Marcelo Delima | Senior Manager, Global Solutions Marketing
For modern organizations, digital transformation is a vital imperative, and cloud services offer a proven path to thrive in the digital economy. However, the shared responsibility model dictates that while the Cloud Service Provider is responsible for security “of” the cloud, the customer is responsible for security “in” the cloud—meaning network controls, identity and access management, application configurations, and especially the security of the data. It is your data in their cloud after all - and you need to make sure your most valuable assets are secure!
Adopting a multi-cloud approach increases complexity
Thriving in the digital economy means delivering optimized customer experiences by providing a high-quality, rewarding, and consistent experience to satisfy all user expectations. With customers having the ability to compare services provided by competing companies, meeting expectations in a frictionless yet secure way is a win-win case for both businesses and customers.
Cloud platforms have emerged as the foundational building block for offering such high-quality services. Hence, businesses are adopting Infrastructure, Platform and Software as a Service environments at an increasing rate.
Overall while the infrastructure of a majority of cloud services is considered secure, cybersecurity is not their primary business. Security controls for Cloud Service Providers are notoriously tough to figure out and can be easy to overlook. Gartner estimated that over the next few years, 99% of cloud security failures will be the customer’s fault. That is a challenge in itself, but it is compounded exponentially as organizations adopt multiple cloud services.
According to the Thales Cloud Security 2021 report, multi-cloud adoption is widespread not only among large scale organizations, but also in small and medium businesses. SaaS usage is the most pervasive with 64% of the global respondents having 26 or more SaaS applications. At the same time, 74% of the surveyed organizations are using two or more PaaS vendors, and 56% are using at least two IaaS providers.
Multi-cloud adoption directly impacts the complexity for managing security in the cloud. In accordance with the same Thales report, nearly half (46%) of the survey respondents agree that ‘within their organizations, it is more complex to manage privacy and data protection regulations in a cloud environment than on-premises.’
7 steps to robust cloud security
Security teams tasked with securing workloads, apps and data sets across cloud environments must address several specific objectives. Sensitive data needs to always remain confidential and secure against both external and internal threats. Controls must be put in place that guard against enterprise or cloud service administrators maliciously or inadvertently exposing sensitive data. Within multi-tenant cloud environments, security teams also need to ensure data can’t be accessed by other threat actors.
To meet these requirements, cloud security solutions must be comprehensive, data-centric and with high assurance. The following steps will ensure that security teams will always be ahead of any cloud related threat.
1. Identify all sensitive data and applications and their location.
2. Determine the risks these assets are exposed to, including external attackers and privileged users.
3. Define your data protection controls in accordance with the risk environment and the business model.
4. Define a holistic approach to your security strategy, which will include all your computing environments, in the cloud, on premises or hybrid.
5. Establish a centralized key management and access management solution that will help you control how to predict, prevent, and respond to the evolving threat environment.
6. Deploy the control that will help you optimize and deliver security and operational efficiency.
7. Stay abreast of the cloud market evolution and make sure decision makers are aware of new capabilities and offerings.
How Thales can help you
Thales offers an integrated, comprehensive set of solutions that deliver central, unified, and efficient capabilities for securing apps and data across all environments. With Thales solutions, organizations can implement granular information security controls that optimize the availability, integrity, and confidentiality of sensitive digital assets.
To learn how Thales can help you build your defenses to mitigate all external threats and privilege abuse risks, download our latest whitepaper “Your Data. Their Cloud. Leveraging the Cloud without Relinquishing Control.”