In early 2019, Gartner stated that 50% of organisations moving to the cloud will accidentally expose their data or services[1].
That was sobering enough. But of course, back in 2019… well, it wasn’t 2020 yet.
What does the exposure rate look like now? One thing’s for sure, it’s unlikely to have improved. As organisations are forced to accelerate their move to the cloud in order to continue doing business as normally as possible, there is a real risk they’re exposing their vital data and business-critical apps to a whole new level of vulnerability.
So, what are the risks we should all be aware of?
Here are a few to consider.
New landscape, new threats
The first and most important thing to remember is that the multi-cloud environment is a new landscape, with a new set of security threats. Migrating data and apps to this landscape is not just a copy-and-paste exercise; it requires careful consideration of an entirely new operational structure, which has serious implications for security. It sounds obvious, but your data and services are going to be more distributed, and this has the potential to make security more challenging. It’s basically nothing like securing a traditional IT model.
For example, one huge cloud security challenge is storage misconfiguration. In 2017, private data from millions of US citizens was exposed after an AWS Simple Storage Service (S3) cloud storage bucket was misconfigured.
Then there’s the complexity of the cloud control plane and shared responsibility matrices. Traditional models of management are changing and doing this across multiple clouds with different user interfaces, application programming interfaces, and cloud operational models, increases the skills and knowledge you need to manage these risks. Security teams must make sure only authorised users have access to the services they need, and while setting this up is time-consuming, it’s an essential layer of protection. It’s also vital to consider multi-factor authentication, careful logging, and continuous monitoring of cloud usage.
Plus of course, there are malicious attacks. DDoS, brute-force attacks, malware, and automated click fraud are just a few of the issues in the new cloud landscape. A cloud service that hosts malware is especially dangerous, as it uses the cloud service provider domain to make it appear more legitimate, and each cloud is different.
How to mitigate security risks in the cloud
The big question is, how do you leverage the flexibility of the cloud, without putting your business at risk?
You need to make sure all your data is protected from data loss and ransomware, and that it’s compliant globally regardless of the cloud you are storing it on. In a hybrid environment, this means ensuring you have secure shared files and block storage that work across your choice of public or private cloud. For an added layer of security, in-place and in-line encryption will ensure your data is protected even if access is compromised. And integrating your clouds with the leading authentication services will help you ensure only those you trust can access it. However, you also need to make sure that whatever security policies you have in place, they do not impact the performance and availability of your mission-critical workloads in the cloud whilst protecting your business.
Using Hybrid Cloud Managed Services from BT, you’ll be able to manage data across multiple clouds, including Private Cloud as well as Public Clouds. Our service enables you to choose the right type of Cloud to migrate your mission-critical workloads, enabling a consistent and compliant service delivered globally in days. By bringing together the skills and expertise of NetApp Data Management with our BT Global network, you’ll get a combination of security, performance, and agility.
While cloud security and management are always going to be challenging, working with the right partners will ensure you always stay one step ahead.
Find out more
To learn more about BT and NetApp’s partnership, and to explore what security in the cloud could look like for your organisation, get in touch.
[1] Gartner, Innovation Insight for Cloud Security Posture Management, 25 January 2019