There are two popular attitudes about cloud security, and both of them are wrong.

One belief is that putting data in the cloud amounts to putting it on the public internet for anyone to access. Therefore, the only way to keep data safe is to keep it at home and out of the cloud altogether. The opposite belief is that cloud providers cover their own bases well because they have to, meaning that while data in the cloud may pose security challenges, it is no longer your problem.

Simple Errors Lead to Cloud Security Risks

The real truth is more subtle and complex — and so are your cloud security needs. The challenges are out there in plain sight, but many enterprises ignore cloud security risks.

As Infosec Island reported, one key Wall Street firm got its cloud security wake-up call in May when it learned that a bucket permission error allowed any client of the cloud service to access account details belonging to 2.2 million customers. As it turned out, the bucket’s permission structure had been set up incorrectly.

This is the kind of simple error that anyone could make, which is exactly the point. No level of precaution by the cloud provider can eliminate these risks because they are inherent to the relationship between provider and cloud user.

Be Responsible for Your Own Cloud Security

Wherever and however you store your data, you need to provide a means for your own authorized users to access and modify that data. After all, that’s what the data is for. No cloud provider can relieve you of that responsibility because only you can specify the permissions for access. You must ensure that the permissions you grant are only the ones you intend to grant.

Cloud security risks are complex because, in the interconnected world of layered services, multiple third parties may have a role in managing your data. Data owners must be ready to answer questions such as:

  • What security policies do vendors have in place?
  • Do they use contractors who may have access to the data?
  • Where is the data actually stored?
  • What other business relationships do vendors have that could provide additional parties with access to the data?

Services that can automate and manage your third-party risk management process can solve part of the problem. Of course, it’s just as important to manage these services responsibly. After all, it is still your data, and security lapses will end up at your door.

Read the white paper: Address six essential concerns of cloud security to build your business

More from Cloud Security

Is Your Critical SaaS Data Secure?

4 min read - Increasingly sophisticated adversaries create a significant challenge as organizations increasingly use Software-as-a-Service (SaaS), Platform-as-a-Service (PaaS) and Infrastructure-as-a-Service (IaaS) to deliver applications and services. This mesh of cloud-based applications and services creates new complexities for security teams. But attackers need only one success, while defenders need to succeed 100% of the time. Organizations are contending with an exponential rise in advanced threats that are not only increasing in volume but also sophistication. The IBM Cost of Data Breach Report 2022 found…

4 min read

Rationalizing Your Hybrid Cloud Security Tools

3 min read - As cyber incidents rise and threat landscapes widen, more security tools have emerged to protect the hybrid cloud ecosystem. As a result, security leaders must rapidly assess their hybrid security tools to move toward a centralized toolset and optimize cost without compromising their security posture. Unfortunately, those same leaders face a variety of challenges. One of these challenges is that many security solutions create confusion and provide a false sense of security. Another is that multiple tools provide duplication coverage…

3 min read

New Generation of Phishing Hides Behind Trusted Services

4 min read - The days when email was the main vector for phishing attacks are long gone. Now, phishing attacks occur on SMS, voice, social media and messaging apps. They also hide behind trusted services like Azure and AWS. And with the expansion of cloud computing, even more Software-as-a-Service (SaaS) based phishing schemes are possible. Phishing tactics have evolved faster than ever, and the variety of attacks continues to grow. Security pros need to be aware. SaaS to SaaS Phishing Instead of building…

4 min read

The Importance of Modern-Day Data Security Platforms

4 min read - Data is the backbone of businesses and companies everywhere. Data can range from intellectual property to critical business plans to personal health information or even money itself. At the end of the day, businesses are looking to grow revenue, innovate, and operationalize but to do that, they must ensure that they leverage their data first because of how important and valuable it is to their organization. No matter the industry, the need to protect sensitive and personal data should be…

4 min read