Story image

Expert explains fighting cloud’s ‘biggest security risk’ – the user

20 Mar 18

Businesses around the world are in a frenzy to either adopt cloud services or optimise their current systems.

Research from Forrester forecasts spending on public cloud platforms, business services, and applications to reach US$236 billion by 2020. With cloud spending predicted to be six times that of IT spending over the same period, Routed director Benhamin Coetzer says a cloud strategy is how companies will innovate faster and more cost effectively. 

Coetzer’s company Routed is a neutral cloud infrastructure provider, and he asserts that while cloud providers take responsibility for securing the cloud, only the organisation itself can secure how they actually use the cloud.

“Proper implementation of user behaviour analytics is essential to enable the organisation to protect itself from one of the greatest security threats - the users themselves,” says Coetzer.

“This approach will allow for introspection and, in an ideal situation, proactive response to potentially malicious actions as they occur.”

A problem, Coetzer says, is that the majority of larger organisations today seem to focus more on enterprise hosted applications and perimeter security to safe-guard business applications and data, often forgetting about the problem within.

“A firewall and a VPN concentrator is placed between users and IT resources and no second thought is spared to security and audit management of business data,” Coetzer says.

“Perimeter security alone is not nearly enough. If a user account is exploited and an attacker gains access to your ‘secure network’, they have carte blanche on any business data and applications that lives inside that network.”

Coetzer says it doesn’t matter what side of the firewall the user happens to find himself, business IT resources should be treated with the stringent access control and user authentication regardless of the circumstances.

“Business should look to the principals inferred by technologies such as Google BeyondCorp and Cloudflare Access to change the mindset around security implementations,” Coetzer says.

Coetzer believes policies and processes must be put in place from the very beginning to ensure cloud security, like secure and reliable user identity verification processes such as two factor authentication along with access control management with granular levels of Roll Based Access Control.

With these policies in place businesses will be able to ensure its users are only consuming applications and data that they are authenticated and authorised to access.

The message of cloud security certainly seems to be getting to businesses, as Gartner has forecast spending in the cloud security market to reach US$93 billion by 2020 while IDC has predicted US$101 billion.

Coetzer says this huge investment in cloud security is certainly a positive but hopes it doesn’t indicate an overly cautious market.

“New operating models for security are needed as this could possibly slow down enterprise adoption of cloud as CIO’s react cautiously to cloud adoption,” Coetzer concludes.

McAfee named Leader in Magic Quadrant an eighth time
The company has been once again named as a Leader in the Gartner Magic Quadrant for Security Information and Event Management.
Symantec and Fortinet partner for integration
The partnership will deliver essential security controls across endpoint, network, and cloud environments.
Is Supermicro innocent? 3rd party test finds no malicious hardware
One of the larger scandals within IT circles took place this year with Bloomberg firing shots at Supermicro - now Supermicro is firing back.
25% of malicious emails still make it through to recipients
Popular email security programmes may fail to detect as much as 25% of all emails with malicious or dangerous attachments, a study from Mimecast says.
Google Cloud, Palo Alto Networks extend partnership
Google Cloud and Palo Alto Networks have extended their partnership to include more security features and customer support for all major public clouds.
Using blockchain to ensure regulatory compliance
“Data privacy regulations such as the GDPR require you to put better safeguards in place to protect customer data, and to prove you’ve done it."
A10 aims to secure Kubernetes container environments
The solution aims to provide teams deploying microservices applications with an automated way to integrate enterprise-grade security with comprehensive application visibility and analytics.
DigiCert conquers Google's distrust of Symantec certs
“This could have been an extremely disruptive event to online commerce," comments DigiCert CEO John Merrill.