You’ve no doubt realized by now that cybercrime isn’t going away anytime soon. What you might not know is that approximately 43 percent of all cyberattacks are aimed at small businesses, and the average price per record in breaches is $360. This hasn’t changed with the focus on security in the cloud.

Healthcare organizations are especially vulnerable to cybercrime—more than 2,100 data breaches in the industry have been reported over the decade. According to the Ponemon Institute’s 2019 Cost of a Data Breach study, only about half of breaches were the result of criminal or malicious intent, with the other half attributed to human error and system glitches.

Even though enterprise organizations are aware of the cybercrime issue, fewer than 40 percent claim they’re equipped to handle a complex cyberattack. A key part of keeping your enterprise-sized organization’s data secure is knowing what threats to watch and how to mitigate them. This includes cloud computing and security.

Security Of and In the Cloud

Let’s take a look at the difference between the security of the cloud and security in it. Although they sound the same, there is a distinction. As Amazon Web Services (AWS) explains, security in the cloud is like security in your on-premise data center, but without the cost of maintaining facilities and hardware. It’s the applications and data an enterprise organization runs in a cloud. Its counterpart, security of the cloud, involves the safety of the hardware, software and other parts of the infrastructure that run services and applications.

It’s important to remember that cloud security is only partly the responsibility of the cloud provider. It should be a team effort. Many organizations will shift some security responsibility to a cloud provider when they move their applications and data to the cloud. In the shared responsibility model utilized by Microsoft Azure and AWS, AWS handles infrastructure security, including the physical security of the data center itself, and the customer is responsible for the security of everything else. Either way, it’s essential to decide and document which party is responsible for all the components of cloud infrastructure.

Understanding Obstacles to Cloud Security

Although it helps to think of cloud security as analogous to on-premise cybersecurity, it is important to remember that the cloud brings its own set of security challenges. The main ones are data breaches and loss, distributed denial of services (DDos) attacks, and user authentication. Another source from the Ponemon Institute, The Insider Threat of Bring Your Own Cloud (BYOC), lists the top security risks of cloud services as:

• Loss or theft of intellectual property
• Compliance violations and regulatory actions
• Loss of control over end-user actions
• Malware infections that unleash a targeted attack
• Contractual breaches with customers or business partners
• Diminished customer trust
• Data breach requiring disclosure and notification to victims
• Increased customer churn
• Revenue losses

Enterprise-sized organizations that employ a multi-cloud solution may encounter additional security obstacles. For example, there is a higher risk of misconfiguration, and there are multiple sets of policies to manage. On the other hand, in addition to benefits like scalability, risk management, power of choice, and enhanced productivity, enterprise organizations using a multi-cloud strategy have the security of disaster recovery using automatic failover.

Distinct Differences Between Conventional IT and Cloud Security

Though some elements of traditional IT and cloud security are similar, there are variations. The following list describes some of the differences:

Best Practices for Ensuring Data Security

As we mentioned in a previous blog post, there are some data security best practices that should be implemented (especially by a cloud hosting provider) to mitigate cloud computing security risks: multi-tiered security, awareness, tracking, and physical security. Following these guidelines can help you strategically safeguard mission-critical data.

1. Multi-Tier Security – A multi-tiered approach signifies that multiple barriers and checkpoints are put in place in the event a compromise occurs. For example, the first tier of the architecture is implemented by redundant perimeter firewalls, which protect against malicious hacking and DDoS attempts. The second tier is implemented by the use of private, non-routable IP address spaces. In the unlikely event the firewall is breached, the servers behind the firewall can’t route traffic to the internet.
2. Monitoring, Awareness, and Tracking – With security breaches posing a continuous threat to your data, being well versed and monitoring multiple channels of information is essential in staying atop the ever-changing security environment. In the event of a security notice, vigilant awareness measures must be implemented to swiftly review the notice and determine the severity of it. If the notice is deemed to present a serious threat, there should be patches or set workarounds in place to be applied immediately.
3. Physical Security – All data centers are protected by layers of security, including multiple layers of electronic building and facility access secured by magnetic locks, 24/7 onsite personnel, monitored and recorded closed-circuit cameras, mantraps, and mandatory identity logging of all outside visitors. Hosting providers shouldn’t risk compromising your data by allowing companies with poor security practices to share data center resources. Demand a provider that performs background checks before allowing customers to host.

If you’re planning to join the large number of enterprise-sized organizations moving their workloads to the cloud, we recommend employing the services of a vendor who can partner with you to integrate and secure your cloud environments. At Connectria, we’re at the forefront of protecting sensitive data for customers of all sizes in all industries. Plus, we ensure the highest standards for our customers’ data protection and uninterrupted access to their data.

Contact us to learn more.