Magazine menu Close Magazine menu

cloud security

Latest stories

security as a service cloud migration

Why you need Security as a Service for cloud migration

  • min read
    • From small-to-medium-sized businesses (SMBs) to the biggest multinationals, use of cloud computing infrastructure and services is growing exponentially. Spending on end-user information security and risk management will reach 188 billion US dollars by 2023, according to leading technology researchers Gartner. This vote of confidence in the cloud could partly come from greater confidence in Security as a Service (SECaaS.) In our interview, Curtis Franklin, Senior Editor at widely read cybersecurity news site Dark Reading, says SECaaS is a consideration in many cloud migrations, but not the primary factor. Not all businesses are ready to migrate everything to a cloud environment – or in other words, to migrate to Enterprise as a Service (EaaS) – but their cloud assets still need enterprise-grade, cloud-based security. Firewall plus access less identity IT departments have widely accepted security solutions like web application firewalls (WAF,) security information and event management (SIEM) and encryption. Franklin says user identity is there: "Cloud access security brokers (CASB) are an option: On-premises or cloud-based software that sits between cloud service users and cloud applications. It monitors all activity and enforces security policies. Some would have called it the next-generation firewall. It's a firewall and access management in one application, but not so much identity." In the cloud, there's a lot of analytics data, or Security Operations Center as a Service (SOCaaS,) that can be added to user credential management, managing encryption keys and identities. What companies should look for Look at the expertise your cloud service brings to the table. Is it just a service, or a service with people? The security of application program interfaces (APIs) that connect data and applications in the cloud is also critical. Franklin warns against introducing vulnerabilities to take advantage of a new cloud-based experience. "Every time you have one application connecting to another, you have a place where a vulnerability can exist. In the cloud, there are many of those." A lower Total Cost of Ownership (or TCO – direct and indirect costs of an application or system) isn't a given unless the enterprise manager has carefully crunched the numbers. Franklin cites cases where companies on volume-based cloud service pricing schedules didn't know their actual volume, or the cloud got unexpectedly popular with staff, so they ended up with high costs. "Many now understand you're not always reducing your costs, but shifting it. You're exchanging Capital Expense for Operational Expense. For a lot of customers, that's fine or better, because it's taxed differently and hits a different part of the annual report. You're taking the money you'd spend anyway and getting more value for it." Sometimes when you're buying SOCaaS, you're buying expertise in the form of people you can't otherwise find. You're trusting the cloud provider to find and rent those minds to you, rather than trying to find them yourself. Built-in reporting and customer support are critical. If an attacker knows more about your infrastructure and environment than you do, it's an opportunity for an exploit. Franklin suggests using these services to stay on top of what's really happening in your environment, as opposed to what you think is happening. What about cloud service agreements? Review cloud service agreements (CSAs) to ensure you'll get the value you need from the service. There must be enough flexibility to set things up so you can realize that value. Know what you want out of the relationship: Harmonious functionality between the cloud service provider and your existing applications. Everything flows from that. Reporting can help you understand what you're getting from the service. Franklin says, "Are you paying for notification? Are you paying for integration with other systems that will automatically act on signals received? Will it play a role in procedural controls or is it going to be active in process control? You need to know, because if it's process control, there's automation. If it's procedure control, you're getting notifications people will have to review. It's critical to know upfront, as part of your CSA, which it is and where those notifications are going." How will SECaaS solutions evolve? Franklin believes SECaaS solutions will evolve in two ways. On the one hand, there will be SECaaS solutions that augment the intelligence of IT staff, letting analysts and engineers be more productive. On the other hand, some will replace human analysts and engineers. The human replacement may be of more interest to small-to-medium sized business, and automation of more interest to larger enterprises. He says businesses should know which path they're taking when they talk to a service provider. "Are they going to make your current staff more effective, letting you avoid hiring or taking over staff roles?" There'll be much more solution development in authentication and access management because it's a complex piece of the security puzzle. Franklin sees much of that going to the cloud service provider that's handling multi-factor authentication. Whether it's a secondary factor that comes through an app, an SMS or something else, the cloud will handle it. He says more companies want the cloud provider to handle all access management, because it's complicated. They want to be able to do it for their employees on both corporate and personal devices. SECaaS bundled into the cloud service provider services, or bought by the business from a vendor, is an excellent way to do it.
river privacy predictions 2020

Never the same river: Predictions for privacy’s next decade

  • min read
    • Your phone. Your smartwatch. Your smart home. Your data is now everywhere. Collecting personal data makes services better for the user, but over the past decade, multiple cases have demonstrated the risk. In privacy, you never step in the same river twice. Concerns, threats and priorities are always changing. What privacy hazards will we see in the coming decade, and how should your business prepare? 1.  Governments will allow themselves to access more of citizens' data It's already happened, but in the next decade, governments around the world will adopt laws that let them access more of citizens' data. They may cite many reasons, including terrorism, instability and the already widespread use of the same data by business. 2.  The gap between regulation and the real world will only grow While the rationale for it is clear, enhanced access to people's data carries risks, such as unauthorized access and leaking information. It will be a big challenge for regulators to keep adapting regulations at the same speed as new technologies come into play. Companies have been slow to change how they're dealing with user data. The only recent significant change has been asking users to consent to how the company will use their data, now mandatory in many countries. We don't see any strong trend toward adding security to protect sensitive user data. There's already a growing gap between regulation and real-world practice, making regulation seem toothless. 3.  Counter-tools will fuel a privacy cyberbattle The trends I've already mentioned will encourage innovators to develop privacy protection technologies. The tech-savvy will adopt these, and more technologies will arise to circumvent them. It will be a privacy cyberbattle. Meanwhile, users will become more proactive about their privacy. There'll be high demand for password managers, virtual private networks (VPNs) and tokens (automatically generated codes) for two-factor authentication (2FA). However, protection mechanisms like 2FA tokens and password managers are just at the endpoint. Attacks and misuse are often at the backend. These tools protect the local environment, but they don't protect against attacks and abuse of systems such as the cloud. And as cloud-based tools go from being leading-edge to indispensable, all employees will need to understand where the risks are. VPNs protect against some data collection (real IP-addresses, geolocation) but don't protect against users voluntarily sharing data with services like Google and Facebook. 4. We'll keep getting fooled by fun Cybercriminals can use this strategy to attack businesses, targeting employees for personal information, and using it to access business systems and data. 5. We'll see new attacks on democratic process and  protections against disinformation These attacks have been with us for many years, and there's no reason for them to stop. Technology for fake visual and audio IDs already exist, and with the political pendulum of a US presidential election, these will bring undesired attention and abuse from multiple parties. 6. Internet of Things (IoT) vendors will scale up security investment The last few years have been turbulent for the cybersecurity industry. IoT-specific malware, data breaches and disinformation campaigns across the globe have all been challenging. This activity will push vendors to a new level of collaboration for the sake of security. Amazon, Apple, Google and the Zigbee Alliance have announced they're creating a working group to develop and promote a royalty-free connectivity standard. This will increase compatibility among IoT products and embed fundamental security. I hope others will follow their lead. All in all, we're looking at an interesting decade ahead for privacy. The challenges will be significant. Businesses will be a key player in securing the privacy of both their employees' and customers' data. Let's hope solutions from innovators follow fast on the heels of each new threat. In the meantime, by putting in place adequate, regular privacy training and cyberthreat education for all employees, any business can be part of the solution.
picking right tech

When there’s too much choice in tech, get your focus right

  • min read
    • We have too much tech and too much choice. Many of tech's challenges are in choosing the product, and only afterward realizing its limitations and the consequences of our choice. I understood this only recently, after working in tech nearly 40 years. I don't know why it's taken me so long to make this brilliant deduction. I enjoy helping others make these choices. Almost every day, I'm either writing, researching or discussing tech choices for others. But just as the shoemaker's children go barefoot, my own tech choices are often fraught with indecision, or worse, no decision. It all rests on human foibles Yesterday, I was on a phone call with a friend who is as technical as they come. He helped create some of the internet's early protocols – ways transferring data between networks that more or less create the internet. We were commiserating about the quirkiness of the video conferencing application Webex when trying to support a hundred-person conference call. It's fine for the video conference itself. The video and audio quality are usually solid. But the 'soft support' rests on the foibles of how humans use tech, like holding a practice session for the conference, notifying everyone of the call and sending out the slide deck. It's real work to explain what to do to organizers and how to create standards to make the call go smoothly. Learn from the 1980s' portable PC wars Let's draw a dotted line back to when I worked in the bowels of the end-user IT support department of Gigantic Insurance in the early 1980s. We bought PCs by the truckload to place on the desks of thousands of IT staff who, until then, had a telephone and, if they were lucky, a mainframe terminal. We bought IBM PCs because back then because that was the only choice for corporate USA. Then Compaq came along with something IBM didn't yet have: a portable PC. Well, sort of portable. It was enormous. It weighed about 30 pounds (14 kilograms) and didn't quite fit into airplane overhead lockers. When Compaq announced their portable PC, selling for more than $5000, our executives felt conflicted. Our IBM sales reps, who had invested many years in golf games with them, were trying to convince us to wait for a year until the IBM portable PC would come to market. But once we got our hands on the IBM prototype, we could see the Compaq was superior. It was already available. It was lighter, smaller and ran the same apps. We recommended Compaq and started buying them in droves. That was the start of the 'clone wars' that unleashed a new era of technology choices on the corporate world. By the time IBM finally came out with their portable PC, Compaq had improved theirs again, so they kept ahead of IBM. It's why we get frustrated when we finally choose our technology and then live with the consequences. Knowing which questions to ask How does this apply to buying business cybersecurity products? Many of us are still looking at the wrong things when deciding what to buy, or don't know which questions to ask. Know what problem you want to solve, and you'll choose your tech differently. Here are some common examples. Have you picked an email encryption product or VPN based on something other than ease of use? Don't be surprised when your staff rebel against using them. Are you running regular phishing awareness programs and cybersecurity training across your business? Phishing is one of the most destructive attacks, and getting users to understand their behavior is risky is the best prevention. Have you recently tested your disaster recovery procedures to find out why your backups don't protect key data elements? Don't wait until you have a ransomware situation to find out you missed a collection of files. Spend the time now to find these and ensure they're well protected. Can you find out if your cloud storage is secure enough? Do you even know which clouds you're using? Do the hard work now rather than waiting for something bad to happen. Have you examined your whole software supply chain? It's easy to overlook a few spots and then suffer data loss, ransomware or denial of service attacks. You might find personal Github pages, or resellers running tools whose security you can't easily verify. The time to work this out is now. Going beyond the specs means taking a step back and throwing out assumptions. Before you start looking at solutions, do the hard work of understanding the problem you really need to solve. This article reflects the opinion of the author.
5 ways to transition to hybrid cloud

Hybrid cloud: Five reasons businesses like yours are embracing it

  • min read
    • Hybrid cloud makes it easier to move your company to the cloud and make fast progress once you're there. It has rapidly become a crucial enabler in cloud adoption and, iin Flexera's 2020 State of the Cloud survey of 750 business cloud decision-makers worldwide, 81 percent  said they were already using hybrid cloud solutions. But what's driving this?  Let's take a look at the top five reasons organizations are moving to hybrid cloud and what they need to consider when doing it. 1. Hybrid is the natural choice Many companies use hybrid cloud as a part of their cloud journey. It's virtually impossible for a business of any considerable size to move everything to the cloud in one go and the part public, part private, part on-premises approach is a natural way to tackle this. Once there, many organizations remain hybrid because it "just works" and provides what they need. Research backs this up: Leading tech services firm IDG's 2020 State of IT Modernization whitepaper reported 89 percent of those using hybrid cloud had tried all-private or all-public cloud before seeing the need for change. 2. A flexible and affordable solution So, what exactly does the hybrid cloud offer? It provides great flexibility and agility. Public cloud means that your IT demands are a little bit like electricity or water. You pay for as much as you use: if you need more, you can buy it easily and incrementally. The public cloud is highly scalable. The private cloud is often preferred for more sensitive data. What's more, you can use multiple public and private clouds depending on your needs. 3. Hybrid cloud can help with security concerns Government tech solutions provider DLT's 2020 report on hybrid cloud security found hybrid cloud users' biggest security concerns were wrongly configured set-ups, unauthorized access and malware. Implemented well, a hybrid cloud security strategy can help provide the right level of security for the right data. For instance, more sensitive data can be placed in the private cloud part of the hybrid infrastructure. An ideal hybrid solution will also help to support compliance and will offer a suite of helpful security benefits, for example, system hardening and vulnerability shielding for protected systems. The threat landscape is changing faster than ever before; partnering with the right cloud and security providers is one of the best ways to ensure your data is kept as safe as possible and you have a clear overview of security at all times. 4. Hybrid cloud for the way we work today Hybrid cloud is your stepping stone towards the public cloud. This is aligned with current workplace trends such as flexible working and the gig economy. It means your data is available anytime, from anywhere, using any device. This is particularly important with employees increasingly working from home and other locations and supporting a workforce, which is 'fuzzy' at the edges and may include freelancers or contractors. With a flexible, distributed workforce, it's safer to have data stored in the cloud and not on devices themselves. The move to hybrid cloud means that laptops and mobile phones left in taxis or stolen with personal and corporate data on them should be a thing of the past. Using the public cloud means you'll be using the very latest technology without upfront investment. Cloud providers need to compete for business, so often invest in cutting-edge technologies and security that gives them – and also you – a competitive advantage. Even multinationals find it difficult to keep up with tech trends in infrastructure if they rely solely on in-house provision. Like other forms of expert outsourcing, it can mean lower costs too. Finally, it can be a real boost to small businesses as it offers them access to the kind state-of-the-art tech that was once the preserve of billion-dollar companies. 5. Hybrid cloud: means choosing the technology that's best for you Hybrid cloud combines the best of both worlds: customized on-premises technology when you need it, and flexible public cloud services for the rest. By combining both, the hybrid approach can also minimize risk. Rather than putting all your technology eggs into a single basket with one cloud provider, you can mitigate risk by testing and moving over services when the time is right. This is particularly important if you're using a lesser-known provider than the big global tech giants like Microsoft and AWS. For newly-founded companies like tech start-ups, being "born in the cloud" and using SaaS (software-as-a-service) cloud technologies is the new normal. But for a more established business with more complex IT requirements and legacy systems to integrate, hybrid cloud is a game-changer – allowing them to migrate selected services with minimum risk. Businesses of all sizes are now investing in hybrid cloud because it's the most effective, easy and productive way to go.
cloud service

Can migrating to the cloud benefit your business?

  • min read
    • It's tempting to imagine the cloud as an actual cloud full of ones and zeros, but it's really a broad range of computing services such as virtualized IT infrastructures, storage, data processing and apps which are offered over a network. A public cloud is one where these services are available to anyone (either free or paid) and accessed over the internet. Most known examples of public clouds are Amazon Web Services (AWS) and Microsoft Azure. A private cloud differs in that it's designed for the use of only one organization. A hybrid cloud, as its name suggests, combines elements of both. Many businesses also use multi-cloud strategies. This means they employ more than one public cloud platform and may also use a hybrid cloud. What sort of cloud is right for my business? There are advantages and disadvantages to all types of cloud. These tend to center around cost and security, a private cloud being both more expensive and, theoretically, more secure for protecting your business data. A company that wants quick access to its data from anywhere might use a public cloud – the market-leading suppliers of cloud storage have a strong focus on providing the highest level of security. A business which holds large quantities of sensitive data, such as legal and financial, and some tech companies, might choose a private cloud. Increasingly, however, many companies go hybrid – critical data may be stored privately, while less important information and resources such as apps are held in the public cloud. We're all heading for the clouds Cloud adoption is growing strongly. According to research by Kaspersky, 37 percent of small- to medium-sized businesses and 50 percent of all enterprises are either using the cloud or planning to increase their use of the cloud. There are good reasons for this. Maintaining IT infrastructure and the associated expertise in-house is expensive and keeping up to date with new technologies can mean running just to stand still. For these reasons, even large multinationals often buy in their cloud services. One of the other great drivers is changing working habits: increasingly staff is either distributed or working remotely. If everything they do is in the cloud, it can be accessed anywhere and from any device. Even so, Kaspersky also found that the speed of cloud adoption varies considerably by industry sector and geographical location. For small- and medium-sized businesses (SMBs), the arguments in favor of cloud adoption are perhaps the most compelling: the cost of maintaining IT infrastructure in-house is often prohibitive; as a result, many have 'made do' with technology that is far from cutting edge. Now they can buy everything in and have access to the same kind of IT and processing power as large companies. SMBs can use the latest productivity software; they can mine data to gain greater insights. What's more, cloud computing is also highly scalable. If you need more cloud services, you just buy them. It's like buying electricity – you just pay for what you use. Traditionally, SMBs have lacked the specialist skills and capabilities to set up infrastructure-as-a-service (Iaas), so they tend to use instead software-as-a-service (SaaS) solutions, which are far simpler to implement and remove the need to maintain the underlying software. Security in the cloud Set featured image When the cloud was very new, security was a concern for businesses of all sizes. Much of this was down to the regular news of data breaches and anxiety around the idea that sensitive data might be stored 'off-site'. However, cloud security is generally highly secure; data is encrypted which reduces the chances of a breach, and a private cloud can be used for sensitive data. The cloud also allows you to store data within a certain country, which may be necessary to comply with data protection laws. For companies with distributed workforces who use multiple devices, the cloud can also have significant security benefits. Finally, cloud security offerings are now fully mature and offer a balance of peace of mind and ease of use. Businesses are starting to acknowledge that including cloud usage into their business processes may result in better security than they used to have when running them entirely on their premises. In some ways, what we're seeing with the cloud is the next development of the internet: greater speeds, better connectivity and improved security are making it possible for even more functionality to reside on the network so it can be accessed from anywhere. Some companies such as tech start-ups have jumped right in, but many companies are still getting used to this brave new world of location-independent productivity. However, in five years' time, it will be the norm for everyone. Is now the right time for your business to transition to the cloud?
by Innovating leaders.
Innovative tech.
About Secure Futures

Secure Futures magazine is your go-to business guide for opinions, trends and insight into the world of technology and cybersecurity. We help your business to bring on the future. Brought to you by Kaspersky, the global cybersecurity experts.

  • For all other countries