אבטחת מחשוב ענן 101: מהם הסיכונים?

Once seen as an addition to the on-premises data storage solutions, the cloud as a technology has changed a lot since 2002 introduction of Amazon Web Services. It’s estimated that the global spend on cloud services will reach $474 in 2022 with cloud revenue to surpass estimate non-cloud revenue for enterprise IT markets in the next few years and 85% of organisations adopting the cloud-first principle by 2025.  

This unprecedented usage growth for the cloud technology comes at a price, though. Ability to share and access data from anywhere in the world has enabled global businesses to operate and thrive – especially during the Covid-19 pandemic – but it also brought a swarm of cybersecurity risks and issues with 74% of large US companies experiencing a data breach in the last 12 months.  

What are the main reasons for that and how business can make themselves more resilient to cloud security fails?  

Let’s check how secure is the cloud technology supplied by the providers. 

עד כמה מאובטח הענן? 

בקצרה: זה מאובטח מאוד. 

Similarly to other cloud providers, Amazon Web Services now offers full compliance and certification aligned with sector-specific standards such PCI-DSS, GDPR, HIPAA, SOC 2, and many others. The cloud providers have also been continuously implementing solutions and tools that avert or mitigate security threats. They also conduct and are subjected to regular and comprehensive maintenance and security audits as they are – unsurprisingly – interested in the longevity and the reliability of the services. Cloud providers such as AWS (Amazon Web Services) and Azure build secure tools and it is now up to us – their regular users – to use them safely. 

In this article, I’m exploring the topic of the cloud computing security risks. I will also feature actionable advice on how to address these risks from two of our cloud experts: Tomasz Wojciechowski, a newly appointed Head of Cybersecurity at Spyrosoft and our ראש הנדסת הענן, לוקאש מרצ'ינק. 

מהם הסיכונים של מחשוב ענן? 

As you may assume from the introduction, the higher risk level for businesses looking to use or maintain their cloud solutions lies in the so-called ‘human factor’ rather than the lack of reliability from the providers – data shows that 95% of cloud security fails are due to this factor. 

כשלים באבטחת מידע 

If you look at this issue, the most important question is who has access to your company data and to what extent. Hackers look for a vulnerability low-hanging fruits and the aspect of access management is overlooked at most companies.

With multiple users and several cloud environments to manage, making sure that there are no gaps can be difficult, especially for large organisations that use on-demand services with their own systems and tools. To put it simply: if your data is unciphered, shared with many users at once across multiple cloud platforms and not monitored, it is not safe. 

בעיות תאימות 

As stated above, most of cloud providers are compliant and offer certificates for industry-wide data management norms. The services themselves may be secure but it does not mean that you should not worry about internal standard compliance. Make sure that you see compliance as an organisation-wide issue and conduct regular checkups or even use third-party bodies to assess the level of compliance for all your resources, be it internal and external. 

היעדר אסטרטגיית ניהול ריבוי עננים 

Managing multiple cloud solutions at once is not an easy task. If you work at a large global organisation that combines Amazon Web Services with Google Cloud and Microsoft Azure in its projects, developing a procedure on how you will approach the use of such a complex combination is necessary. In this דוח Gartner על מעבר לענן, 81% of companies stated that they already work with two or more cloud providers. 

גישה ל-API ללא אימות 

While using Application Programming Interfaces (APIs) for both external suppliers and your employees will help keep data in sync and automate their processes, this can also mean that your business will be more vulnerable to cyber attacks. Implementing a web application security system, adequate authorisation as well as authorisation protocols will ensure that your data is and stays secure. 

אין מספיק מומחי אבטחת סייבר 

If you have ever tried to hire a cybersecurity specialist, you may be aware of this but let us state it one more time: there is a global shortage in cybersecurity professionals.

As ISC גילו במחקרם, there are currently 3.12 million unfilled cybersecurity roles worldwide. The sector is poised to be the fastest growing tech sector with employment growth rate of 31% in US only according to the data collected by the US Bureau of Labor Statistics. If your organisation is already struggling with this global issue, invest in internal educational schemes and upskilling your employees to ensure that you have enough resources to protect your company data. 

בעיות בשליטה על הפרדת דיירים 

According to Tomasz Wojciechowski, the risk of such a breach is low and although it can happen that is not something that occurs very often. It is worth mentioning nevertheless as tenants’ separation control issues can pose a serious threat to medium-sized and large organisations when many users have access to the same cloud-based resource. Failure to maintain separation between multiple tenants can lead to a vulnerability that – in turn – can be easily spotted and exploited by hackers. 

כיצד להפחית או למנוע סיכונים אלו? 

So, what are the actions that you can take to mitigate or averts these cloud computing risks? Here is a list of best practices from our experts, Lukasz Marcinek and Tomasz Wojciechowski. 

הכשירו את הצוות שלכם 

Using unencrypted file sharing, easy-to-crack passwords and personal hardware such as laptops and mobile phones for work as well as phishing attacks are among the most common missteps made by employees at smaller and larger organisations.

To ensure that your teams will not fall into these traps, conduct regular training sessions and implement regular reminders for potentially hazardous tasks. Regular compliance audits and industry-specific safety standards training may also be necessary. 

השתמשו במתווכי אבטחת גישה לענן (CASBs) 

This reinstates the previous points mentioned above but it is something that is not highlighted enough in the enterprise world, according to our Head of Cybersecurity, Tomasz Wojciechowski. Cloud Access Security Brokers (CASBs) are security policy tools that are implemented to serve as a layer between cloud service users and cloud service providers. Encryption, tokenisation, malware detection, authentication and logging are all examples of such tools. 

ניטור וניהול הנתונים שלך 

According to our Head of Cloud Engineering, Lukasz Marcinek, if you give access to any cloud-based resources to any of your employees or contractors, use עקרון ההרשאה המינימלית. The PoLP is when a user gets the minimum level of access or permissions to complete their work tasks. The so-called ‘privilege creep’ where most or all users get full permissions and unlimited access to all resources is a bad practice. 

פעלו לפי Cloud Adoption Framework 

Every cloud provider has its own Cloud Adoption Framework – including Microsoft ו AWS – and it will be helpful in planning your migration to cloud, your security strategy and even naming your resources. Start by developing your security end state and work from there by mapping to concept and frameworks, assigning roles – with ‘zero trust’ policy ingrained in the assignment roadmap – and drive the change on a business and organisational level. 

פיתוח אסטרטגיית ניהול סיכונים 

I’m mentioning it last but developing a sustainable risk management strategy is no small feat, especially in highly regulated sectors such as Automotive and Healthcare. Depending on your business and organisational goals, you may need to employ a few different risk management tools and techniques, including risk data quality assessment and probability and impact matrixלבנות אסטרטגיה שתוכל לתמוך בחברה שלכם בטווח הארוך. 

קראו גם: כיצד אנו ניגשים לניהול סיכונים ב-Spyrosoft 

תורך 

If you interested in our cybersecurity services or have a project you’d like to discuss, do not hesitate to contact our team via our אתר אבטחת סייבר או ישירות ב-LinkedIn.