle is a thorough, proactive evaluation to ascertain weaknesses and identify any hidden threats.

Read more...
How to effectively share household devices
Smart Home Automation Information Security
Sharing electronic devices within a household is unavoidable. South African teens spend over eight hours per day online, making device sharing among family members commonplace. Fortunately, there are methods to guarantee safe usage for everyone.

Read more...
How to securely manage your digital footprint
Information Security Training & Education
Managing your online presence is critical to safeguarding your privacy and security. It is imperative to take a proactive approach, including using robust cybersecurity best practices.

Read more...
The state of code security in 2024
Information Security
The 2024 State of Code Security survey reveals that organisations have continued to shore up application security defences over the last year, according to OpenText Premier Partner iOCO Application Management.

Read more...
What is the level of safety and integrity of the software supply chain?
Information Security IoT & Automation
Organisations are embracing AppSec practices and focusing on their software security posture. However, they highlight that insufficient funding and security resources, plus a disconnect between developers and security teams, remain major roadblocks.

Read more...
Cybercriminals target financial service providers to get at sensitive client data
Information Security
According to Ryan van de Coolwijk, Product Head for cyber at iTOO Special Risks, hackers target financial service providers because they hold sensitive client information that unauthorised individuals could use for fraudulent activities.

Read more...
Fortinet establishes new point-of-presence in South Africa
News & Events Information Security
Fortinet has announced the launch of a new dedicated point-of-presence (POP) in Isando, Johannesburg, to expand the reach and availability of Fortinet Unified SASE for customers across South Africa and southern African countries.

Read more...