{"id":2019,"date":"2020-04-01T13:28:52","date_gmt":"2020-04-01T09:28:52","guid":{"rendered":"https:\/\/techxmedia.com\/?p=2019"},"modified":"2025-04-18T00:09:35","modified_gmt":"2025-04-17T20:09:35","slug":"is-the-cloud-really-safe","status":"publish","type":"post","link":"https:\/\/techxmedia.com\/en\/is-the-cloud-really-safe\/","title":{"rendered":"Is the cloud really safe?"},"content":{"rendered":"\n

Back in the day, the theft and loss of backup tapes and laptops were a primary cause of data breaches. That all changed when systems were redesigned and data at rest was encrypted on portable devices. Not only did we use technology to mitigate a predictable human problem, we also increased the tolerance of failure. A single lapse, such as leaving a laptop in a car, doesn\u2019t have to compromise an organisation\u2019s data. We need the same level of failure tolerance, with access controls and IT security, in the cloud.<\/p>\n\n\n\n

In\nthe cloud, all<\/em> infrastructure is virtualised and runs as software. Services\nand servers are not fixed but can shrink, grow, appear, disappear, and\ntransform in the blink of an eye. Cloud services aren\u2019t the same as those\nanchored on-premises.  For example, AWS\nS3 buckets have characteristics of both file shares and web servers, but they\nare something else entirely. <\/p>\n\n\n\n

Practices\ndiffer too. You don\u2019t patch cloud servers \u2013 they are replaced with the new\nsoftware versions. There is also a distinction between the credentials used by\nan operational instance (like a virtual computer), and those that are\naccessible by that instance (the services it can call). <\/p>\n\n\n\n

Cloud\ncomputing requires a distinct way of thinking about IT infrastructure. <\/p>\n\n\n\n

A\nrecent study by the Cyentia Institute shows that organisations using four\ndifferent cloud providers have one-quarter the security exposure rate. Organisations\nwith eight clouds have one-eighth the exposure. Both data points could speak to\ncloud maturity, operational competence, and the ability to manage complexity.\nCompare this to the \u201clift and shift\u201d cloud strategies, which result in\nover-provisioned deployments and expensive exercises in wastefulness. <\/p>\n\n\n\n

So\nhow do you determine your optimal cloud defense strategy?<\/p>\n\n\n\n

Before\nchoosing your deployment model, it is important to note that there isn\u2019t one\ndefinitive type of cloud out there. <\/p>\n\n\n\n

The National Institute of Standards and Technology’s (NIST) definition of cloud computing lists three cloud service models infrastructure-as-a-service (IaaS), platform-as-a-service<\/a> (PaaS), and software-as-a-service (SaaS). It also lists four deployment models: private, community, public, and hybrid. <\/p>\n\n\n\n

Here\u2019s\na quick summary of how it all works through a security lens:<\/p>\n\n\n\n

Software-as-a-Service (SAAS) cloud<\/strong> is an application service delivered by the cloud. Most of the infrastructure is managed by the provider. Examples include Office 365, Dropbox, Gmail, Adobe Creative Cloud, Google G Suite, DocuSign, and Shopify. Here, you are only responsible for your logins and data. Primary threats include phishing, credential stuffing, and credential theft. These can be controlled via solutions such as multi-factor authentication, application configuration hardening, and data-at-rest encryption (if available).<\/p>\n\n\n\n

Platform-as-a-Service (PaaS) cloud<\/strong> is a platform to build applications into before they are delivered by the cloud. The provider manages the platform infrastructure, but you build and run the applications. Examples include AWS S3 buckets, Azure SQL Database, Force.com, OpenShift, and Heroku. You are only responsible for your logins and data. In addition to SaaS threats (access attacks), there is a need to secure the application itself against web app attacks. In this model, you are likely to have exposed APIs and service interfaces that could leak data if unsecure. Controls include User\/Role Rights Management processes, secure API gateways, Web App Security, Web App Firewalls, bot scrapers, and all the referenced SaaS controls.<\/p>\n\n\n\n

Infrastructure-as-a-Service (IaaS) Cloud <\/strong>is a platform to build virtual machines, networks, and other computing infrastructures. The provider manages the infrastructure below the operating system, and you build and run everything from the machine and network up. Examples include AWS EC2, Linode, Rackspace, Microsoft Azure, and Google Compute Engine. You are responsible for the operating systems, networking, servers, as well as everything in the PaaS and SaaS models. In addition to the threats targeting SaaS and PaaS models, the main security concerns are exploited software vulnerabilities in OS and infrastructure, as well as network attacks. This calls for a hardening of virtualised servers, networks, and services infrastructure. You\u2019ll need all the above-mentioned controls, plus strong patching and system hardening, and network security controls.<\/p>\n\n\n\n

On-Premises\/Not Cloud<\/strong> is the traditional server in a rack, whether it\u2019s in a room in your building or in a colocation (Colo) facility. You\u2019re responsible for pretty much everything. There\u2019s less worries about physical security, power, and HVAC but there are concerns related to network connectivity and reliability, as well as resource management. In addition to threats to networks, physical location, and hardware, you\u2019ll have to secure everything else mentioned above.<\/p>\n\n\n\n

If you have a\nhybrid cloud deployment, you\u2019ll have to mix and match these threats and\ndefenses. In that case, an additional challenge is to unify your security\nstrategy without having to monitor and configure different controls, in\ndifferent models and in different environments. <\/p>\n\n\n\n

Any strategy\nand priority decisions should come before the technological reasons. Don\u2019t go\nto the cloud for the sake of it. A desired goal and robust accompanying\nstrategy will show the way and illuminate where deeper training and tooling are\nneeded. <\/p>\n","protected":false},"excerpt":{"rendered":"

A single lapse, such as leaving a laptop in a car, doesn\u2019t have to compromise an organisation\u2019s data. We need the same level of failure tolerance, with access controls and IT security, in the cloud.<\/p>\n","protected":false},"author":8,"featured_media":9013,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"_monsterinsights_skip_tracking":false,"footnotes":""},"categories":[154,9618,9621,10388],"tags":[520,522,1020,1021,1022,521,831,931],"contributor":[],"class_list":["post-2019","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cloud-computing","category-editors-pick","category-emerging-technologies","category-storage","tag-cloud_security","tag-iaas","tag-infrastructure","tag-nist","tag-paas","tag-saas","tag-software","tag-storage"],"featured_image_src":"https:\/\/techxmedia.com\/en\/wp-content\/uploads\/2020\/04\/cloud-techxmedia.jpg","author_info":{"display_name":"Rabab","author_link":"https:\/\/techxmedia.com\/en\/author\/rabab\/"},"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t