CISOs Confront Growing Cloud Security Challenge

The cloud offers many benefits, like better scalability, lower IT costs, and advanced technology, but it also brings serious cybersecurity challenges.

Many organizations are moving to cloud computing to improve their scalability, reduce IT expenses, and enhance collaboration. According to cybersecurity firm Rubrik, in 2023, cloud architecture held 13% of an organization’s data, up from 9% in 2022. Meanwhile, data stored on-premises decreased from 77% in 2022 to 70% in 2023.

Major players in cloud services include Google Cloud, Microsoft Azure, and Amazon Web Services (AWS). Other notable cloud service providers are IBM, Alibaba, Oracle, Red Hat, DigitalOcean, and Rackspace.

Infosecurity interviewed several experts to discuss the biggest challenges in cloud security faced by CISOs and their teams.

Cloud Security Challenges

Shared Responsibility Model One major challenge is the shared responsibility model in cloud environments. Oli Buckley, a Professor in Cyber Security at Loughborough University, notes that this model is a weak spot in cloud security. Cloud service providers (CSPs) ensure strong infrastructure security, but securing data remains the organization’s job.

A misunderstanding of these responsibilities can increase vulnerabilities. Buckley explains that the complexity of cloud environments makes it hard to maintain visibility and control. Relying on third-party services adds more risks.

To tackle this, organizations are adopting the “Bring Your Security” (BYOS) approach. Erfan Shadabi, a cybersecurity expert at Comfort AG, explains that BYOS allows organizations to add their security measures on top of the cloud provider’s infrastructure, offering an extra layer of protection and better control over data.

Legal Requirements for Data Cloud-stored data often include information protected by regulations, like protected health information (PHI) and personally identifiable information (PII). Rubrik’s research indicates that about 25% of cloud-stored data contains such sensitive information.

Buckley points out that compliance risks are higher in cloud environments because data is stored globally and across various jurisdictions. Meeting regulations like GDPR and CCPA is challenging and requires close cooperation with cloud providers. Staying updated on industry standards and regulations is crucial for cloud security.

Misconfigurations Misconfigurations in cloud resources can create security vulnerabilities. These errors can expose sensitive data, allow unauthorized access, and open up attack vectors.

Luke Stevenson, a Cyber Security Specialist at Redcentric, explains that early on, misconfigurations were a major problem, such as unsecured AWS S3 buckets exposing customer data. Although education has improved this situation, misconfigurations still pose issues for security teams and CISOs.

Regular audits of cloud infrastructure can help prevent misconfigurations.

Visibility Monitoring cloud environments can be tougher than managing on-premise data centers. Mark Lloyd from Axians UK notes that this lack of visibility can lead to undetected misconfigurations and unauthorized access. Organizations should use cloud security posture management (CSPM) solutions to get a clear view of their cloud assets and configurations.

Many organizations use multiple cloud platforms, which makes it hard to piece together a complete picture of normal operations and detect anomalies. Darren Anstee from Netscout emphasizes that security relies on visibility. The old saying “you cannot protect what you cannot see” is still true in the cloud.

Access Management Misconfigurations and poor visibility can lead to unauthorized access to cloud data. Cloud infrastructure, being outside the organization’s perimeter, can quickly become chaotic. Access issues often arise from unsecured passwords or credentials.

Buckley notes that unauthorized access can lead to financial, reputational, or regulatory problems. Implementing strong access controls, such as multi-factor authentication (MFA), and monitoring services can help reduce risks. Mayur Upadhyaya, CEO at APIContext, highlights that overreliance on API keys for authentication poses a risk. API keys can provide broad access and are a target for attackers. Using token-based authentication and access controls can help mitigate these risks.

Lack of Knowledge The ISC2 2023 Cybersecurity Workforce Study shows a significant skills gap in the cybersecurity field, reaching four million. Many organizations struggle with a lack of cloud security expertise.

Stevenson suggests that if your team lacks the expertise needed for cloud security, consider additional training and support. Regular audits and focusing on workforce education can improve your team’s understanding of cloud security.

Conclusion While cloud providers offer solid infrastructure, the responsibility for securing data falls on organizations. By understanding the main challenges and taking appropriate measures, CISOs and cybersecurity professionals can better protect sensitive information. As cloud computing grows, a proactive approach to cloud security will be crucial for success in the digital age.