With the Covid-19 pandemic has accelerated to adoption and priority of cloud technologies in businesses, it has also triggered an increase in cybersecurity threats.
Eklove Mohan is Senior Director, Technology at Synechron, a digital transformation consulting firm for the Financial Services industry. At Synechron, Eklove works in Innovation, Research & Development, Cloud Initiatives, DevOps, Technology Evaluation, mentoring and training of the young IT generation, and with clients to provide tactical and strategic solutions.
Here he shares his thoughts on the challenges of the rapid rise of cloud technologies.
For many financial institutions in the past year, cloud technology and migration has risen to the top of the agenda. For firms undertaking a transformation journey for their business, such as cloud, prioritisation and adopting a proactive rather than a reactive approach is essential – but this does not always happen in practice.
Whilst many businesses have been focused on expanding and adopting cloud technology, accelerated by the turbulence and volatility of the pandemic, there has been a dangerous tendency to overlook what that means holistically for their business. The biggest threat in the expansion of cloud adoption has been the increased liability in cybersecurity.
As your digital ecosystem grows – so does your danger. Cyberattacks against financial institutions increased by 238% between February to April of 2020, according to a recent report.
Banks and other financial institutions spend approximately USD $3,000 per employee to prevent computer networks from cybercriminals. This would mean that banks like Wells Fargo and JPMorgan Chase are spending roughly USD $700 million per year on cybersecurity alone.
One of the primary benefits of cloud is how it can make businesses more secure, another reason as to why the adoption rate of it is now higher than ever before. However, there are still many incidences of data breaches reported from companies such as Alteryx, that left information on more than 120 million US households exposed on an Amazon Web Services S3 bucket – an incredibly costly yet avoidable mistake.
Cloud security as a topic is complex, with multiple different variables to consider. This includes the “Shared Responsibility” model that each of the cloud services providers offer. It is easier to manage liability when it is clear where responsibilities lie and with whom; however, when there is a tag team approach with unclear mandates and responsibility, confusion naturally arises, and weaknesses are exposed.
Organisations that have recently migrated to cloud find it difficult to transition from a “Sole” to a “Shared” model. Over a period of time, organisations learn the table manners in operating within a shared cloud model but this can be a challenging journey. This challenge, however, is far preferable to learning the hard way through a costly and reputationally damaging security breach.
For firms adopting cloud technology, this is by far the most common problem. However, there are various actions that can be taken to ensure your organisation thrives in a secure way.
- Ensure proper governance – Building a central cloud governance body in your organisation that not only keeps a continuous eye on what is going on in your cloud account but defines best practices for all to use across the business.
- Invest in your staff – Train your teams regularly, repeatedly and consistently.
- Don’t take anything for granted – There is no harm in encrypting the data yourself, even though the cloud provider will also encrypt it for you. Double locks ensure even if one is broken, there is another one to still protect you.
- Detect any vulnerabilities – Perform regular penetration tests to identify any security vulnerabilities in your cloud environment.
Another key challenge with cloud security is closely related to cloud’s primary selling point – scalability. A critical aspect of cloud computing is the ability to scale up dynamically when the load increases and scale down when activity dwindles.
Cybercriminals are sophisticated. They can mimic the load and post dummy transactions at a high rate, pushing cloud resources to scale up, incurring additional cost to the business. This then leads to resources becoming unavailable to your end customers, resulting in business loss and reputational damage. For businesses there are measures to combat this style of attack:
- Manage expectations – Setting throttling and quota limits for your APIs.
- Stay organised – Maintain a list of malicious IP addresses and block them via a firewall rule.
- Know your request patterns – Bulk requests during non-peak hours are a warning sign and must be escalated as soon as possible.
Finally, firms must not overlook simple security processes as a single weakness in the chain of the digital ecosystem can be exploited. A good example of this is at the most used entry point to cloud technology: the login.
As an administrator, an individual has access to all the resources and data that is running within the organisation with a single login to the cloud portal site. Imagine the damage a cybercriminal can cause if he or she gains access to this credential. To prevent this (or at least not easily compromise it), every cloud provider recommends enabling multi-factor authentication (MFA) where each organisation and its administrators should enable it by default.
This gives a sense of the holistic thinking required for firms looking to update or to migrate to cloud technology. The points covered in this article should serve as a starting point when considering your digital transformation. Proper remediation will not only prevent your organisation from being compromised by cyber-attacks but will also help in gaining all the desired benefits of cloud, making your transformation journey a safe one.
