Story image

Expert explains fighting cloud’s ‘biggest security risk’ – the user

20 Mar 2018

Businesses around the world are in a frenzy to either adopt cloud services or optimise their current systems.

Research from Forrester forecasts spending on public cloud platforms, business services, and applications to reach US$236 billion by 2020. With cloud spending predicted to be six times that of IT spending over the same period, Routed director Benhamin Coetzer says a cloud strategy is how companies will innovate faster and more cost effectively. 

Coetzer’s company Routed is a neutral cloud infrastructure provider, and he asserts that while cloud providers take responsibility for securing the cloud, only the organisation itself can secure how they actually use the cloud.

“Proper implementation of user behaviour analytics is essential to enable the organisation to protect itself from one of the greatest security threats - the users themselves,” says Coetzer.

“This approach will allow for introspection and, in an ideal situation, proactive response to potentially malicious actions as they occur.”

A problem, Coetzer says, is that the majority of larger organisations today seem to focus more on enterprise hosted applications and perimeter security to safe-guard business applications and data, often forgetting about the problem within.

“A firewall and a VPN concentrator is placed between users and IT resources and no second thought is spared to security and audit management of business data,” Coetzer says.

“Perimeter security alone is not nearly enough. If a user account is exploited and an attacker gains access to your ‘secure network’, they have carte blanche on any business data and applications that lives inside that network.”

Coetzer says it doesn’t matter what side of the firewall the user happens to find himself, business IT resources should be treated with the stringent access control and user authentication regardless of the circumstances.

“Business should look to the principals inferred by technologies such as Google BeyondCorp and Cloudflare Access to change the mindset around security implementations,” Coetzer says.

Coetzer believes policies and processes must be put in place from the very beginning to ensure cloud security, like secure and reliable user identity verification processes such as two factor authentication along with access control management with granular levels of Roll Based Access Control.

With these policies in place businesses will be able to ensure its users are only consuming applications and data that they are authenticated and authorised to access.

The message of cloud security certainly seems to be getting to businesses, as Gartner has forecast spending in the cloud security market to reach US$93 billion by 2020 while IDC has predicted US$101 billion.

Coetzer says this huge investment in cloud security is certainly a positive but hopes it doesn’t indicate an overly cautious market.

“New operating models for security are needed as this could possibly slow down enterprise adoption of cloud as CIO’s react cautiously to cloud adoption,” Coetzer concludes.

Cloud application attacks in Q1 up by 65% - Proofpoint
Proofpoint found that the education sector was the most targeted of both brute-force and sophisticated phishing attempts.
Singapore firm to launch borderless open data sharing platform
Singapore-based Ocean Protocol, a decentralised data exchange that promotes data sharing, has revealed details of what could be the kickstart to a global and borderless data economy.
Huawei picks up accolades for software-defined camera ecosystem
"The company's software defined capabilities enable it to future-proof its camera ecosystem and greatly lower the total cost of ownership (TCO), as its single camera system is applicable to a variety of application use cases."
Tech community rocked by deaths of Atta Elayyan and Syed Jahandad Ali
Both men were among the 50 killed in the shooting in Christchurch last Friday when a gunman opened fire at two mosques.
NZ ISPs block internet footage of Christchurch shootings
2degrees, Spark, Vodafone and Vocus are now blocking any website that shows footage of the mosque shootings.
Barracuda expands MSP security offerings with RMM acquisition
Managed Workplace delivers an RMM platform with security tools and services, such as site security assessments, Office 365 account management, and integrated third-party antivirus.
Flashpoint: APAC companies must factor geopolitics in cyber strategies
The diverse geopolitical and economic interests of the states in the region play a significant role in driving and shaping cyber threat activity against entities operating in APAC.
Expert offers password tips to aid a stress-free sleep
For many cybersecurity professionals, the worries of the day often crawl into night-time routines - LogMeIn says better password practices can help.