The Cloud Roadshow – Kuwait 2022 edition – join for free

The cloud has become an integral part of online life. It makes digital communication and work more convenient and has spurred rapid innovation for organizations. But when friends share photographs, coworkers collaborate on a new product, or governments deliver online services, it’s not always clear where the data itself is being stored. People may inadvertently move data to a less secure location, and with everything internet accessible, assets are at greater risk of unauthorized access.

Data privacy is also increasingly important to people and governments. Regulations like the General Data Protection Regulation (GDPR) and Health Insurance Portability and Accountability Act (HIPAA) require organizations that collect information to do so transparently and put in place policies that help prevent data from being stolen or misused. Failure to comply can result in expensive fines and reputational harm.

To remain competitive, organizations must continue to use the cloud to iterate rapidly and make it easy for employees and customers to access services, while protecting data and systems from the following threats:

• Compromised accounts: Attackers often use phishing campaigns to steal employee passwords and gain access to systems and valuable corporate assets.
• Hardware and software vulnerabilities: Whether an organization uses a public or private cloud, it’s critical that the hardware and software is patched and up to date.
• Internal threats: Human error is a big driver of security breaches. Misconfigurations can create openings for bad actors, and employees often click on bad links or inadvertently move data to locations with less security.

Cloud security is a shared responsibility between cloud service providers and their customers. Accountability varies depending on the type of services offered:

Infrastructure as a service

In this model, cloud service providers offer computing, network, and storage resources on demand. The provider is responsible for securing the core computing services. Customers must secure everything on top of the operating system including applications, data, runtimes, middleware, and the operating system itself.

Platform as a service

Many providers also offer a complete development and deployment environment in the cloud. They take responsibility for protecting the runtime, middleware, and operating system in addition to the core computing services. Customers must safeguard their applications, data, user access, end-user devices, and end-user networks.

Software as a service

Organizations can also access software on a pay-as-you go model, such as Microsoft Office 365 or Google Drive. In this model, customers still need to provide security for their data, users, and devices.

No matter who’s responsible, there’re four primary aspects to cloud security:

• Limiting access: Because the cloud makes everything internet accessible, it’s incredibly important to ensure that only the right people have access to the right tools for the right amount of time.
• Protecting data: Organizations need to understand where their data is located and put the appropriate controls in place to safeguard both the data itself and the infrastructure where the data is hosted.
• Data recovery: A good backup solution and data recovery plan is critical in case there’s a breach.
• Response plan: When an organization is attacked, they need a plan to reduce the impact and prevent other systems from becoming compromised.

Types of cloud security tools