sb-nz logo
Story image

Expert explains fighting cloud’s ‘biggest security risk’ – the user

20 Mar 2018

Businesses around the world are in a frenzy to either adopt cloud services or optimise their current systems.

Research from Forrester forecasts spending on public cloud platforms, business services, and applications to reach US$236 billion by 2020. With cloud spending predicted to be six times that of IT spending over the same period, Routed director Benhamin Coetzer says a cloud strategy is how companies will innovate faster and more cost effectively. 

Coetzer’s company Routed is a neutral cloud infrastructure provider, and he asserts that while cloud providers take responsibility for securing the cloud, only the organisation itself can secure how they actually use the cloud.

“Proper implementation of user behaviour analytics is essential to enable the organisation to protect itself from one of the greatest security threats - the users themselves,” says Coetzer.

“This approach will allow for introspection and, in an ideal situation, proactive response to potentially malicious actions as they occur.”

A problem, Coetzer says, is that the majority of larger organisations today seem to focus more on enterprise hosted applications and perimeter security to safe-guard business applications and data, often forgetting about the problem within.

“A firewall and a VPN concentrator is placed between users and IT resources and no second thought is spared to security and audit management of business data,” Coetzer says.

“Perimeter security alone is not nearly enough. If a user account is exploited and an attacker gains access to your ‘secure network’, they have carte blanche on any business data and applications that lives inside that network.”

Coetzer says it doesn’t matter what side of the firewall the user happens to find himself, business IT resources should be treated with the stringent access control and user authentication regardless of the circumstances.

“Business should look to the principals inferred by technologies such as Google BeyondCorp and Cloudflare Access to change the mindset around security implementations,” Coetzer says.

Coetzer believes policies and processes must be put in place from the very beginning to ensure cloud security, like secure and reliable user identity verification processes such as two factor authentication along with access control management with granular levels of Roll Based Access Control.

With these policies in place businesses will be able to ensure its users are only consuming applications and data that they are authenticated and authorised to access.

The message of cloud security certainly seems to be getting to businesses, as Gartner has forecast spending in the cloud security market to reach US$93 billion by 2020 while IDC has predicted US$101 billion.

Coetzer says this huge investment in cloud security is certainly a positive but hopes it doesn’t indicate an overly cautious market.

“New operating models for security are needed as this could possibly slow down enterprise adoption of cloud as CIO’s react cautiously to cloud adoption,” Coetzer concludes.

Link image
The importance of data resilience in the current cybersecurity climate
Protecting an organisation's data is one of the most crucial functions of any CISO. Strategies should be in place where data is stored securely and cost-effectively.More
Story image
Network visibility is the crux of security in 2020
Resilience sits at the heart of security, and there is a need for organisations’ architecture, processes and strategies to be more impervious in order to continue to ensure protection, writes Gigamon A/NZ manager George Tsoukas.More
Story image
Experiencing ransomware significantly impacts cybersecurity approach
"The survey findings illustrate clearly the impact of these near-impossible demands. Among other things, those hit by ransomware were found to have severely undermined confidence in their own cyber threat awareness."More
Story image
Why IT and HR must work together to help businesses weather the storm
Employers are striving to balance team productivity, security and employee engagement. If remote work is the new norm, it’s impossible to ignore the challenging nature of the situation, writes Gigamon manager for A/NZ George Tsoukas.More
Story image
Report reveals relationship between boardroom and cybersecurity investments
“While boards are definitely listening and stepping up with increased budget for cybersecurity, they tend to view any investment as a cost rather than adding business value."More
Story image
BlackBerry partners with ServiceNow for incident response management
BlackBerry has announced it has entered into a partnership with ServiceNow to integrate the BlackBerry AtHoc service within the Now platform for rapid crisis communications and IT service management. More