As cyber-attacks targeting cloud infrastructures increase, using a Cloud Security Posture Assessment can help you determine how best to reduce your organization's risk.
Indeed, cloud computing has become firmly established by organizations of all sizes and across all sectors. A cloud-based infrastructure facilitates digital transformation, offering opportunities to use best-of-breed cloud apps to help improve productivity. It also offers remote working, and in doing so, helps your organization maintain a competitive edge. However, cloud computing also offers opportunities for cyber criminals. In the first half of 2019, 4.1 billion data records were breached, a 54% increase on the previous year.
Cloud-based cyber-attacks are now a common occurrence , and big names and small, are at risk. In 2019, cloud security attacks were successful at companies including Capital One, Facebook, MS Azure (Elasticsearch) and countless others. Many of these attacks were caused by vulnerabilities and/or misconfigurations in the organization’s cloud infrastructure. For example, when an organization uses a third-party to host IT resources, they face this question: just who is responsible for security and where are security gaps and weaknesses? This is why carrying out a Cloud Security Posture Assessment is so critical to reducing risks to your organization cloud infrastructure.
As organizations across the globe moved to cloud computing, the idea of an on-premise, network perimeter to protect data, became no longer relevant. Cloud providers, like Amazon Web Services (AWS), Microsoft Azure and many others worked to provide assurances that they could offer secure environments to replace the old network perimeter. However, there is a point at which cloud provisioning and the responsibility for data security, become somewhat fuzzy. Which is why this has led to the concept of the “shared responsibility model”. Shared responsibility is described as:
In other words, the cloud vendor must provide the security of the infrastructure pieces, such as the Operating System (OS), the virtualization layer, physical security, etc.
You might be aware that the industry body OWASP, provides a number of areas to focus on in their “Top Ten” cloud security risks. These areas can be used as a basis for identifying any potential issues in your cloud-based apps and data. This type of assessment targets these areas to identify and reduce risks like misconfigurations and vulnerabilities, etc. However, a cloud security posture assessment will go further by looking across all areas of cloud use, including user behavior, access control policies, and your cloud architecture. Indeed, the cloud posture assessment will also provide recommendations and action items if any area falls short of secure. The European Network and Information Security Agency (ENISA) is a center of network and information security expertise for the EU. ENISA plays an important role in providing organizations with a pretty extensive overview of the information security risks when moving to the cloud which you can review HERE.
The assessment process is as follows below.
1- We will review your organization's cyber security documentation and processes
2- We will sit down with your business resources and IT experts to better understand your reality
3- We will analyse and assess your maturity and risks
4- We will submit proposal with a comprehensive roadmap to mitigate your risks and improve your security posture
Carrying out a cloud security assessment is a practical and strategic exercise to improve your cloud security health. Your organization will get better visibility on:
1- Your current cloud posture
2- Provide data for risk analysis
3- How your cloud process are aligned or not
4- How secure your third party integrations are
5- Making sure that the existing infrastructure and the cloud are aligned
A cloud security assessment helps you reduce your risk and it is a practical process that offers many benefits. Enterprises of all sizes embrace cloud computing. You are ultimately responsible to make sure you do not leave the door open to cyber-crime. To do so, an enterprise requires a methodology that drills down into the areas where an organization is most at risk. A cloud security assessment teases apart, any areas within a cloud computing model that increase risk. In doing so, it also improves the visibility of the data life cycle.
In an era where cyber-crime is now commonplace, having an analytical approach to security is vital. Cyber-threats are complex and multi-faceted. We need to use a cloud security assessment to counterbalance these gross threats.
