Magazine menu Close Magazine menu

cloud security

Latest stories

security as a service cloud migration

Why you need Security as a Service for cloud migration

  • min read
    • From small-to-medium-sized businesses (SMBs) to the biggest multinationals, use of cloud computing infrastructure and services is growing exponentially. Spending on end-user information security and risk management will reach 188 billion US dollars by 2023, according to leading technology researchers Gartner. This vote of confidence in the cloud could partly come from greater confidence in Security as a Service (SECaaS.) In our interview, Curtis Franklin, Senior Editor at widely read cybersecurity news site Dark Reading, says SECaaS is a consideration in many cloud migrations, but not the primary factor. Not all businesses are ready to migrate everything to a cloud environment – or in other words, to migrate to Enterprise as a Service (EaaS) – but their cloud assets still need enterprise-grade, cloud-based security. Firewall plus access less identity IT departments have widely accepted security solutions like web application firewalls (WAF,) security information and event management (SIEM) and encryption. Franklin says user identity is there: "Cloud access security brokers (CASB) are an option: On-premises or cloud-based software that sits between cloud service users and cloud applications. It monitors all activity and enforces security policies. Some would have called it the next-generation firewall. It's a firewall and access management in one application, but not so much identity." In the cloud, there's a lot of analytics data, or Security Operations Center as a Service (SOCaaS,) that can be added to user credential management, managing encryption keys and identities. What companies should look for Look at the expertise your cloud service brings to the table. Is it just a service, or a service with people? The security of application program interfaces (APIs) that connect data and applications in the cloud is also critical. Franklin warns against introducing vulnerabilities to take advantage of a new cloud-based experience. "Every time you have one application connecting to another, you have a place where a vulnerability can exist. In the cloud, there are many of those." A lower Total Cost of Ownership (or TCO – direct and indirect costs of an application or system) isn't a given unless the enterprise manager has carefully crunched the numbers. Franklin cites cases where companies on volume-based cloud service pricing schedules didn't know their actual volume, or the cloud got unexpectedly popular with staff, so they ended up with high costs. "Many now understand you're not always reducing your costs, but shifting it. You're exchanging Capital Expense for Operational Expense. For a lot of customers, that's fine or better, because it's taxed differently and hits a different part of the annual report. You're taking the money you'd spend anyway and getting more value for it." Sometimes when you're buying SOCaaS, you're buying expertise in the form of people you can't otherwise find. You're trusting the cloud provider to find and rent those minds to you, rather than trying to find them yourself. Built-in reporting and customer support are critical. If an attacker knows more about your infrastructure and environment than you do, it's an opportunity for an exploit. Franklin suggests using these services to stay on top of what's really happening in your environment, as opposed to what you think is happening. What about cloud service agreements? Review cloud service agreements (CSAs) to ensure you'll get the value you need from the service. There must be enough flexibility to set things up so you can realize that value. Know what you want out of the relationship: Harmonious functionality between the cloud service provider and your existing applications. Everything flows from that. Reporting can help you understand what you're getting from the service. Franklin says, "Are you paying for notification? Are you paying for integration with other systems that will automatically act on signals received? Will it play a role in procedural controls or is it going to be active in process control? You need to know, because if it's process control, there's automation. If it's procedure control, you're getting notifications people will have to review. It's critical to know upfront, as part of your CSA, which it is and where those notifications are going." How will SECaaS solutions evolve? Franklin believes SECaaS solutions will evolve in two ways. On the one hand, there will be SECaaS solutions that augment the intelligence of IT staff, letting analysts and engineers be more productive. On the other hand, some will replace human analysts and engineers. The human replacement may be of more interest to small-to-medium sized business, and automation of more interest to larger enterprises. He says businesses should know which path they're taking when they talk to a service provider. "Are they going to make your current staff more effective, letting you avoid hiring or taking over staff roles?" There'll be much more solution development in authentication and access management because it's a complex piece of the security puzzle. Franklin sees much of that going to the cloud service provider that's handling multi-factor authentication. Whether it's a secondary factor that comes through an app, an SMS or something else, the cloud will handle it. He says more companies want the cloud provider to handle all access management, because it's complicated. They want to be able to do it for their employees on both corporate and personal devices. SECaaS bundled into the cloud service provider services, or bought by the business from a vendor, is an excellent way to do it.
river privacy predictions 2020

Never the same river: Predictions for privacy’s next decade

  • min read
    • Your phone. Your smartwatch. Your smart home. Your data is now everywhere. Collecting personal data makes services better for the user, but over the past decade, multiple cases have demonstrated the risk. In privacy, you never step in the same river twice. Concerns, threats and priorities are always changing. What privacy hazards will we see in the coming decade, and how should your business prepare? 1.  Governments will allow themselves to access more of citizens' data It's already happened, but in the next decade, governments around the world will adopt laws that let them access more of citizens' data. They may cite many reasons, including terrorism, instability and the already widespread use of the same data by business. 2.  The gap between regulation and the real world will only grow While the rationale for it is clear, enhanced access to people's data carries risks, such as unauthorized access and leaking information. It will be a big challenge for regulators to keep adapting regulations at the same speed as new technologies come into play. Companies have been slow to change how they're dealing with user data. The only recent significant change has been asking users to consent to how the company will use their data, now mandatory in many countries. We don't see any strong trend toward adding security to protect sensitive user data. There's already a growing gap between regulation and real-world practice, making regulation seem toothless. 3.  Counter-tools will fuel a privacy cyberbattle The trends I've already mentioned will encourage innovators to develop privacy protection technologies. The tech-savvy will adopt these, and more technologies will arise to circumvent them. It will be a privacy cyberbattle. Meanwhile, users will become more proactive about their privacy. There'll be high demand for password managers, virtual private networks (VPNs) and tokens (automatically generated codes) for two-factor authentication (2FA). However, protection mechanisms like 2FA tokens and password managers are just at the endpoint. Attacks and misuse are often at the backend. These tools protect the local environment, but they don't protect against attacks and abuse of systems such as the cloud. And as cloud-based tools go from being leading-edge to indispensable, all employees will need to understand where the risks are. VPNs protect against some data collection (real IP-addresses, geolocation) but don't protect against users voluntarily sharing data with services like Google and Facebook. 4. We'll keep getting fooled by fun Cybercriminals can use this strategy to attack businesses, targeting employees for personal information, and using it to access business systems and data. 5. We'll see new attacks on democratic process and  protections against disinformation These attacks have been with us for many years, and there's no reason for them to stop. Technology for fake visual and audio IDs already exist, and with the political pendulum of a US presidential election, these will bring undesired attention and abuse from multiple parties. 6. Internet of Things (IoT) vendors will scale up security investment The last few years have been turbulent for the cybersecurity industry. IoT-specific malware, data breaches and disinformation campaigns across the globe have all been challenging. This activity will push vendors to a new level of collaboration for the sake of security. Amazon, Apple, Google and the Zigbee Alliance have announced they're creating a working group to develop and promote a royalty-free connectivity standard. This will increase compatibility among IoT products and embed fundamental security. I hope others will follow their lead. All in all, we're looking at an interesting decade ahead for privacy. The challenges will be significant. Businesses will be a key player in securing the privacy of both their employees' and customers' data. Let's hope solutions from innovators follow fast on the heels of each new threat. In the meantime, by putting in place adequate, regular privacy training and cyberthreat education for all employees, any business can be part of the solution.
picking right tech

When there’s too much choice in tech, get your focus right

  • min read
    • We have too much tech and too much choice. Many of tech's challenges are in choosing the product, and only afterward realizing its limitations and the consequences of our choice. I understood this only recently, after working in tech nearly 40 years. I don't know why it's taken me so long to make this brilliant deduction. I enjoy helping others make these choices. Almost every day, I'm either writing, researching or discussing tech choices for others. But just as the shoemaker's children go barefoot, my own tech choices are often fraught with indecision, or worse, no decision. It all rests on human foibles Yesterday, I was on a phone call with a friend who is as technical as they come. He helped create some of the internet's early protocols – ways transferring data between networks that more or less create the internet. We were commiserating about the quirkiness of the video conferencing application Webex when trying to support a hundred-person conference call. It's fine for the video conference itself. The video and audio quality are usually solid. But the 'soft support' rests on the foibles of how humans use tech, like holding a practice session for the conference, notifying everyone of the call and sending out the slide deck. It's real work to explain what to do to organizers and how to create standards to make the call go smoothly. Learn from the 1980s' portable PC wars Let's draw a dotted line back to when I worked in the bowels of the end-user IT support department of Gigantic Insurance in the early 1980s. We bought PCs by the truckload to place on the desks of thousands of IT staff who, until then, had a telephone and, if they were lucky, a mainframe terminal. We bought IBM PCs because back then because that was the only choice for corporate USA. Then Compaq came along with something IBM didn't yet have: a portable PC. Well, sort of portable. It was enormous. It weighed about 30 pounds (14 kilograms) and didn't quite fit into airplane overhead lockers. When Compaq announced their portable PC, selling for more than $5000, our executives felt conflicted. Our IBM sales reps, who had invested many years in golf games with them, were trying to convince us to wait for a year until the IBM portable PC would come to market. But once we got our hands on the IBM prototype, we could see the Compaq was superior. It was already available. It was lighter, smaller and ran the same apps. We recommended Compaq and started buying them in droves. That was the start of the 'clone wars' that unleashed a new era of technology choices on the corporate world. By the time IBM finally came out with their portable PC, Compaq had improved theirs again, so they kept ahead of IBM. It's why we get frustrated when we finally choose our technology and then live with the consequences. Knowing which questions to ask How does this apply to buying business cybersecurity products? Many of us are still looking at the wrong things when deciding what to buy, or don't know which questions to ask. Know what problem you want to solve, and you'll choose your tech differently. Here are some common examples. Have you picked an email encryption product or VPN based on something other than ease of use? Don't be surprised when your staff rebel against using them. Are you running regular phishing awareness programs and cybersecurity training across your business? Phishing is one of the most destructive attacks, and getting users to understand their behavior is risky is the best prevention. Have you recently tested your disaster recovery procedures to find out why your backups don't protect key data elements? Don't wait until you have a ransomware situation to find out you missed a collection of files. Spend the time now to find these and ensure they're well protected. Can you find out if your cloud storage is secure enough? Do you even know which clouds you're using? Do the hard work now rather than waiting for something bad to happen. Have you examined your whole software supply chain? It's easy to overlook a few spots and then suffer data loss, ransomware or denial of service attacks. You might find personal Github pages, or resellers running tools whose security you can't easily verify. The time to work this out is now. Going beyond the specs means taking a step back and throwing out assumptions. Before you start looking at solutions, do the hard work of understanding the problem you really need to solve. This article reflects the opinion of the author.
by Innovating leaders.
Innovative tech.
About Secure Futures

Secure Futures magazine is your go-to business guide for opinions, trends and insight into the world of technology and cybersecurity. We help your business to bring on the future. Brought to you by Kaspersky, the global cybersecurity experts.

  • For all other countries