Cloud and Cybersecurity: Types, Threats & How to Reduce Risks

The use of the cloud brings great benefits in the medium and long term, both in terms of applications and economics. However, if not properly managed, it can also be a target for cyberattacks.

In this blog, we will know in depth the characteristics of a cloud service, as well as the considerations we must take into account when migrating our information to a cloud service to minimize risks.

• What is the cloud?
• Characteristics of the cloud
• Types of Cloud
• Cybersecurity Threats in the Cloud
• Cloud Risks
• How to reduce risks in the cloud

The cloud, technology implemented to store and manage data.

What is cloud computing?

The cloud, also known as cloud computing, cloud services, or cloud computing; are the technologies or a global network of servers with specific functions, connected to function as a single ecosystem. These technologies are implemented to store and manage data, run programs or applications and provide services. Cloud services facilitate access to information from any connected device.

Characteristics of the cloud

● Scalability and elasticity. Cloud resources are not limited; because of their capacity, your technologies will adapt to the load they are under, so you won’t run out of storage or compute capacity for your application.

● Independence. One of the main features of cloud computing is being able to access any device or management console.

● Security. Cloud users are responsible for ensuring application-level security. Cloud service providers are responsible for physical security.

● Costs are reduced. Infrastructure is provided by a third party and does not have to be purchased for one-time or IT tasks.

● Performance. All resources are available to optimize the bottom line. Integrations are generated so that the user has greater efficiency and performance to track and make corrections to further increase resource capacity.

● Maintenance. Maintenance decreases, it is not necessary to have an entire department for the sustenance of the cloud. A responsible person can be assigned to follow up. The cloud performs the maintenance of systems automatically, which contributes to the optimization of time.

Types of cloud

• Private cloud. Consisting of a single organization with its own cloud of servers and software for use without a public access point.
• Public cloud. Several companies can use it simultaneously, sharing resources and offering services. The cloud provider is responsible for security maintenance.
• Hybrid cloud. Composed of two or more infrastructures, between public and private clouds, which remain as single entities, united by one technology.
• Community cloud. Sharing resources between companies or organizations that pool their resources in the cloud to solve a common problem.

Cybersecurity Threats in the Cloud

Threats in the cloud depend on the type of service contracted and how it is contracted and deployed.

Here are some threats to consider:

Data theft.

This can be the result of a targeted attack, human error, application vulnerabilities, or poor security practices. The data stolen is usually health information, financial information, personally identifiable information, trade secrets, and intellectual property.

Poor Identity and Access Management

Poor management of identity, passwords, or credentials can result in cybercriminals accessing, modifying, and deleting data, stealing information or spying, as well as injecting applications or malicious code that appears to come from a legitimate user.

Insecure APIs

One of the fundamental aspects of cloud services security is the programming interfaces for creating applications, as they have to be designed with security policies that guarantee the protection of information.

System vulnerabilities

System vulnerabilities can be exploited by cyber attackers to infiltrate, steal data, gain control or disrupt services.

Attacks from the inside

A malicious administrator may have access to sensitive information and may have increased levels of access to more critical systems and data.

Advanced Persistent Threats (APT)

Advanced Persistent Threats are a type of attack that infiltrates systems to compromise a system that houses valuable information. APTs stealthily pursue their targets over long periods of time, often adapting to security measures designed to defend against them. The problem with cloud services is that once installed, attacks can move laterally across data center networks and blend in with normal network traffic to achieve their goals.

Denial of Service (DoS) Attacks

A DDoS (Distributed Denial of Service) attack is an attempt to exhaust the resources available to a network, application, or service so that its legitimate users cannot access it. By forcing a cloud service to consume excessive amounts of resources, cybercriminals can slow down legitimate users’ systems or even leave them without access.

Cloud Risks

It is necessary to perform a risk assessment of the cloud that may affect the service to be hired, so that, in this way, the security measures to be implemented are established. These are some of the risks of the cloud:

Access by privileged users: An employee with administrator privileges accesses when he should not or acts with bad intentions, modifying data or configurations. The human factor also involves risks, as it is possible that by mistake privileges are given to employees who should not have them, and these, through ignorance, cause damage.

Regulatory non-compliance: A regulatory non-compliance occurs when the supplier does not comply or does not allow us to comply, with our legal obligations. For this type of infringement, we may face legal sanctions.

Lack of knowledge of data location: Purchasing services with a data hosting provider in a data center whose location is unknown, implies a risk of not knowing the legislation of other countries.

Lack of data isolation: When contracting cloud services, companies share the cloud infrastructure with others, it is necessary that the provider manages that the data of different companies are not mixed and that each one only has access to their own.

Unavailability of the service in the event of a disaster or incident: It is important to be aware that if the provider suffers a serious incident or disaster and does not have a continuity plan, they will not be able to continue providing service.

Lack of investigative support: In the event of an incident, it is necessary to review access to data to find out what has happened. The provider is required to guarantee access to activity logs.

Long-term viability: there is a risk that the conditions of the contract may be modified due to a change in the supplier’s structure, senior management, bankruptcy or the supplier deciding to outsource part of its services. It is therefore advisable to ensure access to and recovery of data.

How to reduce risks in the cloud

Privileged user access: For mitigation, it is necessary to create a council with the provider, so that the users who have privileges are only those who should have them. It is the responsibility of the employer to decide what access privileges their employees will have depending on the information to be accessed.

Non-regulatory compliance: External audits and security certifications are important to mitigate non-regulatory compliance. The employer’s responsibility is to ensure compliance within the company and that audits are carried out properly.

Recovery: To reduce this risk, it is necessary to require data recovery capability and estimated time of recovery from suppliers.

Data localization: To mitigate the risks of data localization, it is necessary to know the regulatory framework applicable to data storage and processing. It is recommended that the service provider adapts to the legal framework of the country of the service subscriber. It is the responsibility of the entrepreneur to know the location of his data in order to inform himself about the relevant legislation.

Data Isolation: To mitigate this risk, data at rest needs to be isolated and encryption procedures need to be performed by experienced personnel. The data controller must know where the most sensitive information for their organization is located and take the necessary protective measures.

Investigation support: The vendor must ensure that logs and data are centrally managed.

Long-term viability: The customer must be confident that they will be able to recover all data in the event of a change of structure or management by the provider.

4 best practices for cloud security

1. Define a robust service level agreement (SLA)
When acquiring services from a cloud service provider, it is extremely important to establish the responsibilities of the parties involved under the contract, where the levels of control, access, services, and security of the same are set.

2. Establish the design of the security architecture
Both parties have to integrate, align and detail the security architecture contract used in the environment to be contracted. It is essential to ensure that the supplier provides the minimum conditions such as a firewall, antivirus, and DDoS protection, among others.

3. Request advanced perimeter protection
Perimeter security has to be considered for the protection of information, so it is recommended to require these advanced security services.

To resolve email security, consideration should be given to:

• Antivirus
• AntiSpam
• Information leakage control
• Ability to create specific rules for blocking, including attachments
• Email monitoring

A cloud application solution should have the following:

• Intrusion detection tools.
• Application firewall (WAF)
• Next-generation firewall (NGFW)
• Attack mitigation tools for DDoS attacks
• Log correlation
• Content Delivery Network (CDN)

4. Enable Ethical Hacking.
Properly planned vulnerability scanning and ethical remediation should be allowed for the cloud. This type of scanning should be done by a company outsourced by the provider that the company deems trustworthy.

The Cloud proves to have great advantages for the scalability and economy of companies so it is not surprising that it is an increasingly popular solution.

The migration to this solution must take into account elements that guarantee a more robust and optimized infrastructure for the requirements of each organization, always considering information security as a fundamental pillar.