Many modern companies leverage cloud services for part or all of their IT environment. While the cloud offers many advantages, teams must navigate a different, more complex security landscape. Organizations that fail to address the cloud’s security challenges put their critical systems and data at risk.
Some companies are still making costly security mistakes despite the cloud model’s relative maturity. Businesses intent on protecting the valuable data stored and processed in the cloud must avoid the following mistakes.
Not Understanding the Shared Security Responsibility Model
Cloud environments are secured by both the provider and the customer under the shared security responsibility model. This model outlines the role each entity plays in securing the environment and its data. Let’s look at the AWS shared responsibility model to demonstrate how the model works and where teams can make mistakes that may degrade security.
AWS is responsible for the security of the cloud. This responsibility entails protecting the AWS cloud infrastructure, including all the hardware, software, networking, and physical facilities that support its cloud services.
Customers are responsible for security in the cloud. Their specific responsibilities are dependent on the cloud services they select. For example, businesses using IaaS solutions are responsible for configuring and managing their security. Customers are responsible for managing, encrypting, and classifying data assets, and for controlling access using effective Identity and Access Management (IAM) tools.
In some cases, responsibility for different aspects of a security-focused activity is shared directly by the provider and customer, as in the following examples.
- Patch management: AWS patches the infrastructure, but the customer must patch the guest operating systems and applications.
- Configuration management: AWS configures the infrastructure components, with the customer responsible for configuring operating systems, databases, and applications.
- Training: AWS trains its employees, but customers are responsible for training their personnel regarding cloud services.
Teams may misunderstand the boundaries of shared security responsibility, leading to mistakes that put the environment at risk. Common mistakes include:
- Thinking backups are automatically configured;
- Trusting default access controls to protect mission-critical data;
- Assuming data encryption is enabled by default everywhere in the environment.
Misconfigured Cloud Components
Teams can introduce significant security risks by misconfiguring cloud components. Misconfiguration is one of the primary causes of cloud security issues. What may appear to be a minor misconfiguration can have disastrous effects on the environment and grant threat actors access to sensitive data.
Typical misconfiguration examples include:
- Publicly exposed cloud storage buckets;
- Unsecured internet-facing management interfaces;
- Disabled logging solutions.
Companies can minimize misconfiguration issues by thoroughly reviewing Infrastructure-as-Code templates and removing temporary settings deployed for testing or development. These temporary configurations often provide open access to components to streamline development, but must be modified to protect applications that go into production.
Overly Permissive Identity and Access Management (IAM)
Excessive IAM permissions can lead to significant cloud security risks. Threat actors can leverage compromised credentials to move laterally through the environment, identifying and corrupting valuable targets. Teams must ensure that they do not neglect strict permissions to achieve gains in operational speed.
The following common IAM problems can greatly reduce cloud security.
- Teams may grant administrator-level permissions too liberally.
- Companies may not implement effective multi-factor authentication (MFA) solutions.
- Businesses may fail to implement role-based access controls (RBAC) to prevent employees from gaining unnecessary permissions.
- Admins may fail to remove unused and obsolete accounts and credentials.
Lack of Cloud Visibility
Many organizations operate with incomplete visibility into their cloud environment. Modern, complex hybrid and multi-cloud infrastructures introduce additional visibility hurdles. Teams must accurately identify all cloud assets, identities, and SaaS solutions to implement effective security solutions.
Companies with insufficient cloud visibility face risks that include:
- Systems with known and unpatched vulnerabilities;
- Orphaned accounts and resources;
- Sensitive data in abandoned workloads or storage.
Organizations cannot protect their cloud environment effectively without complete visibility into the infrastructure.
Shadow IT and AI
The distributed and diverse nature of cloud computing makes it easier for employees to adopt shadow, unapproved IT and AI solutions. Shadow solutions can include SaaS platforms and AI tools that streamline operations and increase productivity. Teams may also leverage additional cloud storage services or browser extensions that they have not configured securely.
Companies are exposed to risk by shadow IT solutions. They lose visibility to sensitive data assets processed by ungoverned processes. Personnel may bypass compliance controls that expose regulated and sensitive data. Teams may integrate these shadow tools into the enterprise environment, opening the door to threat actors compromising the business.
Weak Backup and Recovery Planning
Companies may incorrectly expect the cloud provider to create immutable backups that support disaster and ransomware recovery. This expectation is typically fully met, and customers must design and test backup and recovery procedures to protect their business. Cloud outages may occur, and teams must be prepared to recover applications and data.
Poor planning can introduce single points of failure by allowing threat actors to delete or corrupt backup media. SaaS platforms such as Microsoft 365 may only provide limited recovery capabilities. Teams must monitor synchronization processes to ensure that corrupt data is not replicated throughout the environment. Companies should implement dedicated backup and recovery solutions to protect their cloud investment.
VAST’s Cloud Security Solutions
Our extensive experience and strategic partnerships with cloud vendors give us an excellent perspective on cloud security. We offer a range of cloud-focused services, from migration planning to fully managed cloud environments.
- VAST View: This comprehensive cloud management solution provides the visibility and functionality you need to secure your business.
- CBaaS: VAST’s CBaaS offering is a fully managed backup solution that creates immutable backups that threat actors cannot compromise, tailored to your business’s needs.
- DRaaS: Our disaster recovery solution protects you against natural disasters and ransomware attacks, with a flexible platform built on AWS Elastic Disaster Recovery.
- Managed public cloud: Our experienced, U.S.-based teams will efficiently and securely manage your cloud environment so you can focus on running your business.
- Cloud access security: We offer a cloud access security broker (CASB) solution to retain control of your data.
Talk to us today to learn how we can help you eliminate the cloud security mistakes that threaten your business.
