sb-au logo
Story image

Expert explains fighting cloud’s ‘biggest security risk’ – the user

20 Mar 2018

Businesses around the world are in a frenzy to either adopt cloud services or optimise their current systems.

Research from Forrester forecasts spending on public cloud platforms, business services, and applications to reach US$236 billion by 2020. With cloud spending predicted to be six times that of IT spending over the same period, Routed director Benhamin Coetzer says a cloud strategy is how companies will innovate faster and more cost effectively. 

Coetzer’s company Routed is a neutral cloud infrastructure provider, and he asserts that while cloud providers take responsibility for securing the cloud, only the organisation itself can secure how they actually use the cloud.

“Proper implementation of user behaviour analytics is essential to enable the organisation to protect itself from one of the greatest security threats - the users themselves,” says Coetzer.

“This approach will allow for introspection and, in an ideal situation, proactive response to potentially malicious actions as they occur.”

A problem, Coetzer says, is that the majority of larger organisations today seem to focus more on enterprise hosted applications and perimeter security to safe-guard business applications and data, often forgetting about the problem within.

“A firewall and a VPN concentrator is placed between users and IT resources and no second thought is spared to security and audit management of business data,” Coetzer says.

“Perimeter security alone is not nearly enough. If a user account is exploited and an attacker gains access to your ‘secure network’, they have carte blanche on any business data and applications that lives inside that network.”

Coetzer says it doesn’t matter what side of the firewall the user happens to find himself, business IT resources should be treated with the stringent access control and user authentication regardless of the circumstances.

“Business should look to the principals inferred by technologies such as Google BeyondCorp and Cloudflare Access to change the mindset around security implementations,” Coetzer says.

Coetzer believes policies and processes must be put in place from the very beginning to ensure cloud security, like secure and reliable user identity verification processes such as two factor authentication along with access control management with granular levels of Roll Based Access Control.

With these policies in place businesses will be able to ensure its users are only consuming applications and data that they are authenticated and authorised to access.

The message of cloud security certainly seems to be getting to businesses, as Gartner has forecast spending in the cloud security market to reach US$93 billion by 2020 while IDC has predicted US$101 billion.

Coetzer says this huge investment in cloud security is certainly a positive but hopes it doesn’t indicate an overly cautious market.

“New operating models for security are needed as this could possibly slow down enterprise adoption of cloud as CIO’s react cautiously to cloud adoption,” Coetzer concludes.

Story image
The guide to digital security in unstable times
An increase in vulnerability across different sectors has meant that 2020 has seen more than its fair share of cybersecurity incidents. One of the most effective ways to combat the perils of today’s cyber-threats is to gain a better knowledge of the threat vectors looming over the heads of organisations. More
Story image
Ripple20 threat could affect 35% of all IT environments – ExtraHop
The vulnerabilities have the potential to ‘ripple’ through complex software supply chains, enabling attackers to steal data or execute code.More
Link image
VR a leading factor in edge computing, says Gartner
Edge architectures and technologies, including VR, will be an essential component of innovative products and services.More
Story image
SMBs seeking service providers in face of rising cyber threats
SMBs are struggling with their cybersecurity solutions, with three quarters worried about being the target of a cyberattack in the next six months, and 91% considering using or switching to a new IT service provider if offered a better option.More
Story image
Fortinet’s ‘zero trust’ approach redefining security
Cornelius Mare, Fortinet A/NZ Director, Security Solutions, explains why taking a ‘zero trust network access’ approach to cybersecurity requires fully-integrated and comprehensive security services and policies.More
Story image
Is cyber deception the latest SOC 'game changer'?
Cyber deception reduces data breach costs by more than 51% and Security Operations Centre (SOC) inefficiencies by 32%, according to a new research report by Attivo Networks and Kevin Fiscus of Deceptive Defense.More