We’ve all heard about data breaches, online, in print, and on broadcast media. They’ve been around as long as electronic data storage devices. The path from data and apps used on-premises, to the cloud, (and rarely, back again) is part of the story of cybersecurity. Here’s a status report of data breaches in the cloud.
Cloud Adoption Accelerates 2020 Data Breaches
First off though, what is a data breach? In simple terms, it’s a security incident in which an intruder steals, uses, or gains access to information without authorization. Data breaches are the headline-hogging attacks that grab everyone’s attention with incredible numbers of stolen records (3.2 billion in a single recent exploit).
The pandemic, corporate remote work policies, and the growing trend of cloud service adoption are the drivers of the ballooning number of data breaches. In May 2020, O’Reilly reported an 88% adoption rate of enterprises using all types of cloud services. A year later in mid-2021, adoption rates hovered at 94 percent. But by the end of 2Q 2021, the year-on-year total of data breaches increased by 27 percent.
As a result, more businesses than ever exposed themselves to cyberattackers on the lookout for easy pickings.
Security Is a Major Problem in the Cloud
Not long ago, when the migration toward cloud-based services began, security professionals grumbled their misgivings about securing company data and operations off-premises. Well, the dissatisfaction is back. Once again, security professionals are unhappy with their cloud-based security situations.
In the 2021 survey conducted by IDC, nearly half of organizations surveyed were unhappy with their cloud-based security services, citing:
- Problems managing access consistently across several cloud services.
- The lack of visibility into security data and access privileges.
- Difficulty integrating different security solutions.
- Difficulty operating a shared security model with their cloud service vendor.
Only 20 percent of organizations surveyed felt very satisfied with their cloud-based security situation. What’s happening to make security professionals so fiercely disappointed?
Traditional security solutions don’t always work in the cloud
Security environments that run on-premises protect their IT infrastructure at its edge. Cloud environments, however, are connected to servers and data throughout a network and skirt perimeter defenses. Preventing unauthorized access to cloud environments requires an approach that focuses on protecting data. This data-centered approach is a hallmark of modern cloud-based security.
Enterprise cloud-based data breaches surprise researchers
A crushing majority of enterprises interviewed in the IDC study experience data breaches in their cloud operations. Respondents shared that data breaches in the cloud disrupt their organizations at a disturbing rate:
- Nearly 80% of companies surveyed said they experienced one or more cloud data breach during the previous year and a half.
- Forty-three percent of respondents revealed they had experienced ten or more breaches during the past 18 months.
The biggest security threats included:
- Poorly configured identity and access management (IAM) permissions.
- Not enough visibility into access settings, data, and activities.
- Assigning identity and data access permissions more feely than user roles require.
So, what types of solutions would make cloud-based data breach protection more effective?
- Managing the Risk of Data Breaches. As the survey respondents’ list of concerns show, in the cloud, data visibility and access control are top of mind with security specialists.
- Improving security resource visibility. When we discuss visibility, we’re talking about providing a complete picture of company-wide security status. You cannot monitor or protect devices and information you don’t know exist. So, visibility is the having a clear, complete, and accurate view of data and security controls so that relevant resources are easy to monitor and manage.
- Improving identity and access control. Organizations struggle to balance cloud technology benefits with safe, day-to-day security operations. The challenge: organizations must provide access to data and protect it from threats within and outside their IT infrastructures.
So, what does a cloud-based, data security solution look like?
Components of a Cloud-based Security Solution
Ideally, the most effective data security solutions would improve data visibility and control in cloud and on-premises environments. When you look under the hood of data-centered security solutions, expect to find these features and capabilities:
- A single, unified view of risk. Everyone who manages security needs a compact but comprehensive view of potential threats and security resources. That means starting with an integrated visual dashboard. The dashboard UI shows where security devices are, how devices and controls are configured, security resource status (if any attack is in process or about to happen), policy noncompliance, and any other security threats.
- Automated maintenance and monitoring tasks. There are many manual tasks that eat up a security team’s time and attention. Writing deployment scripts, configuring controls, and assigning access permissions are just three examples of processes that are ripe for automation.
- Encryption. Data encryption helps to protect data that is sent, received, and stored in the cloud. Encryption creates a barrier to intruders by transforming digital information into unreadable content. The only way for the data to be useful is to apply an encryption key, which makes the content readable.
- Identity and access management. IAM provides full security visibility and control by enabling administrators to choose users who can view or use specific security resources. These access permission assignments are based on a user’s role and company-defined rules.
- Multi-factor authentication. This familiar tool uses text, biometric information (or both) to provide an extra layer of protection to data stored in the cloud.
These days, it’s nearly impossible to run a successful company without protecting the customer and business operations data housed in IT systems. The good news: There are plenty of solutions that can protect your data in the cloud.
