Protecting Data in the Cloud is a Shared Responsibility

Before cloud computing became the norm, enterprises were once expected to secure everything themselves. They would have had to be responsible for everything from their systems in the data center to their applications. Today, cloud service providers are able to take much of that burden off of their customers, but just how much, however depends on the service that you are actually purchasing. With a whole slew of “as-a-Service” offerings (IaaS, SaaS..etc) now available, it is easy to get confused and lose track of where security obligations start and end. Venturing into the cloud without an understanding of what needs to be secured increases risk and potentially opens the door to attackers through unpatched systems, poor access controls, and other vulnerabilities.

Knowing Your Role in the Cloud

Unfortunately, research has shown that understanding their role in securing the cloud is frequently a pain point for businesses. In fact, cloud misconfigurations now account for the majority of security incidents involving the cloud. Additionally, a report earlier this year from Oracle and KPMG stated that only 8% of IT executives and cybersecurity professionals said they fully understood the shared responsibility security model across all types of cloud services. These are the same executives who reported widespread use of SaaS, platform as a service (PaaS) and Infrastructure as a Service (IaaS) in their organization.

With this in mind, maintaining sufficient standards for security and compliance in the cloud is a must. While the shared responsibility model outlines what the vendor and the customer are responsible for, the specific approach or features that vendors use will vary. Customers must remain vigilant on how they will configure and secure their users and access, and utilize controls like encryption when appropriate. Recent history is filled with tales of misconfigured cloud workloads that were assumed safe without first taking the proper precautions.

So What Can We Do?

In recent times, catching misconfigurations in the cloud has become complicated due to the sheer number of cloud instances in corporate environments. With this in mind, the solution is to combine comprehensive visibility and automated security. Organizations need the ability to identify and correct mistakes as quickly as possible, creating the need for solutions that provide visibility across multiple environments.

Crowdstrike offers visibility into cloud workload events and instance metadata to provide detection, response, and proactive threat hunting and investigation. This extends to delivering real-time information about workloads and containers without any performance compromise. Stratejm is proudly partnered with Crowdstrike to provide full-scale systems integration, configuration, and management to help organizations unify the security capabilities they need into a single platform.

Leveraging a cloud service without first understanding the security and compliance implications for your organization is a recipe for disaster. Contact Stratejm today to what those are.