Moving to the cloud, what does it mean and is it secure?
A cloud solution in tandem with robust and vigilant IT culture provides the best option for data security.
Cloud computing is a term that covers a huge amount of business applications, it’s not just about storage, a whole host of things use cloud from Netflix to Internet banking.
The insecurity of the cloud is probably the biggest myth surrounding it. Cloud services from a quality vendor are in truth likely to be far more secure than most in-house networks. This is especially true for the SMB for whom resources are finite and where budget pressures can compromise the approach to security.
Even with a layered security solution that uses the latest surveillance techniques, security hardware, software, firewalls, automated detection systems and has a dedicated team whose job it is to keep the business safe, it’s likely less protected than the average cloud vendor.
Staying in control
For the majority of businesses, data is their most valuable commodity. The idea of sharing that data with another business and trusting them to keep it secure can be hard to come to terms with. Yet that’s what millions of businesses do each day.
It is in the cloud vendor’s interest to keep company data safe and secure. Their business model is built around being trusted to keep data safe. Again, choose a quality cloud vendor and it is no different than choosing an onsite storage vendor. While managing storage many be one of many internal business functions, it will be the primary one for the vendor.
Cloud vendors have better security, service, infrastructure and more redundant systems than most businesses could afford. Compliance tends to come as part of the package, but we make extra sure that all needs are met, even for tightly regulated industries.
Working in the cloud doesn’t mean handing over company data and letting someone else take care of it. It’s a highly customised solution built around the limits set by a business. That includes the security and control needed to work comfortably. Either the public cloud or private cloud can be used, but if neither fit the bill perfectly, a hybrid solution is available.
Private cloud solutions provide a totally secure environment where only the company has access to data, maximising all the benefits of cloud computing with the knowledge that data is completely secure. By integrating secure networking, data is safe during transmission too.
Data breaches
Barely a day goes by without news of a high profile data breach, hack or theft of company data. All organisations are at risk from data theft, loss or malicious hacking. Every businesses data is valuable to someone, so it’s essential to protect it.
A security engineer looking from the inside of a business outward has no idea of their security is good enough. It’s only when someone is on the outside trying to get in that the holes are found. This is the only effective way of finding out if your network security really is good enough.
The vast majority of businesses have never done penetration testing or had an external security audit. Yet every business should. Unfortunately, many simply don’t have the time, expertise or resources to dedicate to such a detailed task. This is something Excalibur run on a regular basis for every business we work with.
External threats are always improving and evolving. Hackers and malware are always finding new angles of attack and methods to exploit weaknesses in network infrastructure. Businesses need cloud security solutions that can keep up.
The only defence against data loss or malicious programming is multi-layered. The combination of a quality firewall, intrusion prevention systems (IPS), breach detection system (BDS), DMZ, antivirus, anti-malware and phishing protection. That’s before you get to proactive defences.
External threats are one thing, but internal threats are also something a business has to face. Whether accidentally or otherwise, data can be lost from within the organisation. The rise of BYOD and wireless networking have opened up potential security holes that need careful management to avoid loss.
Staying secure
Devices are an obvious source of hacking, in fact 1 in 5 people have had their handsets lost or stolen. Businesses can use a cloud based Mobile Device Management (MDM) system to force encryption, remotely wipe and control their mobile fleet. MDM is also a great tool for productivity and workforce monitoring.
Printers are a not-so-obvious cause for security concern. If they are networked it’s extremely important to assess how secure they are. They can often be a weak link in a company’s defences. The prevalence of public shares that are open to the internet and often difficult configuration options leave a network potentially open to attack. There is a lot of work that needs to go into securing a network printer, which can be confusing, especially for those with little technical experience.
The biggest culprit for leaving a printer open to attack is installing it with the default settings. Much like leaving a router with manufacturer’s configurations and passwords, the defaults are known to many. These defaults offer hackers plenty of opportunity to attack your network at their leisure. Unfortunately, installing and forgetting network hardware is prevalent in many businesses without their own IT departments.
By its very nature, a network printer has to be opened up to be useful. It has to be made part of a network share, can require FTP to be running and be accessible across networks or IP ranges depending on how an office is set up. Without careful configuration, this can leave the printer and the network vulnerable to attack.
It’s important to understand that if a printer is not configured and protected, security implemented in other areas could be rendered useless. It’s best to change the default configuration, password, login and network addresses right away and provide defence in depth for your entire network. Configure the share for an IP range and block external traffic to the printer wherever possible.
Cloud based productivity service Office 365 from Microsoft has recently added a Service Assurance Dashboard that simplifies managing security. It sits inside the Security and Compliance Centre and provides a one stop shop for notifications on privacy, security and compliance within an Office 365 infrastructure.
The prime directive of the Service Assurance Dashboard is risk assessment. To deliver the information needed to make informed decisions about how Office 365 is used and how safe company data is within the platform and any other security considerations pertinent to using it.
The Service Assurance Dashboard allows businesses to:
• See how Office 365 implements security controls and how those controls are tested
• Access independent audit reports including SSAE 16 / SOC 1, SOC 2 / AT 101, ISO 27001 and ISO 27018
• Offer insights into encryption, incident management, tenant isolation and data resilience
• Learn how to use Office 365 security options to best effect
There is also a lot of information available about how Office 365 controls data, implements a control, tests and evaluates those controls, and how independent auditors also evaluate the same controls. There is also a very useful map of Office 365 internal controls.
The information available within the Service Assurance Dashboard is very useful for assessing risk. There are also FAQs, tutorials and other resources that enable you to make the most of the protections available within the platform.
As Microsoft explains ‘Tens of thousands of organizations already use Office 365 Service Assurance and have indicated that they are saving a significant amount time in evaluating the security, privacy and compliance of Office 365. Information available through Service Assurance such as the ‘Customer Security Considerations Workbook’ have helped customers secure their Office 365 service with features/configurations that they manage.’
The reality of the threat to corporate networks
65% of large firms detected a cyber security breach or attack in the past year.
68% of breaches experienced are viruses, spyware or malware, these are also typically the types of breaches that cause most disruption to businesses.
£3M was the largest cost reported of a security breach, with £36,500 being the average for a large business.
Is the cloud for you?
67% of businesses say cloud services are critical to their organisation. By May 2015, UK cloud adoption reached 84% in both private and public sector businesses.
