Hitachi

U.S.A.

Hitachi Group Global Network

Americas

Asia

Europe

Middle East and Africa

Oceania

Close

Why Do A Cloud Security Assessment?
You are here: Home \ Cloud Security \ Why Do A Cloud Security Assessment?
Posted on Friday, January 10th, 2020 by

As cyber-attacks targeting cloud infrastructures increase, using a Cloud Security Posture Assessment can help you determine how best to reduce your organization’s risk.

Indeed, cloud computing has become firmly established by organizations of all sizes and across all sectors. A cloud-based infrastructure facilitates digital transformation, offering opportunities to use best-of-breed cloud apps to help improve productivity. It also offers remote working, and in doing so, helps your organization maintain a competitive edge. However, cloud computing also offers opportunities for cyber criminals. In the first half of 2019, 4.1 billion data records were breached, a 54% increase on the previous year.

Cloud-based cyber-attacks are now a common occurrence , and big names and small, are at risk. In 2019, cloud security attacks were successful at companies including Capital One, Facebook, MS Azure (Elasticsearch) and countless others. Many of these attacks were caused by vulnerabilities and/or misconfigurations in the organization’s cloud infrastructure. For example, when an organization uses a third-party to host IT resources, they face this question: just who is responsible for security and where are security gaps and weaknesses? This is why carrying out a Cloud Security Posture Assessment is so critical to reducing risks to your organization cloud infrastructure.

What is a Cloud Security Posture Assessment?

As organizations across the globe moved to cloud computing, the idea of an on-premise, network perimeter to protect data, became no longer relevant. Cloud providers, like Amazon Web Services (AWS), Microsoft Azure and many others worked to provide assurances that they could offer secure environments to replace the old network perimeter. However, there is a point at which cloud provisioning and the responsibility for data security, become somewhat fuzzy. Which is why this has led to the concept of the “shared responsibility model”. Shared responsibility is described as:

 

  • Security of the cloud – the responsibility of the cloud provider
  • Security in the cloud – the responsibility of the customer (organization client)

In other words, the cloud vendor must provide the security of the infrastructure pieces, such as the Operating System (OS), the virtualization layer, physical security, etc.

What does it mean for your organization?

  1. You, the customer, i.e. the organization using the cloud, are responsible for cloud apps and data. This includes security controls such as encryption for data-in-transit and at-rest.
  2. You, the customer, are still responsible for your own data. This is where a Cloud Security Posture Assessment comes in.
  3. A Cloud Security Posture Assessment is a process that allows you to test out the security of your cloud environment. The result is a view of your maturity, cloud risks and how to improve your cyber security to a more than just adequate level.

You might be aware that the industry body OWASP, provides a number of areas  to focus on in their “Top Ten” cloud security risks. These areas can be used as a basis for identifying any potential issues in your cloud-based apps and data. This type of assessment targets these areas to identify and reduce risks like misconfigurations and vulnerabilities, etc. However, a cloud security posture assessment will go further by looking across all areas of cloud use, including user behavior, access control policies, and your cloud architecture.  Indeed, the cloud posture assessment will also provide recommendations and action items if any area falls short of secure. The European Network and Information Security Agency (ENISA) is a center of network and information security expertise for the EU. ENISA plays an important role in providing organizations  with a pretty extensive overview of the information security risks when moving to the cloud which you can review HERE.

What Happens During a Cloud Security Posture Assessment?

The assessment process is as follows below.

1-   We will review your organization’s  cyber security documentation and processes

2-   We will sit down with your business resources and IT experts to better understand your reality

3-   We will analyse and assess your maturity and risks

4-   We will submit proposal with a comprehensive roadmap to mitigate your risks and improve your security posture

Benefits of Doing a Cloud Security Posture Assessment

Carrying out a cloud security assessment is a practical and strategic exercise to improve your cloud security health. Your organization will get better visibility on:

1-   Your current cloud posture

2-   Provide data for risk analysis

3-   How your cloud process are aligned or not

4-   How secure your third party integrations are

5-   Making sure that the existing infrastructure and the cloud are aligned

Conclusion

A cloud security assessment helps you reduce your risk and it is a practical process that offers many benefits. Enterprises of all sizes embrace cloud computing. You are ultimately responsible to make sure you do not leave the door open to cyber-crime.  To do so, an enterprise requires a methodology that drills down into the areas where an organization is most at risk. A cloud security assessment teases apart, any areas within a cloud computing model that increase risk. In doing so, it also improves the visibility of the data life cycle.

In an era where cyber-crime is now commonplace, having an analytical approach to security is vital. Cyber-threats are complex and multi-faceted. We need to use a cloud security assessment to counterbalance these gross threats.

New call-to-action

Avatar
About author:

Latest Webinars | Watch Now

Cybersecurity, Cyber Crime and Your Business — How to Strengthen Your Cybersecurity Posture – In collaboration with Cytelligence

Watch Now

Cybersecurity 101 for Credit Unions – In collaboration with the Caribbean Confederation of Credit Unions (CCCU)

Watch Now

Introduction to Technical Security Testing for Credit Unions – In collaboration with the Caribbean Confederation of Credit Unions (CCCU)

Watch Now