Resources

Cloud computing adoption rates have been soaring in the past few years and the trend can be seen at both enterprises and small and medium sized businesses. And the adoption rates are so high with good reason. 

Some of the most common benefits businesses have reported are flexibility of their infrastructure; mobility of being able to access necessary data via any device; increased collaboration with cloud productivity suites such as Google Workspace and Microsoft 365; efficient data recovery for all kinds of data mishaps and especially ransomware; competitive edge by implementing a cloud-based infrastructure before competitors…and security. As much as 94% of businesses reported improvements in their security posture after switching to the cloud.  

The growing implementation and switching to the cloud inevitably leads to greater volume of sensitive data and services being left out in the open. While security is quoted as one of the main benefits of the cloud, it also stands as one of its main pitfalls. Just as business owners are basking in the advantages of the cloud, cyber criminals are catching up on this trend and shifting the focus of their efforts and campaigns to this area of computing and doing business. 

While the popular belief is the superior security the cloud offers, it can lead to business owners neglecting to actually put an effort in securing their sensitive data, accounts and assets. Another popular belief is that the cloud provider is responsible for their data, but one of the rules of the cloud is that the responsibility falls to the cloud customer. 

In our "Top 4 Biggest Cyber Threats for SMBs in 2021" article, we cited cloud computing to be one of them. And with already dissecting ransomware, insider threats and phishing, now it’s the time to take a deeper look into cloud computing, take away all of the bells and whistles we hear about everywhere and see what threats lie beneath. Here are the 4 most common cloud computing cyber risks for SMBs in 2021 and how to mitigate them:

1. Violation of compliance regulations

A compliant company is one whose activities are in line with the rules that apply to their operations. These rules can include regional and industry laws, industry ethics policies, company values and legal obligations. We recognize regulatory compliance that refers to state, federal and international laws and regulations that businesses need to follow and corporate compliance that refers to ways in which a business ensures they are following their own mission, vision, internal policies and procedures, and it’s not regulated by any law. 

Not complying with compliance regulations can lead to companies facing legal charges and hefty fines, be labeled as having unethical practices, destroy reputation as well as hamper their day-to-day operations. Now, how does this tie in with cloud computing? It comes down to visibility and awareness over where all of their sensitive data and assets are located. Many compliance regulations refer to the ways in which sensitive customer data is stored and processed and lack of visibility over them can lead to business violating those regulations, without even knowing. 

When it comes to business running on-premise systems and storing their data in-house, there really is no issue with knowing where all of their data is located. But, when it comes to using cloud providers for data storage that host data in multiple locations, this can get tricky. If your data is scattered across different locations that fall under different jurisdictions you might be in danger of not complying to local data protection regulations. The solution is not a complicated one.

Importance of compliance for SMBs is indisputable. It is advised for SMBs and any business that uses cloud providers for storing data, to choose one that stores it in one location or at least keeps it within one jurisdiction — such as in the EU when looking at GDPR or California in the case of CCPA. If this is not possible due to any reason, it’s up to business to be aware of all locations where the cloud provider stores their data and endure what laws and regulations apply to it in order to avoid penalties and fines. 

2. Data breaches

Data breaches happen when there is unauthorized release of private and sensitive data to the public, or simply an incident where sensitive data is left exposed to prying eyes. Repercussions of a data breach can lead to anything from reputational damage due to your customers’ information landing in the wrong hands and breaching the trust they put in your business, loss of intellectual property, legal fines due to data protection regulations violation and a myriad of other financial damages.

Cloud infrastructures make it easy for businesses to store and share data with other parties, via email and even public links that can be accessed directly from the internet. However convenient this is and a major benefit to cloud computing it creates security concerns. That volume of data in transit can make it easier for cyber criminals to intercept and access. But data in the cloud isn’t really just left open and accessible to anyone and it’s not the case of anyone simply stumbling upon it while browsing the web. But, if you know how and where to look (like attackers do), it’s a different scenario.  

In order to not let their guard down when it comes to protecting and securing their data in the cloud, businesses should employ some rather simple methods. Implementing multi-factor authentication that will require all users accessing the cloud to verify their identity with more than just mere email and password and using VPNs to prevent snooping malicious attackers from accessing location and other personal data while cloud users are browsing the web and accessing sensitive data can go far. And ultimately, due to data breaches being caused by human error in more than 90% of cases, educating staff on the dangers and best practices of cloud computing can be the biggest difference in whether your business will be breached or not. 

3. Misconfiguration

We’ve mentioned that the design of cloud infrastructure to be easily accessible and that it enables easy data sharing is one of the main benefits but also issues for businesses making the switch. This makes it difficult for businesses to ensure their data is only accessed by authorized users and makes their visibility over their assets and infrastructure a bit…clouded. 

Additionally, we’ve also mentioned that many businesses will rely on their cloud provider to enforce security controls and in general. Because many businesses lack the knowledge on cloud infrastructure and leave it to the cloud provider to secure their infrastructure. This can lead to security misconfigurations and oversights. Any oversight means an entry point for attackers exploiting it and getting unauthorized access to sensitive data. 

Some common misconfigurations that can leave data in the cloud accessible by unauthorized users are storage buckets that hold that data that can allow public access to them with just one wrong click; overly permissive security group policies, backup storage location misconfigurations, and in general, a lack of visibility into the entire cloud infrastructure. 

Mitigation of cloud infrastructure misconfigurations can be done through regular cloud configuration auditing to check for any missed instances that don’t fit into the baseline, continuous monitoring of the entire cloud infrastructure to catch any suspicious changes in settings and configurations, and validation of access rights users have to sensitive data and assets. 

4. Lack of access management

Access is everything: if it’s authorized and controlled access to sensitive data, all is fine and as it should be. But in the case of unauthorized access, things can quickly go haywire. With no control over who can access what in your cloud infrastructure, attackers can easily leverage this to their advantage and get privileged access without you even knowing. 

Identity and access management is an important framework that controls the processes, technologies and policies that handle the management of all accounts across a business. IAM for short, allows businesses to control which user can access which information and parts of the infrastructure and ensure secure setting of account data. 

The primary rule of IAM is that no employee should have more access than it needs to perform their job roles. IAM is an important framework for both on-premise systems and might be even more important for cloud infrastructures. This is due to many businesses, when moving their data and systems to the cloud forget to enforce access policies and attackers, knowing this, target access management frequently. 

The baseline for proper identity and access management is setting up the policies and procedures that allow it, as well as regular audits of those policies to ensure no accounts have more access than they need and that any employee no longer with the company doesn’t have access to systems. Multi-factor authentication is actually one of the most critical components of proper IAM and should be used as an additional security layer to all accounts and all parts of the cloud. 

Conclusion

Just as with everything in life, cloud computing, while having many benefits that make it a must-have in the technology landscape of 2021, also has its downsides and risks. Even if security is boasted as one of the biggest differences of cloud infrastructure vs on-premise one, it certainly has its risks. To truly take in all of the advantages cloud has to offer, businesses must also know the dangers that lurk in the cloud and take action and mitigation techniques to minimize their exposure to risk and damages in case a risk becomes a cyber attack.

What better way to tackle the topic of cyber risks in cloud computing than let the experts lead you. Working with a trusted managed service provider such as Xceptional can help you reap all of the benefits and be prepared for all of the risks cloud can bring. Contact us to find out how we can help in your new cloud chapter.