Magazine menu Close Magazine menu

cloud computing

Latest stories

cloud computing

Dispelling the myths and misconceptions: Is the public and hybrid cloud really secure?

  • min read
    • There's no denying that securing applications and data across an increasingly diverse range of computing environments is challenging. On the one hand, today's business leaders are under constant pressure to innovate and keep up with a rapidly evolving market. On the other, security presents a constant thorn in their sides in an age when major data breaches make headlines almost every day. But, while the naysayers might dismiss cloud technologies as disruptive and inherently less secure than traditional in-house computing, they're missing an important point. The reality is that it's generally not the cloud itself that's the problem. As with almost all data breaches, the human element is usually to blame. This might include factors such as inefficient risk assessments, mismanaged access controls, poor data redundancy and a variety of other threats, most of which stem from within the organization. The common misconception that the cloud is the source of these challenges is why software-as-a-service has yet to become an established and trusted way of doing business in many parts of the world. Dispelling the myth of cloud (in)security Let's get one thing straight: the world's major cloud data centers – operated by the likes of Amazon, Google and Microsoft – are some of the most secure environments on the planet. This really shouldn't come as a surprise, since these companies are some of the most powerful in the world. They have access to the financial resources, expertise and bleeding-edge tech on a level that few organizations could ever dream of having. Not only do they have 24/7 physical controls like security guards, video surveillance and perimeter fencing akin to that of a maximum-security prison, they also offer administrative and technical controls to safeguard the data in their care from hackers. Information security and integrity are at the very core of what these major technology providers do, hence they strive to eliminate every single point of failure with built-in redundancies and automated rollovers. They distribute data across many different machines in many different locations to protect it from threats like natural disasters and hardware failures. The cloud potentially offers improved security from an administrative perspective by reducing the need for customer-controlled security layers. Some cloud providers and server colocation vendors also offer a fully outsourced security operations center (SOC), which is ideal for smaller businesses, who are often targeted en masse by threats like phishing scams and malicious advertising. Even in cases where migrating to the cloud doesn't provide improved information security, the greatly reduced capital expenses can offer more financial control to invest in security. So, where do the threats come from? Now, I'm not saying that the world's biggest data centers are impenetrable fortresses – but they're the closest thing to it. Why is it then, that major data breaches targeting cloud-hosted digital business assets are always making headlines? The weakest link isn't the technology – it's the people. This is often the case when managing complex, hybrid cloud environments in which businesses use a blend of public infrastructures (like Amazon Web Services (AWS)) and an on-premises or hosted private cloud consolidated across a wide-area network (WAN). However, with the right approach, the hybrid cloud brings multiple benefits, such as decreased capital costs and greater flexibility. Here are the main threats to hybrid cloud security you need to overcome: Mismanaged access rights One of the greatest advantages of cloud-hosted resources is they're accessible from any device with an internet connection. This can also be its greatest drawback in an age when social engineering attacks dominate the world of cybercrime. After all, cybercriminals aren't always stereotypical hackers staring at lines of code whizzing across a monitor. Instead, they increasingly rely on tactics of subterfuge and manipulation to encourage their victims to surrender confidential information, such as login details. Social engineering tactics are often used to put their malicious code to work. To overcome these risks, IT administrators must enforce multifactor authentication (MFA) to reduce reliance on passwords. This way, those accessing the system, particularly from an unknown device or network, will need to verify their identities with a secondary authentication method. This might be a fingerprint scan or a temporary security token like an SMS code. Because the secondary verification method is dynamic, or an innate characteristic of the user (like a retinal scan or fingerprint), it's far better protected from social engineering attacks. Unprotected APIs Hybrid cloud deployments depend on application programming interfaces (APIs) to ensure the interoperability between different infrastructures – such as in-house data centers, public cloud resources and hosted private clouds. These serve as conduits for ensuring the seamless flow of data between the two systems to provide an uninterrupted experience for end users. But when unprotected, these API endpoints can leave sensitive data exposed. This vulnerability is often exploited when data is being transmitted across insecure devices and connections. Other attacks may exploit misconfigured APIs to coerce the system into doing something that would lead to its compromise. For example, attackers started exploiting misconfigured Kubernetes APIs to issue commands to it; in doing so, they downloaded and launched a malicious payload from outside. Since APIs are effectively gateways – access points into a public cloud application or service – IT administrators need to take extra steps to secure the data that flows through them. The easiest way to protect it is to ensure that data never leaves an endpoint unencrypted. This way, even if a hacker does get their hands on data exposed by a vulnerability in the API, it will be unusable to them. Today's AES-256 encryption algorithms would take 3×1051 years to crack without knowing the encryption key, by which time even the youngest and most patient hacker might just give up. Insecure third parties In hybrid cloud environments, your vendors are an additional source of risk. 181 third-party vendors access the average business network every week, leading to two-thirds of companies experiencing data breaches linked to one of their vendors. Unfortunately, some cloud vendors are vague when it comes to critical factors like data ownership and governance. They may not have the necessary controls in place to ensure that your data is safe during its migration to the cloud or when it's hosted on their own servers. To reduce the substantial risks posed by third parties, businesses must carefully vet any cloud vendors they choose to work with. Enterprise managers must always verify data ownership and security controls and ensure that everything is clearly defined in their service level agreements (SLAs). They need to know exactly what the provider does with their data, which access controls and permissions they have in place, and which resources they provide if something goes wrong. Any agreement should ideally be reviewed by an attorney before signing. Breaches of regulatory compliance Even if you have all available security measures in place when migrating data to the public cloud, there's still the matter of compliance. Many data-processing regulations, for example, require data belonging to citizens of a particular country to be stored in the same territory. In some ways, this contradicts the very ethos of the cloud as a decentralized and distributed computing environment. To further complicate matters, most cloud providers cannot guarantee the physical location of your data, although there are some exceptions: AWS, for example, can work in regional mode to avoid moving your data out of the territory. Fortunately, hybrid cloud deployments are ideally suited to highly regulated industries, since they provide more control over where data is physically stored. For example, a healthcare provider subject to HIPAA and HITECH regulations might keep patient health information (PHI) in a private cloud such as an in-house data center or server collocation facility. A GDPR-compliant company might do the same to ensure that customer data remains in the EU, while business applications are moved to the cloud. In the end, the hybrid model gives you more control over where your data is stored and how it's protected. Hybrid cloud computing – the first step towards innovating at scale The key to successful hybrid cloud deployment is a security-first approach that provides IT administrators with full visibility into their digital assets. With the right management solutions and software layers, enterprises can build a single cohesive environment that incorporates the best of both worlds. A hybrid cloud deployment is no more or less secure than on-premises virtualization, but with the right approach, it can become even more secure. All it takes to get started is to select a cloud security product that's scalable and adaptable to your needs.
Going green in IT bulb stairs

Reduce your company’s IT carbon footprint, and save money

  • min read
    • While digital usually seems non-physical and ephemeral, digital services run on servers. Servers use energy still mostly produced by burning fossil fuels. This means digital services have carbon emissions and are part of causing climate change. Many of the big IT companies are now reporting their carbon emissions. The numbers look similar to the emissions of whole countries. In 2018, Amazon emitted 44.4 megatons of carbon – as much as Finland in that same year. Most of that is third-party carbon emissions, such as from packaging and transport of Amazon goods and emissions from business travel. Apple's carbon footprint wasn't much less in the same year, at 25.2 megatons –  similar to Mongolia. If we don't count emissions from producing Apple-branded goods, their emissions are just 0.6 megatons — more like the Gambia. Half is from business travel, another 30 percent from employees' commutes. Google's carbon footprint was — 1.2 megatons, comparable to Liberia. Comparing these IT companies' emissions to countries shows their contribution is significant. So what can you do to minimize your company's impact? 1. Use scalable architecture With the rise of cloud computing, many businesses started migrating their infrastructure to the cloud. The typical approach is renting an always-on server that safely exceeds the business's current peak load. But people use the internet, and your services, differently depending on time of day, so loads differ a lot. The load at night is probably significantly lower than at midday. For software with scalable architecture, load balancers can automatically add more computing power on a single machine or add more servers depending on the number of requests you're receiving. That means you don't waste money and energy on servers running in idle mode. Most cloud providers offer both horizontal (adding more machines) and vertical (adding more power to the machine) load balancing. To use load balancing, you'll need to build your services with scalability in mind, but once you start, it will save you money and lower your cloud infrastructure's carbon footprint. 2. Use greener providers Where does your cloud provider get its electricity? It may depend on the region. Sweden relies mostly on renewable energy, such as wind and water. France heavily employs nuclear power, which is also low emissions. Poland gets most of its energy from burning coal. So, your company's carbon emissions vary depending on where the data center that provides its cloud computing is based. Bigger services such as Amazon Web Services (AWS) and Microsoft Azure tend to pay more attention to that aspect of sustainability. AWS users can choose where their computing power comes from using a map that shows which data centers run on green energy and which do not. Microsoft built a low-carbon Kubernetes scheduler with a group of scientists. It automatically migrates your tasks to different data centers around the world to maximize green power use, minimizing your carbon footprint. The scheduler can be ported to work with other cloud providers too. You don't necessarily need to choose AWS or Azure if you want to go green. The Green Web Foundation has a directory of smaller providers that use green energy. Running computing on your own hardware usually uses more energy, though. Cloud systems conserve energy by allowing a more even distribution of tasks among computing powers. 3. Choose your programming language wisely Programming languages differ in several ways, including their logic, syntax and capabilities. They also differ in resource consumption. JavaScript and Python tend to consume more resources than compiled programs in languages such as Fortran, C++ and Rust. Object-oriented languages, in turn, consume more than imperative ones. More resources means more power, means more emissions. Faster doesn't necessarily mean greener. A program may be executed for longer but consume less energy. You're more likely to choose programming languages based on the tasks they perform, the abilities of your workforce and the rest of your technological stack, but it's worth taking into account the energy aspect. No matter what the language, optimizing code helps lower your carbon footprint, making it faster and less power-hungry. Profiling your software and rewriting ineffective parts can have a significant impact. 4. Optimize your web pages The average web page is now more than three megabytes. The bigger the page, the more power needed to transfer it from server to client, and to display it. You may think that doesn't account for a large part of carbon emissions, but the Green Web Foundation disagrees. Green Web found running a background video on a Web page resulted in as much carbon as the project team's commutes. Remember that 30 percent of Apple's total emissions coming from its workers' commutes? Now you see the scale. There are many tools for optimizing web pages. Google Lighthouse scores your website on performance, accessibility, best practice and search engine optimization (SEO). The Green Web Foundation introduced another tool, Greenhouse, that analyzes pages and checks which domains run on renewable energy. It's not as useful as Lighthouse for optimization, but it can help ecologically savvy organizations choose service providers. You can also use The Green Web App to find out if your site is hosted on a server that runs on green energy. Unfortunately, not many hosting providers publish information about the greenness of their electricity. Save the planet while saving money For some, trying to prevent global warming is a compelling reason to make an effort. For others, it's not. But when it comes to IT, going green usually means saving money too. For example, after optimizing your hosting and code, you will need less computing power, saving money. Your website will load faster, meaning fewer customers close it before it fully loads. And the faster your site, the higher search engines rank it, so more customers will see it.
by Innovating leaders.
Innovative tech.
About Secure Futures

Secure Futures magazine is your go-to business guide for opinions, trends and insight into the world of technology and cybersecurity. We help your business to bring on the future. Brought to you by Kaspersky, the global cybersecurity experts.

  • For all other countries