Story image

Expert explains fighting cloud’s ‘biggest security risk’ – the user

20 Mar 18

Businesses around the world are in a frenzy to either adopt cloud services or optimise their current systems.

Research from Forrester forecasts spending on public cloud platforms, business services, and applications to reach US$236 billion by 2020. With cloud spending predicted to be six times that of IT spending over the same period, Routed director Benhamin Coetzer says a cloud strategy is how companies will innovate faster and more cost effectively. 

Coetzer’s company Routed is a neutral cloud infrastructure provider, and he asserts that while cloud providers take responsibility for securing the cloud, only the organisation itself can secure how they actually use the cloud.

“Proper implementation of user behaviour analytics is essential to enable the organisation to protect itself from one of the greatest security threats - the users themselves,” says Coetzer.

“This approach will allow for introspection and, in an ideal situation, proactive response to potentially malicious actions as they occur.”

A problem, Coetzer says, is that the majority of larger organisations today seem to focus more on enterprise hosted applications and perimeter security to safe-guard business applications and data, often forgetting about the problem within.

“A firewall and a VPN concentrator is placed between users and IT resources and no second thought is spared to security and audit management of business data,” Coetzer says.

“Perimeter security alone is not nearly enough. If a user account is exploited and an attacker gains access to your ‘secure network’, they have carte blanche on any business data and applications that lives inside that network.”

Coetzer says it doesn’t matter what side of the firewall the user happens to find himself, business IT resources should be treated with the stringent access control and user authentication regardless of the circumstances.

“Business should look to the principals inferred by technologies such as Google BeyondCorp and Cloudflare Access to change the mindset around security implementations,” Coetzer says.

Coetzer believes policies and processes must be put in place from the very beginning to ensure cloud security, like secure and reliable user identity verification processes such as two factor authentication along with access control management with granular levels of Roll Based Access Control.

With these policies in place businesses will be able to ensure its users are only consuming applications and data that they are authenticated and authorised to access.

The message of cloud security certainly seems to be getting to businesses, as Gartner has forecast spending in the cloud security market to reach US$93 billion by 2020 while IDC has predicted US$101 billion.

Coetzer says this huge investment in cloud security is certainly a positive but hopes it doesn’t indicate an overly cautious market.

“New operating models for security are needed as this could possibly slow down enterprise adoption of cloud as CIO’s react cautiously to cloud adoption,” Coetzer concludes.

SonicWall secures hybrid clouds by simplifying firewall deployment
Once new products are brought online in remote locations, administrators can manage local and distributed networks.
What MSPs can learn from Datto’s Channel Ransomware Report
While there have been less high profile attacks making the headlines, the frequency of attacks is, in fact, increasing.
Cisco expands security capabilities of SD­-WAN portfolio
Until now, SD-­WAN solutions have forced IT to choose between application experience or security.
AlgoSec delivers native security management for Azure Firewall
AlgoSec’s new solution will allow a central management capability for Azure Firewall, Microsoft's new cloud-native firewall-as-a-service.
How to configure your firewall for maximum effectiveness
ManageEngine offers some firewall best practices that can help security admins handle the conundrum of speed vs security.
Exclusive: Why Australian enterprises are prime targets for malware attacks
"Only 14% of Australian organisations are continuously training employees to spot cyber attacks."
Exclusive: Why botnets will swarm IoT devices
“What if these nodes were able to make autonomous decisions with minimal supervision, use their collective intelligence to solve problems?”
Bitdefender announces security integration with Kaseya
The new partnership will allow VSA by Kaseya’s cloud and on-premises users to deploy and manage security with Bitdefender Cloud Security for MSPs.