How to Fortify Your Cloud Security

With the spread of COVID-19, businesses have faced new challenges. Needless to say, many enterprises are rethinking how they’ve been doing work and what that work will look like. In fact, according to Fugue’s recent State of Cloud Security Survey, 83% of companies surveyed are transitioning to 100% distributed teams. And yet, with this move, 84% are concerned about cloud security during the transition, with 92% specifically concerned about being vulnerable to a major cloud data breach.

Historically, any major event—from the Olympics to a natural disaster—comes with an influx of bad actors perpetrating scams and other opportunistic attacks, and we’ve seen this with COVID-19. Whether the event is exciting or terrifying, the distraction offers bad actors an opportunity to bypass security defenses. But how should organizations think through an appropriate strategy to deal with such new challenges?

Change is difficult but necessary

While it may be tempting to institute a major security overhaul to deal with these increased threats, for most businesses, radical changes should not be the immediate response. Simply put, it’s impossible to implement sweeping change to systems and processes during unpredictable times. Disruptive change opens up new vulnerabilities that malicious actors can exploit, especially when the changes are implemented with such haste that the implications of the disruptions are not clearly understood or identified.

Instead, companies that are managing change successfully are doubling-down on key security initiatives and pushing out the rest. Determine what’s changed in the world, how it affects your operations, and then prioritize controls and capabilities that help deal with that change.

If your people can’t work, your business won’t run

One of the most fundamental and painful changes for many organizations has been the sudden shift from a 5%–10% remote workforce to a 100% remote team. The systems needed to handle it often aren’t in place.

For example, entire call centers might be staffed with contractors who used to work full-time from a company facility, and used fixed workstations to access an internal app on the corporate network. Those same call centers may also have outsourced software testers that accessed a client’s code only from their employers’ dedicated machines and networks. Now those contractors can’t do anything, so the call center can’t serve customers and new code can’t be tested. Operations grind to a halt, as demonstrated at many organizations in recent months.

The lesson here is to look for more resilient methods for keeping your people working when they can’t get to the office.

Here, a critical security initiative is to give workers access to key applications, so that they can continue their jobs. It sounds simple, but in practice, it’s been quite difficult for many. Traditional solutions, such as virtual private networks (VPNs), haven’t worked well during these unprecedented times, as organizations have struggled to install required VPN software on employees’ and contractors’ machines. Even large providers of VPN solutions haven’t been immune to the challenges of getting tens of thousands of new VPN users up and running.

The lesson here is to look for more resilient methods for keeping your people working when they can’t get to the office. For example, Google has used a “zero trust” approach that scales to over 100,000 workers easily, for almost a decade. It’s been so successful that they’ve built on it to develop BeyondCorp Remote Access, a cloud solution that allows employees and extended workforces to access internal web apps from virtually any device, anywhere, without a traditional remote-access VPN.

Remote work blurs the line between personal and business

Another common observation in recent months is that workers, now stuck at home, struggle to balance work time and personal time. Without experience managing this, people find that they can’t focus, don’t know when to shut their machine off, etc.

However, there is a security aspect to this blurring as well. A common security control is to forbid workers from using the same machine and account for personal use (such as checking personal email, surfing the web, or accessing social media) and for business use (signing in to payroll systems, developer portals, corporate networks, and so on). You don’t want someone to pick up a password-stealing virus while visiting a chat room, then sign in to a corporate design system.

This is easier to enforce when employees use their business workstations at the office and then use personal computers at home. Enforcing this gets much more difficult when everyone is working from home, often on a single machine.

For example: A financial analyst might be working on quarter-end close in the morning, shift to taking a lunch break and surfing the web, and then shift back to the corporate financial systems. If the analyst inadvertently downloaded malware while surfing, attackers may access the network remotely and gain early access to financial information. They may later access other confidential data as well. In short, an unexpected remote workforce may result in more threats entering the corporate network.

In the UK, 90% of the cyber data breaches in 2019 were caused by human error, and this was before COVID-19 hit the UK.

The lesson here is twofold. First, make sure that all workers’ machines have effective security technologies—such as antivirus software and two-factor authentication—in place to deter phishing, malware, and other threats, and make sure they get the latest updates.

Second, and more importantly, make sure your security monitoring is up to snuff so you can detect unusual behavior, such as a worker’s machine connecting to a dodgy web domain that no one else has accessed before. The technology to harden worker’s machines, to detect new threats, and to monitor unusual activity exists today. It is easily deployed and is much more effective than earlier technologies, so take advantage of it.

And when considering the human element, remember that human error is often just as much of a threat—if not more so—than outside malice. According to the CybSafe analysis of data from the UK’s Information Commissioner’s Office (ICO), 90% of the cyber data breaches in 2019 were caused by human error, and this was before COVID-19 hit the UK. This is why the biggest thing employees can do to help IT secure data is to remain vigilant for potential threats.

It’s true that no one knows how long the current situation will last, let alone what will come afterward, but the need for effective cyber security remains constant. Fortunately, organizations are showing success with approaches like zero trust and strengthened security monitoring that enable their teams to work securely and effectively in times of uncertainty.

Article Provided By: Forbes

 

If you would like liquidvideotechnologies.com to discuss developing your Home Security System, Networking, Access Control, Fire, IT consultant or PCI Compliance, please do not hesitate to call us at 864-859-9848 or you can email us at deveren@liquidvideotechnologies.com.