Migrating to the Cloud: Security Risks and Concerns

Cloud computing has grown immensely in popularity over the last few years, with experts now predicting the market to be worth more than $800 billion by 2025. The Cloud offers numerous benefits including increased flexibility and convenience as well as room for scaling. However, many companies are still hesitant about Cloud migration because of concerns to do with security.

Working within the Cloud can seem daunting. While a convenient place to hold all your data, it can feel like control and visibility is severely limited, making you question how you’ll both locate your important data and ensure it is all secure.

Most Cloud service providers work on the basis of shared responsibility model, whereby both your company and the service provider will play a part in the protection of your data. These models can vary across providers, so it’s important to know what your team will be responsible for in terms of security before migrating anything. 

Misconfigured Settings

With a shared responsibility model, your company will usually be in charge of making sure security settings are correctly configured. Many organisations are unfamiliar with Cloud infrastructure, leading to oversights and poor configuration, which can, in turn, leave your data vulnerable. Migrating to the Cloud should not be a rushed process, so it’s important to get to grips with security controls you’ll need to implement in order to be compliant and secure before moving any assets. Often, providers will provide recommendations and tools to assist with configuration too.

Data Loss

Over 60% of organisations have said that their biggest concern when transferring data is that it will be incomplete, missing, or corrupt once it reaches its new destination in the Cloud. Backing up data is therefore essential before you move anything, so you can restore any affected data easily. It’s also important to notify all stakeholders before migrating data to avoid interference during the transfer. 

Even once the data is in the Cloud, leakage is still a concern as results of accidental deletion or overwriting of data, and malware. Classifying and labelling data before migration can help to keep track of the most sensitive data and where it will be held in the Cloud, especially as visibility can become more of an issue. Backing up regularly and minimising user access privileges can then be implemented post migration to reduce risk of data loss. 

Compliance

Many industries govern how organisations handle data and security, requiring certain standards and regulations to be met. Some common ones include HIPAA, GDPR, Cyber Essentials, DSS, or ISO 27001. It makes sense then that companies want to ensure migrating to the Cloud doesn’t interfere with this compliance.

Although Cloud computing works on a shared responsibility model, data security and compliance are the organisation’s responsibility so you should make sure your Cloud provider supports security measures you put in place. 

Many breaches of compliance are due to poor access controls, for example allowing someone access to data they shouldn't be able to access. Implementing a strong identity and access management solution can help keep control over these access privileges and ensure highly sensitive data is restricted. As the Cloud becomes more popular, these industry compliance regulations are starting to specifically include Cloud computing in their security requirements, for example ensuring you have multi factor authentication activated for your Cloud accounts. 

Account Hijacking/Cyber Attacks

A final major concern for companies operating within the Cloud, is the risk of account hijacking, when a bad actor may gain unauthorised access to employee accounts. One common way hackers can acquire credentials is via a phishing attack. Once into the account, data may be stolen or held for ransom, with legitimate users locked out. Worst case scenarios can involve bad actors accessing admin accounts giving them the ability to reconfigure core settings. 

Cloud monitoring solutions are an effective way of checking activity across your cloud computing services, detecting any suspicious or anomalous events. It is also best practice to have Multo Factor Authebtication (MFA) switched on for all cloud users so companies should check that their cloud service supports this. Even with these measures, however, it is best to prepare for the worst and this involves having a solid cloud disaster recovery plan in place, so you can minimise damage and downtime should you face a cyber attack. The exact details will vary depending on the business, its data, and the Cloud provider, but may include risk assessments, staff training and backup strategies.

The Cloud is an invaluable tool for businesses, opening up new opportunities for storage, accessibility and collaboration, but it has also brought new security risks and considerations that should be explored fully before migrating. Companies considering the move must choose their Cloud provider carefully, making sure it meets compliance and security requirements, and implement appropriate measures to handle cyber threats. We will likely continue to see the cloud computing market thrive but companies must work to build Cloud security into their wider strategies in order to reduce risk so the numerous benefits can be taken full advantage of. 

Clive Madders is CTO Cyber Tec Security

You Might Also Read: 

Cloud Computing & Security: What Enterprises Should Know:

 

« Companies Going To War On Social Media
Hackers Set Fire To An Iranian Steelworks »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

ZenGRC

ZenGRC

ZenGRC - the first, easy-to-use, enterprise-grade information security solution for compliance and risk management - offers businesses efficient control tracking, testing, and enforcement.

Jooble

Jooble

Jooble is a job search aggregator operating in 71 countries worldwide. We simplify the job search process by displaying active job ads from major job boards and career sites across the internet.

Syxsense

Syxsense

Syxsense brings together endpoint management and security for greater efficiency and collaboration between IT management and security teams.

Resecurity, Inc.

Resecurity, Inc.

Resecurity is a cybersecurity company that delivers a unified platform for endpoint protection, risk management, and cyber threat intelligence.

MIRACL

MIRACL

MIRACL provides the world’s only single step Multi-Factor Authentication (MFA) which can replace passwords on 100% of mobiles, desktops or even Smart TVs.

CERT Polska

CERT Polska

CERT Polska is the first Polish computer emergency response team and operates within the structures of NASK (Research and Academic Computer Network) research institute.

LRQA

LRQA

LRQA are a leading global assurance provider, bringing together unrivalled expertise in certification, brand assurance, cybersecurity, inspection and training.

Kent Interdisciplinary Research Centre in Cyber Security (KirCCS) - University of Kent

Kent Interdisciplinary Research Centre in Cyber Security (KirCCS) - University of Kent

KirCCS harnesses expertise across Kent University to address current and potential cyber security challenges.

Tinfoil Security

Tinfoil Security

Tinfoil is a simple, developer friendly service that lets you scan your website for vulnerabilities and fix them quickly and easily.

National Defence Radio Establishment (FRA) - Sweden

National Defence Radio Establishment (FRA) - Sweden

The National Defence Radio Establishment (Försvarets Radioanstalt), is the Swedish national authority for Signals Intelligence, also providing Information assurance services to government authorities.

DFLabs

DFLabs

DFlabs is a pioneer in Security Automation & Orchestration technology, leveraging your existing security products to dramatically reduce the response and remediation gap.

HYAS Infosec

HYAS Infosec

HYAS is a highly skilled information security firm developing the next generation of information security technology.

Armis

Armis

Armis is the first agentless, enterprise-class security platform to address the new threat landscape of unmanaged and IoT devices.

Cyber Security Academy (CSA)

Cyber Security Academy (CSA)

The CSA aims to educate professionals who wish to contribute to strengthening the digital defensibility of states, organisations and individual citizens.

astarios

astarios

astarios provide near-shore software development services including secure software development (DevSecOps), quality assurance and testing.

BINAR10

BINAR10

BINAR10 is a technology services company, specialized in Ethical Hacking / Penetration Testing, Information Security Management and Open Source technologies.

Scarlett Cybersecurity

Scarlett Cybersecurity

Scarlett Cybersecurity provide cybersecurity services to US private and public organizations with specific emphasis on compliance and cybersecurity incident prevention, detection, and response.

UTMStack

UTMStack

UTMStack is a Unified Security Management system that includes SIEM, Vulnerability Management, Network and Host IDS/IPS, Asset Discovery, Endpoint Protection and Incident Response.

UnderDefense

UnderDefense

UnderDefense provides cyber resiliency consulting and technology-enabled services to anticipate, manage and defend against cyber threats.

Prism Infosec

Prism Infosec

Prism Infosec is an award-winning independent cyber security consultancy, CREST STAR, NCSC CHECK member, CAA ASSURE audit provider and PCI Qualified Security Assessor.

IGI Cybersecurity

IGI Cybersecurity

IGI Cybersecurity delivers people-driven cybersecurity for personalized, resilient cyber defense focused on individualized strategy and unshakeable partnership.