Cloud adoption has become a popular option among businesses as they look to cut costs, streamline IT efficiency, and increase agility and flexibility. Cloud and multi-cloud technologies deliver improved business performance and accelerate innovation. But the promise of the cloud comes with a major challenge – security.

From zero-day exploits and DDOS attacks to malware incidents and compliance violations, replacing legacy, on-premise technology with the power of the cloud has opened organizations up to new security risks. Oftentimes, cloud security efforts lag behind cloud use and adoption. As a result, Gartner predicts that 99% of cloud security failures will be caused by cloud customers by 2025. So, how can organizations reap the benefits of the cloud while still preserving security?

In this post, we’ll take a closer look at the main challenges organizations face when securing the cloud, the impact of those challenges, and solutions your organization can use for protecting your cloud environment.

Three Main Challenges to Cloud Security

The cloud is revolutionizing how businesses operate, and companies of all sizes are taking advantage of its benefits. But to achieve its full potential, there are certain challenges and pitfalls that must be addressed when it comes to cloud security.

The Growing Complexity of Multi-Cloud Environments.

Cloud technologies provide organizations with the flexibility, scalability, and innovation that on-premise capabilities could never afford. But, while the cloud is a powerful tool that can increase business efficiencies and create new opportunities, it also introduces a new level of complexity within an organization. There are many service providers that offer cloud platforms for the development, management, and deployment of applications - from Amazon Web Services (AWS) to Microsoft Azure to Google Cloud Platform (GCP). Over the last year, both Alibaba Cloud and Oracle have seen an uptick in adoption as they have surpassed the top cloud market leaders across a range of technical and support criteria, according to Gartner. Many organizations often gravitate towards a best-of-breed approach and partner with numerous cloud providers depending on the solution that best fits their current business needs. In fact, roughly 67% of organizations utilize at least two different cloud providers simultaneously.

However, transferring data to the cloud can bring many security risks, like insider threats, malware, external attacks, misconfigured servers, insecure APIs, and compliance violations. More often than not, organizations create a multi-cloud environment before an enterprise-wide strategy was formed with input from Security. Since each cloud provider has their own approach to security infrastructure and compliance obligations, failing to include Security on these decisions can expose organizations to entirely new categories of risks and challenges. This fragmented approach to multi-cloud environments can also strain security teams as they are required to manage, maintain, and secure these complex resources. Although multi-cloud is critical to many businesses these days, managing the complexity of these environments after the fact is a key challenge for cloud security teams.

Lack of Personnel Experienced in Cloud Security.

Last year, almost 50% of organizations were unsure if they had experienced a cloud security incident. Cloud security requires a specific set of knowledge and skills to address the capabilities of different cloud providers and the technologies that intersect with the cloud (e.g., DevSecOps, the Internet of Things (IoT), automation). However, many organizations are still using legacy security approaches, which are ineffective in cloud security environments and lack the necessary skills and experience for effective cloud management and security.

The need for skilled cybersecurity workers has been an issue for many years. With the increased reliance on cloud and multi-cloud environments and the strong experience necessary to protect an organization’s cloud infrastructure, cloud security has become the second most difficult hiring area, according to 28% of managers worldwide. Many teams are struggling to find the right cybersecurity professionals to keep up with the evolving technological needs of the cloud. Without a skilled cloud security team, organizations will continue to grow more susceptible to the exploitation of unintentional security misconfigurations.

Lack of Collaboration and Communication Across Teams.

Strong communication, a mutual understanding of enterprise and team goals, and collaborative processes are necessary qualities in the relationship between security teams and developers. However, security teams and developers can often have fractured relationships, which can lead to budgetary conflicts, compliance issues, and unsecure cloud assets. Business stakeholders place an emphasis on the deployment of new cloud services and features to increase revenue. Even though security is a key component in this process, it’s often an afterthought to both business leaders and developers. Unfortunately, waiting until the end of a project can lead to costly changes if needed and delay the overall release time.

Security should be the responsibility of everyone. Over 70% of organizations have experienced security and compliance issues due to the lack of collaboration between security teams and developers. Developers should recognize the importance of implementing security at every phase rather than looking to it as a hassle or roadblock. On the other hand, security teams must take the initiative to ensure their efforts are not pushed to the wayside. A strong cloud security program requires both teams to work cohesively, and the more integrated the business processes, the more efficient and successful these projects will be.

The Impact of Cloud Security Challenges

By 2025, the worldwide cloud spending is expected to surpass $1.3 trillion. As the cloud continues to be more widely adopted, it’s important to be aware of the challenges organizations face when leveraging the cloud and the impact these can have on business operations.

Cost Concerns: Even though the cloud is cost-effective, cloud security can come with a hefty price tag since businesses must have the resources and expertise to handle its risks. In addition, not all cloud providers offer unlimited features or bandwidth, and the cost to expand or introduce new services over time can eventually lead to high cloud costs. As businesses grow, they must ensure their cloud capabilities and the resources that manage them can grow or have a budget in place to afford these changes.
Cloud Downtime: Since cloud systems are internet-based, they can experience technical problems like reboots, service outages, and downtime. In 2017, an AWS outage cost publicly traded companies almost $150 million. While these events are unavoidable, they can severely incapacitate operations, so business should have a plan in the event of downtime.
Vulnerable to Attack: The misconfiguration of cloud infrastructures is one of the leading contributors to data breaches in the cloud. The Capital One breach that exposed the personal data of more than 100 million Americans was the result of a misconfigured setting on an AWS firewall. Since many organizations often have multi-cloud deployments, it is easy for a simple misconfiguration or security oversight to leave an organization’s cloud-based resources vulnerable to attack.
Stolen Crown Jewels: Although which assets are considered crown jewels can vary, they are the assets most vital to an organization and require the highest level of protection. These days, many companies store their crown jewels in the cloud since these critical applications depend on cloud resources. As a result, these assets have the potential to be exposed to new attack vectors and a greater threat landscape and could lead to catastrophic consequences if a breach were to occur within the cloud environment.

Five Solutions for Securing the Cloud

As more organizations migrate their data, applications, and other assets to the cloud, understanding how to protect this sensitive information is imperative. Security threats have become more advanced as the digital landscape evolves, and traditional network security is no longer effective as applications move to the cloud and users become increasingly mobile. Since no organization or cloud service provider can eliminate all security threats and vulnerabilities, cloud security plays an essential role in an organization’s overall business strategy. For this reason, it is essential to take active steps to improve cloud security to keep data and applications located in the cloud safe from current and emerging cybersecurity threats.

Based on the Cloud Controls Matrix introduced by the Cloud Security Alliance (CSA), we’ve divided cloud security solutions into five key domains.

Access

Every cloud service provider offers a unique set of identity and access management capabilities with distinct permission principles. Although most organizations have built cloud adoption and migration into their business plans, many often overlook how access and authorization for cloud resources are managed. Since today’s cloud environments are highly distributed and accessed by a host of users, they can be more difficult and complex to monitor and control. Organizations that have a strong cloud security team could take on these responsibilities themselves, but the task requires a significant overhead that some teams aren’t equipped to handle. Luckily, there are tools that can help govern and track permissions in the cloud and ease this process.

Cloud Infrastructure Entitlements Management (CIEM) Solutions

By leveraging a CIEM solution, organizations can continuously monitor the identities, permissions, and activity located in the cloud. Whether in a single or multi-cloud environment, CIEM solutions can detect and remediate IAM misconfigurations to establish least-privilege access policies. Without CIEM, organization would be forced to rely on the patchwork set of native tools provided by different cloud providers, so CIEM solutions will be a leading tool in strong cloud security programs.

Configuration

When it comes to cloud security, it is important to be able to assess the misconfigurations within a cloud environment, especially when taking into account that 70% of all security challenges in the cloud arise from misconfigurations. Well-known businesses such as Capital One, Expedia, and Estee Lauder have all suffered from data breaches resulting from the improper configuration of their cloud environments. In dynamic cloud environments, preventing misconfigurations requires an ongoing effort.

A critical part in overcoming this is having the right tools to apply the necessary security controls to the cloud.

Cloud Security Posture Management (CSPM)

CSPM concentrates on assessing cloud environments for possible misconfigurations. Spanning across all cloud architectures (i.e., SaaS, PaaS, and IaaS), CSPM technologies identify and remediate risks caused by cloud misconfigurations to improve the security of cloud environments and prevent the threats that lead to data breaches and compliance violations.

Cloud Workload Protection Platform (CWPP)

A CWWP is a security offering designed to meet the unique protection requirement of workloads in hybrid, multi-cloud, and data center environments. A CWPP scans container and serverless workloads in order to detect vulnerabilities and misconfigurations that present a risk to the organization. CWPPs should integrate with CSPMs to better manage cloud assets and detect complex cloud-based cyberattacks.

Architecture

With organizations growing more reliant on the cloud, security architecture is becoming critical in protecting cloud environments. Cloud security architecture is a security strategy designed around securing an organization’s assets in the cloud. It is based upon cloud security best practices, providing the written and visual model that defines how to configure and secure operations within the cloud. This can include identity and access management methods for protecting applications and data, approaches for gaining visibility into compliance and threat posture, and physical infrastructure security components.

Designing and building a cloud security architecture is essential to reducing an organization’s exposure to risks and threats while using the cloud. During cloud deployment, cloud security architecture can organize security measures, making them easier to maintain over time. Cloud security architecture can also reduce redundancies in security measures that would increase operation costs.

Next-gen firewalls and threat modeling are two solutions that can help address architectural gaps when safeguarding cloud systems and data. For threat modeling, security teams work with developers to identify potential attack vectors in various applications. From there, they can determine which architectural changes should be put in place. Next-gen firewalls can be used to support native network security capabilities within the cloud.

Governance

Cloud governance ensures that asset deployment, system integration, data security, and various other aspects of the cloud are properly planned, managed, and maintained. Since cloud systems can be created and operated by different groups within an organization, these teams must be able to work together to align with the organization’s cloud security strategy. Unfortunately, there is often a disconnect between cloud security teams and developers.

Here are several effective strategies that can help break down the silo mentality between security teams and developers and support more effective, cross-functional interactions between each team:

Establish a Steering Committee: Organizational silos do not normally break down on their own. Establishing a steering committee can provide opportunities for different teams to interact with one another and work together to achieve a common goal. A steering committee will ensure the goals of each team are met and will set the standard for future projects.
Communicate a Unified Vision: Conflicts can form when departments lose sight of broader company goals and purposes and focus solely on individual or departmental goals. Creating a unified vision will help both individuals and teams understand the bigger picture and that their goals are secondary to the overall success of the organization.
Create Shared Accountabilities: Even with a unified organizational vision, teams would benefit from having shared goals that help align them. By working towards a shared objective, teams will be encouraged to regularly communicate, share ideas, and solve issues, which will build trust and allow teams to realize the value each department can bring to a project.
Incorporate Collaboration Tools: There are a range of collaboration tools that can be utilized to help teams better work together in the cloud (e.g., CRM dashboards, shared documents, project management platforms). When different departments can collaborate within the same interface, it breaks down barriers to cooperation and communication and makes it easier to share ideas and work more efficiently towards a common goal.
Get Leaders Onboard: Silo mentality begins with management. Management often focuses on accomplishing specific goals that benefits their department, which can create resistance and conflict with the goals of other teams. Cross-team collaboration is more likely to occur if leaders demonstrate this behavior.

Telemetry

For cyber criminals to exploit cloud environments while remaining undetected, many turn off logging in compromised systems to hide their activity. This creates gaps in telemetry that can delay incident response and lead to high-profile cybersecurity incidents. As with any security operations, it’s important to have monitoring and visibility into activities within a cloud environment. Telemetry data must be reliable and relevant and provided in real-time to avoid gaps, whether introduced by cybercriminals or caused by a miscommunication between different departments.

Leveraging the different logs available within the cloud (network, endpoint, management, etc.) is a key component in ensuring security in the cloud. Using the information provided by the logs, security teams can integrate data into a centralized Security Information and Event Management (SIEM) to allow for continuous monitoring of the organization’s cloud network. In addition, this added visibility can provide security teams with the information needed to detect threats and identify potential malicious activity.

Looking Ahead

The numerous advantages of the cloud are undeniable; however, one misconfigured sever could leave your organization struggling with financial and reputational damage for years to come. Fortunately, there’s no reason why this has to ever become a reality. As with any technology, there are always security concerns, but a strong cloud strategy will ensure your organization is prepared to handle any challenge that might come its way.

Want more insights into the latest cybersecurity news?

Subscribe to Focal Point's Risk Rundown below - a once-a-month newsletter with guides, webinars, interesting white papers, and news all focused on data privacy. You can unsubscribe at any time.