Organizations of all types and sizes are turning to the cloud for their application and data storage requirements. The cloud makes it possible for them to deploy their workloads more quickly and to scale them up and down as requirements change. Not only does this increase the organization’s flexibility, but it also frees up IT personnel to focus on other initiatives, while avoiding the overhead that comes with on-premises infrastructure.

Deploying to the cloud can also increase security risks, however, and add to the complexities of complying with applicable regulations and standards. Cloud platforms are processing and storing more data than ever—much of which transmitted over the internet—and this can leave it susceptible to a wide range of vulnerabilities. More than ever, organizations need to implement a cloud security strategy that minimizes the risks that come with the cloud and ensures that their sensitive data remains safe and available.

Cloud security refers to the practices, policies, and controls that an organization employs to protect the data, applications, and infrastructure it deploys to cloud environments. A comprehensive strategy is essential for the organization to fully protect its cloud assets and prevent unauthorized access to the data, while safeguarding sensitive information such as credit card numbers or personal identifiable information (PII).

By implementing a cloud security strategy, IT teams can minimize the risks that come with cloud deployments and better meet compliance requirements. That said, implementing an effective strategy is no small undertaking. There are numerous types of cloud services, environments, and applications, and they can be mixed-and-matched in a variety of ways, adding to the challenges that already come with protecting data in today’s increasingly connected world.

The many faces of the cloud

One of the challenges that comes with protecting cloud assets is that an organization can use cloud services in a variety of ways. For example, cloud service providers (CSPs) generally support one or more of the following service types:

• Infrastructure as a service (IaaS). The CSP supplies the compute, network and storage resources, along with virtualization capabilities. The customer is responsible for the data, applications, middleware, operating system, and virtual machines.
• Platform as a service (PaaS). The CSP supplies a complete platform that enables customers to develop and deploy their own applications to the cloud. Customers write, build, and maintain those applications and provide the necessary data.
• Software as a service (SaaS). The CSP supplies a complete, fully managed application that customers typically access through a supported web browser or downloadable app. Customers are responsible only for configuring certain settings and providing the necessary data.

An organization might use all these types of services or only one or two of them. Some vendors also offer other variations. For example, they might provide containers as a service (CaaS), which lets the organization run its apps within a containerized environment, or they might offer function-as-a-service (FaaS), which enables an organization to run its applications as functions, without having to maintain infrastructure.

In addition to different service types, organizations can also deploy to different cloud types. The four most common cloud types are public, private, hybrid, and multicloud:

• Public. The cloud environment is hosted by a CSP in an off-site data center. The CSP is responsible for maintaining and securing the environment. Customers have only limited access to the backend systems and infrastructure, depending on the service type.
• Private. The cloud environment is maintained for an organization’s exclusive use. The infrastructure might be hosted and managed on-site by the organization itself or deployed off-site and maintained by a third-party provider. In either case, the customer has far more control over the environment than with the public cloud.
• Hybrid. This configuration is a combination of both public and private clouds, with workloads often spanning both types of environments. Ideally, a hybrid cloud operates a single cloud platform that seamlessly spans environments. This approach provides organizations with more flexibility when implementing their workloads, but it adds to the complexity of managing and securing workloads and data.
• Multicloud. This configuration is a combination of two or more public cloud services, often from different CSPs. The multicloud approach does not assume the type of seamless operations promised by the hybrid cloud, although a multicloud scenario still complicates the process of managing and securing data.

Organizations might also support hybrid multicloud environments, in which a private cloud is combined with multiple public cloud services, adding even more complexity to their cloud security strategies.

The importance of cloud security

Cloud service providers take security seriously and use a variety of methods to protect their systems and their customers’ data. However, these safeguards might not be enough to fully protect an organization’s resources, especially with the steady adoption of hybrid and multicloud environments.

Cloud architectures are, by their nature, highly interconnected, giving would-be cybercriminals many entry points for carrying out their attacks. All it takes is one breach at a single weak point, such as a compromised identity or stolen device, for a hacker to enter and traverse a large network of connected resources.

Rather than treating security and compliance as an afterthought, organizations moving into the cloud must be proactive in protecting their cloud assets. They need a strategy that can help minimize the risk of a successful cyberattack, while mitigating the impact of an attack should a hacker succeed. But achieving this level of protection is no small matter, with organizations facing a wide range of threats:

• Identify theft
• Insider threats
• Social engineering attacks
• Malware and ransomware
• Intellectual property threats
• Data leakage and corruption
• Insecure APIs and applications
• Distributed denial-of-service (DDoS) attacks

This is by no means an exhaustive list of the various ways that data can be put at risk. According to CrowdStrike’s 2023 Global Threat Report, cloud exploitation grew by 95% in 2022, and 71% of those attacks were malware-free. At the same time, the number of “cloud-conscious” threat actors nearly tripled, and the number of access broker ads on the dark web increased by 112%. Access broker ads are placed by threat actors who acquire credentials through illicit means and then try to sell them to anyone who will pay.

Many of the attacks that are carried out against cloud environments are the result of the following four factors, which are common to many organizations deploying workloads to the cloud:

• Lack of visibility. Public cloud environments are owned and managed by third-party CSPs. Those environments are tightly controlled and often provide customers with limited visibility into critical processes. At the same time, cloud environments provide a great deal of flexibility, making it easy to deploy dynamic workloads and scale to meet fluctuating demand. In such an environment, IT teams can have a difficult time tracking who is accessing which resources and how those resources are being used.
• Inadequate identity and access management. Cloud deployments can increase management overhead, making it difficult to track the various ways that user and application accounts have been granted access to various cloud resources. Accounts are often granted greater access than needed, or access is not rolled back after it’s no longer needed. Hybrid cloud and multicloud environments only add to the complexity of managing access. Without a proper identity and access management (IAM) strategy in place, organizations are at an increased risk of introducing vulnerabilities that can lead to compromised data.
• Misconfigured system settings. The more cloud services that an organization uses, the more settings there are to configure and the more ways there are to misconfigure those settings. For example, administrators might not remove default passwords, fail to enable encryption on storage resources, or implement inadequate logging on backend services. Any of these misconfigurations can introduce vulnerabilities into the environment and result in compromised data.
• Failure to secure workloads. Today’s cloud workloads often require multiple resources and span multiple environments. Application components are frequently provisioned dynamically, with resources scaled up and down as required. Data might be inputted from multiple sources and outputted to multiple sources. Failure to properly secure such a workload at any one layer can make it susceptible to an assortment of security risks.

Another challenge that many organizations face is in trying to accommodate the various regulations that govern how the data must be treated. Expanding into the cloud adds additional layers of complexity when it comes to ensuring that data is being properly handled and protected according to governing regulations and standards. IT teams must be able to demonstrate that they are continuously in compliance no matter where the data resides—made all the more difficult by the lack of control that comes with cloud environments.

Only by implementing a comprehensive cloud security strategy can an organization hope to meet these challenges head on. An effective strategy offers a number of important benefits to the organization:

• Greater visibility. By implementing a comprehensive cloud security strategy, IT teams gain greater visibility into their cloud assets through the use of tools and processes designed specifically for cloud environments.
• Greater data protection. An effective strategy incorporates data security by default (security by design). Cloud security ensures that data is secure wherever it resides, while relying on comprehensive data governance and the careful implementation of identity access and management. Along with greater data protection comes greater customer trust.
• Improved compliance. The tools and processes used to implement a cloud security strategy go hand-in-hand with achieving the necessary level of compliance. Cloud security provides IT with visibility into its cloud assets and protects those assets, which in turn helps the organization to comply with the legal and industry standards that govern their operations and data requirements.
• Streamlined management. For an organization to effectively secure their cloud environments, they will often consolidate and centralize their monitoring and management operations, which can also help streamline the security process. In this way, administrators can more easily implement security policies, manage software updates, view distributed resources, manage workflows, and analyze pertinent information, all of which makes it easier to ensure the data remains secure.
• Increased flexibility. A comprehensive cloud security strategy makes it easier to support cloud-native solutions because cloud security tools and techniques are already designed to accommodate these types of workloads. In this way, IT teams don’t need to reinvent the wheel with each new application type they deploy to the cloud. An effective strategy also makes it easier to support a remote workforce because the protections are already geared toward resource distribution.
• Reduced costs. The more effective the cloud security strategy, the greater the savings. Because of the increased visibility and streamlined management, IT teams can use resources more efficiently and reduce their overall management costs. Greater data protection also helps to minimize the risk of a data breech, which can be an extremely costly prospect.

Today’s organizations face an uphill battle when it comes to protecting their cloud assets. The need for a robust cloud security strategy has never been greater. An organization that fails to protect its cloud assets could face steeps fines, a loss in revenue, and a tarnished reputation that takes years to restore.

Managing data in the cloud

Cloud security follows a shared responsibility model, in which the CSP is responsible for certain aspects of security, and the customer is responsible for the rest. The exact split usually depends on the type of cloud service.

For example, in an IaaS scenario, the vendor is responsible for the server, network, and storage infrastructure—along with the virtualization capabilities—and the customer is responsible for securing the operating system, middleware, applications, and data. In an SaaS scenario, however, the CSP is responsible for all these components, and the customer need only ensure that the application settings and access permissions are handled properly.

Not surprisingly, a cloud security strategy must take into account these factors and a number of other considerations, which can be broken down into four broad categories: data management, risk management, infrastructure and application security, and business continuity.

Data management

Data management refers to the steps that an IT team can take to ensure that the data itself is properly protected at all times, in all locations, and under all circumstances. To this end, the team should apply basic data security, implement a data governance plan, and put into place the necessary access controls.

Data security is concerned with protecting sensitive data at rest and in motion. This is especially important because users often access cloud resources over the internet and from a variety of locations. For this reason, all sensitive data should be encrypted, using advanced encryption algorithms. An organization might also want to implement a public key infrastructure (PKI) that uses digital certificates to secure digital communications.

An effective cloud security strategy also requires a system of data governance, which ensures that data is properly managed throughout its entire lifecycle. Data governance takes a wholistic approach to keeping data secure, private, accurate, and available. This can be achieved only if an IT team has visibility into all its data and can identify where it resides and what controls have been placed on the data.

An important component of data governance is to ensure that the data is handled in a way that complies with applicable regulations and standards, whether the data is processed or stored on-premises or with a third-party CSP. Where possible, an IT team should automate compliance policies and controls, using tools designed specifically for a cloud environment.

Data management should also include a comprehensive system of access controls that incorporate techniques such as security policies, multifactor authentication (MFA), principles of least privilege, zero-trust access controls, and virtual private networks (VPNs), along with extensive and robust logging.

As part of this process, an IT team should implement a robust IAM solution that provides a security framework for controlling who can access specific cloud-based and on-premises resources and what level of access they should have to those resources, based on their individual identities. The IAM solution should control access to all systems, networks, and assets, while providing protection down to a granular level.

In addition, the IT team should consider implementing a data loss prevention (DLP) solution that reduces the risks of data loss, leakage, and misuse. The team might also benefit from a cloud access security broker (CASB), which establishes a gateway between the CSPs and their customers to enforce an organization’s security policies.

Risk management

In today’s complex cloud environments, an IT team must be proactive when it comes to securing sensitive data, and that means taking steps to detect threats and respond to security incidents as soon as they arise. To this end, the team must be able to anticipate potential threats and know what actions to take to address them if and when they arise.

The team needs as much visibility into its workloads and data as possible, across all its cloud environments, and that means continuously monitoring the applicable systems to stay on top of what’s happening and to look for vulnerabilities and threats, which are often indicated by anomalous behavior somewhere in the network or application stack.

An IT team must be able to monitor, log, and analyze events across all their cloud environments. To do so, they require solutions that provide insights into their cloud resources so they know what’s happening in those environments at all time. These insights can also help them better understand their own attack surfaces and where vulnerabilities might lie.

The team should also regularly scan for vulnerabilities and properly configure a system of alerts so threats can be immediately addressed. Advanced threat protection is essential in safeguarding cloud resources and sensitive data and preventing potential data breaches; however, this protection can be achieved only if the team has complete visibility into its network, endpoints, workloads and data.

The team must also be prepared to respond immediately to any threat incidents that might occur. This starts with careful incident planning, along with regular, comprehensive auditing and risk assessments. Such auditing can be an effective strategy for minimizing risks. It might also be required by applicable regulations or standards.

Because of the steady migration to the cloud, many tools are now available to help organizations be more proactive in their risk management. The following tools provide a variety of examples of techniques that can help protect cloud assets:

• Security information and event management (SIEM). Combines security information management (SIM) with security event management (SEM) to identify and respond to potential security threats.
• Cloud infrastructure entitlement management (CIEM). Automatically monitors cloud resources to help mitigate the risks associated with granting excessive permissions on those resources.
• Cloud security posture management (CSPM). Automatically identifies and responds to security and compliance issues across SaaS, PaaS, and IaaS environments.
• Extended detection and response (XDR). Collects and correlates security threat data from siloed security tools to provide extended visibility across cloud and on-premises endpoints.
• SaaS security posture management (SSPM). Automatically detects and responds to misconfigured settings discovered in target SaaS environments that can represent security or compliance risks.

In addition to tools such as these, many organizations also use penetration testing to verify the security of their cloud systems. Penetration testing makes it possible to simulate an attack to help identify and address vulnerabilities. When penetration testing is performed in conjunction with regular audits, an IT team can more effectively verify the security measures they’ve put into place and where gaps in security might exist.

Infrastructure and application security

IT teams require consolidated solutions that give them centralized visibility and control over the various infrastructure and applications across their cloud environments. Only then can they properly monitor and analyze what is happening on their systems and track workflows as they move between endpoints. A centralized security system enables them to effectively enforce policies and carry out operations such as managing software updates.

To protect their infrastructure and applications, IT teams might employ a wide range of technologies, including firewalls, antimalware, AI-drive analytics, Internet Protocol Security (IPsec), network detection and response (NDR) systems, and many others. In addition, they might segment their networks and workloads to isolate them, which can help minimize damage in the event of a breach. For example, they might partition workloads into subnets or use micro-segmentation to isolate applications and their operating environments.

Cloud security should also take into account endpoint security. Endpoints can connect to cloud environments in multiple ways. For example, a user might access cloud resources through a browser, an application might incorporate a connector provided by the cloud service, and management software might use an API to access and control cloud resources. IT teams must be vigilant in monitoring these connections and their users’ behavior.

Application security goes hand-in-hand with cloud security, especially with the growing reliance on cloud-native architectures. Development and deployment operations are becoming more fluid and dynamic, requiring careful consideration in how to protect them. IT teams are also faced with development trends such as infrastructure as code (IaC) and continuous integration/continuous delivery (CI/CD), which blur the lines between application and cloud security even more.

In today’s cloud environments, IT teams often must take additional steps to protect their resources, such as scanning container images or application code before the application is deployed to production or creating micro-perimeters around application components to reduce their attack surfaces.

Like IT administrators, developers are under greater pressure to ensure the security of their applications, especially if they dynamically provision infrastructure, as in the case of IaC. Developers and security teams must also be careful about using open-source components in their applications, which typically require additional scanning that takes into account component dependencies.

Organizations now have a number of tools to help protect their infrastructure and applications. For example, they might turn to one or more of the following types of solutions:

• Secure access service edge (SASE). Provides a cloud-based framework for converging wide area networking and network security functions—such as secure web gateways and firewall as-a-service—into a unified platform that connects users, systems and endpoints.
• Zero-trust network access (ZTNA). Enables remote users to access internal applications and services—as defined by access control policies—while adopting a zero-trust security model.
• Cloud-native application protection platform (CNAPP). Consolidates multiple security and compliance functions into a unified, cloud-based platform that detects and responds to threats throughout an application’s entire lifecycle.
• Cloud workload protection platform (CWPP). Detects and responds to threats in workloads running on different types of clouds, such as private and public clouds, and different types of application environments, such as containers, physical servers, and virtual machines.

One emerging trend that can help organizations address infrastructure and application security is DevSecOps (short for development, security, and operations). DevSecOps is an approach to DevOps that integrates security into every stage of the software development lifecycle. It breaks down the barriers between the security team and the development and operations teams, just like DevOps aims to break down the barriers between development and operations. With DevSecOps, organizations are more likely to catch security-related issues because the code can be scanned and tested for misconfigurations, compliance issues and other security concerns.

Business continuity

No matter how diligent an organization might be about security, the possibility of a breach still exists, and IT teams need to be prepared for the potential loss of data that comes with it. This means having in place a system that can recover from disaster and ensure business continuity with the least impact on operations. To achieve this, IT teams must build redundancy into their systems so they can seamlessly recover them if and when the need arises.

An organization’s disaster recovery strategy should strive for uninterrupted operations in the event of disaster—or at least achieve minimal disruptions. The systems necessary to support the organization’s workloads should be up and running as quickly as possible, and the data that supports those workloads should made available just as fast. A disaster recovery strategy is not only important in the event of a security breach, but also for any other type of event that might disrupt operations, such as an earthquake or hurricane.

The exact nature of system recovery will depend on the cloud platform and type of service being implemented. For example, an organization that runs its own private cloud to provide PaaS services will take a different approach to disaster recovery than the organization relying on SaaS applications hosted in a public cloud platform.

Regardless of the environment, however, IT teams should implement robust backup solutions that ensure the availability of data no matter what type of event should occur. A backup solution can help protect against accidental data deletion or corruption as well as against malicious threats such as malware, ransomware, insider sabotage, or other types of attacks that could lead to data loss.

IT teams should also take the steps necessary to protect their backups and ensure they can be easily restored. For example, they should encrypt their backups, test the data-recovery process, and ensure that at least one copy of each backup is isolated to prevent infection from malware. At the same time, the backup strategy should take into account retention policies, applicable compliance laws, and any other constraints on the data.

Protecting your cloud assets

Although cloud services promise to simplify IT operations, organizations must still use due diligence to protect their cloud assets. As part of this effort, they should ensure that their workers receive the training they need to understand and apply security best practices. For example, they should know how to identify suspicious emails and avoid using unsanctioned services (shadow IT).

An organization might also bring on Certified Cloud Security Professionals (CCSPs) to help ensure cloud security or consider a managed detection and response (MDR) service, which provides a team of security experts to monitor an organization’s systems 24×7 to detect and respond to cybersecurity threats

When it comes to cloud security, there is no one-size-fits-all solution. Organizations must tailor their strategies to meet their own specific needs, taking into account the service type (e.g., IaaS or SaaS), cloud structure (e.g., public cloud or hybrid cloud), type of applications (e.g., containerized or virtualized), applicable regulations (e.g., GDPR or CCPA), and the many other factors that must be considered when deploying to the cloud.

Threats against data come in many forms and continue to grow more sophisticated and aggressive each day. The more proactive an organization can be in protecting its cloud assets, the less likely it will suffer a data breach and the more quickly it can recover if it does.