Cloud security issues have skyrocketed as a result of much of our life activity moving online. The activities of malicious criminals have begun to highlight many cloud flaws in the wake of recent events, leading many IT teams worldwide to take notice. Even as cybersecurity threats across the digital landscape have risen during the outbreak, cloud security concerns are quickly coming to the forefront.
Some of the top cloud security threats currently include:
- Remote access enterprise systems are lacking secure setup and security checkups due to a lack of preparedness for a mandatory work-from-home shift.
- End-user education against social engineering continues to be necessary as user credentials are stolen via fraudulent emails and other deceptive means.
- Personal smart home security currently lacks user awareness of safe configuration practices. Previously non-networked devices like thermostats have become outfitted as potential breach points for malicious criminals to enter private home networks.
Cloud security challenges
Security in cloud computing has been a longtime concern. While personal cloud services like Apple’s iCloud have seen their fair share of controversy, the bigger concern currently is with the safety of enterprise and government operations.
Where in-office networks and hardware can be a more controlled environment, remote access introduces more contact points that are open to possible attack. Each connection and component must be hardened with a secure framework to ensure there will be no errant breaches. Under a secure remote work plan, laptops, phones, and network connection devices themselves are all set up and tested for durability by internal IT teams.
Unfortunately, the rate of COVID-19’s global spread meant a rapid shift to work-from-home policies. Unplanned adoption of remote working infrastructure came with incomplete and incomprehensive policies for tools such as cloud server access. Increased use of cloud-based collaboration platforms and virtual meeting systems has led to a strong uptick in IT complications.
Results from a Fugue survey found that nearly every 3 in 4 teams operating on cloud systems have experienced over 10 daily incidents simply due to improper system setup. Anything from storage breaches to relaxed policies on system access has left 84% of workplace IT teams worried they have been hacked and haven’t discovered it yet. Inefficient manual recourse used by most teams introduces human error into the equation, which makes the reliability of cloud troubleshooting questionable.
Threat criminals have taken to exploiting the increase in cloud use, targeting everything from healthcare facilities to online workforce services. With holes in security already existing, human error is yet another point of concern for organizations. IT staff and endpoint users have to remain perpetually vigilant against cyber threats, leading to “alert fatigue” and many other lapses in judgment.
Cloud security threats
Security hazards to cloud computing services are layered in the following ways:
- System vulnerabilities are the technical side of threats that must be handled proactively by IT-capable staff.
- Endpoint user error or negligence is the human side that requires continuous training and education to prevent.
- Malicious cyber attackers are ultimately only as powerful as the human and technical weaknesses in a cloud system allow them to be. However, experience in the manipulation of both technical and human elements gives attackers an advantage.
While zero-day exploits are entirely possible, many attackers can use easier, known vectors of infiltration into an organization’s cloud systems. Here are some specific issues that are affecting cloud use:
Cloud configuration
Misconfigured cloud systems are commonplace at the moment as many workplaces set up remote systems for the first time. A cloud-based framework requires extensive safeguards on the backend to reduce its weak points to online attacks. Adequate time must be given to do a detailed cloud setup, which has left a large number of IT departments rushing through the process.
Fugue’s April 2020 survey cites a lack of policy awareness as a significant reason that these threats are not managed effectively. Also, teams lack proper monitoring and regulations for all the software APIs interacting with cloud services. With many layers of permissions and controls that have not been operations-essential before the present, it’s not surprising that IT teams are underprepared.
Lack of stress testing is an equally concerning issue during the remote work transition. The load of an entire worksite — or dozens to hundreds of worksites — using cloud-based servers requires repeated testing at-capacity. System stability cannot be guaranteed without it and can lead to the unintended functioning of an otherwise secure infrastructure.
With all these issues, unfamiliar procedures are going live while being installed and tested. Simultaneous troubleshooting and course correction are giving IT teams long hours in which they may not be able to perform at their best. Each of these weaknesses may serve as open doors for malicious criminals to gain access.
BYOD work from home policies
Bring-your-own-device (BYOD) policies have been implemented by some organizations to ease the conveniences and flexibility that remote work demands. While this allows companies to offload hardware costs and maintenance onto employees, this creates many potential breach points for corporate IT systems.
As personal and work activities blend through device use, cloud systems are more likely to be exposed to stray malware from unprotected devices. In most workplaces, personal use is intended to be kept separate from enterprise devices with the added benefit of reducing contact with an endpoint user’s unsecured accounts and files.
Onsite networks are secured by firewalls, Wi-Fi routers are safeguarded, and even employer-provided phones are managed by your IT team. They systematically ensure that any surface of possible attack has the most current security protocols and software updates.
The new remote connectivity climate has left many organizations blind-sighted, with few or no remote-ready enterprise computers and phones to provide their employees. Existing malware infections are among one of the many worries with unsecured personal device use. Outdated operating systems and other device software can easily be abused by malicious criminals. Other family member’s devices on an employee’s home network can be vectors for malware as well.
Even with secure IT-vetted hardware, much of the prior onsite protections become irrelevant with no process in place to check each user’s home network security.
Social engineering and other cyberattacks
Threat criminals have increased their efforts to tap into any unattended holes in cloud architecture to profit or disrupt organizations, even at such a sensitive time.
Phishing has attackers pose fraudulently as trusted individuals or authorities to persuade victims out of their valuables or access to private areas. This term usually applies to online theft of account credentials or money. Social engineering methods like this have been an attractive method to acquire cloud system access from employees and individuals alike.
Phishing with malware payloads works by impersonating trusted parties and baiting victims into opening infected files or links. Employees can be targeted to infect enterprise cloud storage, databases, and other networked structures. Once infected, these types of malware can spread to cause all types of disruption, or more commonly, incur an organization-wide data breach.
Brute force attacks in terms of cloud infiltration have involved credential stuffing, which involves inputting stolen credentials from other accounts into various services. Attackers try to take advantage of any possible password-username reuse across multiple accounts. Typically, they will acquire stolen credentials from existing account breaches, with credentials being sold on the Dark Web. Rapid attempted logins from many distant locations can be a red flag for this activity.
Distributed Denial-of-Service (DDoS) attacks overload cloud servers or the framework around it to disrupt or take services offline. These may occur on the back of botnet-based and phishing threats, where attackers gain access to a system and use a preassembled remote computer “army” to execute the assault. Ease of execution and the extent of disruption to web-based operations makes DDoS attacks very appealing. With haphazard infrastructure setup, many organizations on cloud systems are even more vulnerable.
How to secure data in the Cloud
When looking to improve your cloud data security, you will want to be attentive to a few key areas. Largely, data encryption is an important area of focus in cloud security. With encryption, you can scramble your data to be virtually unusable by anyone without your encryption keys to unlock it. Here are a few tips that could help you.
As a personal home user, you can take the following measures:
- Using a VPN service: A virtual private network can help your data stay private and anonymous in transit between your cloud and devices. Encryption is a primary feature of most VPN services, so using one can help you avoid eavesdropping on your connections.
- Determine if you are storing data that needs encryption: Not all data needs to be encrypted, but sensitive data should always have this layer of protection. Best practices would entail using encryption for files like tax documents and other private data, but you may deem it unnecessary for files and other data you already share publicly. Just remember, you can lose access if you lose your encryption keys.
- Deploy encryption carefully: As your provider may not keep track of encryption keys themselves, you will want to ensure that cloud encryption keys are not stored in a vulnerable place like onboard computer storage.
- Choose a security service that monitors your identity: With products like Kaspersky Security Cloud, you will receive updates if your data is exposed in a cloud provider data breach. In case anything fails with any of your encryption methods, you will be informed with a proper plan-of-action to keep yourself safe.
If seeking to secure your SMB or Enterprise systems, be sure to examine the following:
- Encrypting data before being stored in the cloud: By securing your local data storage devices and operating systems, you will have more control over how your business handles its encryption measures.
- End-to-end encryption: Ensure your provider offers encryption that secures your data in transit to and from your cloud service. Sensitive data like financial or proprietary company information should always be secured from interception.
- Managing your encryption keys: Encryption requires various keys to access the data, which means these should be controlled and guarded carefully. Determine whether your cloud provider manages their keys for you, or if you will have to keep track of them internally.
- Utilize a cloud security solution: Keeping on top of your data encryption efforts is a large task to maintain without assistance. However, security products like Kaspersky Hybrid Cloud Security can help you evaluate how your local and cloud security efforts can improve, all while guarding against new threats.
Tips to improve your cloud security
Cloud computing security challenges can be confronted by beginning with end-user protection tools and methods. Whether for personal use or planning enterprise IT policies, here are a few tips to help you keep your cloud services secured:
- Avoid document and attachment downloads: Preview attachments and documents when possible. Keep your documents online versus saving and accessing from local storage.
- Notify support about phishing attempts: Whether emails, phone calls, texts, or any other form of suspected phishing, let your service provider and/or work IT team know.
- Activate multi-factor authentication: Layered protection like biometrics or USB “keys” atop traditional passwords can create more security barriers. While they are not fool proof, an extra minute of personalized security may help to halt low-level cyberattacks.
- Secure smart home devices (or at least your internet access): Make sure your router’s admin access is hardened with a strong password and username. Improving the passwords on home Wi-Fi can also be a great start. For remote working, you might consider using a mobile hotspot with a VPN instead of your home network.
- Ensure you follow the tips from your workplace cybersecurity training. Rules and policies are only effective if you take time to practice and apply them. Suggest that your IT team implement virtual exercises against threats like phishing if they aren’t already in use.
- Set up and require the use of a VPN. This service gives you and your organization a private tunnel for all your data to travel through uninterrupted. Be sure your VPN provider offers end-to-end encryption and has a trusted history.
- Revisit and limit user access. Removing unused user accounts and throttling some user permissions down to essentials can support great cyber hygiene during remote work.
- Install internet security software. Even if you are perfectly vigilant on your own devices, this won’t stop an infection that’s infiltrated through another user into your workplace cloud. Proper antivirus software, like Kaspersky Cloud Security will help you carry the burden of security.
- Keep all your software updated. Security fixes make up the bulk of many software patches. Install them as soon as possible to seal potential data breach points.
- Increase security levels across OS, applications, and web services. Default security measures on some programs and devices may opt for balanced convenience and security. We recommend adjusting them more towards stricter permissions to help “gate” against security threats.
- Test your cloud security set-up. This means using various security methods to probe your network and all its components for possible vulnerabilities. One important method is for your passwords to be tested for strength, which tools like Kaspersky Password Manger provide. While this can be time-consuming to test on your own, some cybersecurity tools like Kaspersky Hybrid Cloud Security can harden your systems while confronting any incoming threats.
Related products:
- Cloud Security for your Home Devices
- Advanced Cloud Security for SMBs
- Hybrid Cloud Security
- Enterprise Cloud Security for Industries
Related Articles:
