We are living in turbulent times. Online security has always been an area of concern; however, with recent global events, the world we now live in has become increasingly cloud-centric. With that, I’ve long believed that for most large cloud platform providers offering managed services, such as document editing and storage, email services and calendar management, data stored there is much safer than any network-connected on-premise data. Our Data Governance framework allows us to secure and protect the networks of small and large educational and corporate institutions and to give peace of mind.
Giant firms such as Google and Microsoft, which are prime targets for attack, have much greater, more focused, and better-trained security teams than even most nation-states. They don’t underestimate the need for strict and advanced cloud security.
They also possess the technology and resources to compete at the highest level in data security. For network security reasons alone, I prefer using these platforms for our company’s documentation and email storage. Aside from network security, physical site security and data resilience are also likely to be much stronger than what we, as standalone enterprises, can provide.
The Center Is Strong, but the Edge Is Weak
I’ve spent much of the last 10 years studying the weak points of the cloud-centric model and trying to identify where they might be. As you may expect, as has always been the case, the ”user” is the weakest link, and even more so in an out-of-office and off-VPN environment, where the benefits of the cloud office come into their own. COVID-19 is further evidence of this trend.
However, a second, new and perhaps under-estimated threat comes from third-party applications that have access to your data in order to perform critical tasks. Who monitors the access rights they have? How do you see their background activity on your cloud platform?
A third new weakness is introduced in the form of cloud-based identity verification. By now, we’re all used to using Google or Facebook as our cloud identity provider. If a user’s “identity” can be stolen, do you know which apps that gives the thief access to? To avoid raising suspicion, nothing might be touched on the primary platform, but the stolen identity could be used on many other platforms to a very damaging effect.
Finally, a fourth weakness I see is the “browser.” In the cloud-centric universe, the browser acts as the entrance door. Browsers themselves are pretty robust, much more so, I believe, than other operating systems such as Windows, Linux, and the MAC OS variant. They have a tighter design, narrower function, and fewer entry points. However, they welcome extensions; meanwhile, the sheer power of extensions is not generally appreciated.
Browser extensions can pretty much allow the bad guys to do anything they set their minds to, from stealing identities to grabbing screens, taking photos and even tracking users. What seems like a legitimate use case in one scenario may in fact be a deadly threat in another.
So let me ask you this, do you know what extensions are running on all your enterprise’s browsers?
Verdict: Monitoring Is Key
To identify these risks and effectively mitigate them, monitoring is all-important. For example, as discussed in a recent blog post, it is crucial that we all pay attention to the changing trends in data governance and cloud computing.
The security benefits alone of the cloud-based model far outweigh the risks. However, the model is not without risks.
Understanding these threats and putting in place the tools to measure and monitor, as well as report, track, and trace them, are all critical components of a successful and safe cloud office deployment. At our organization, we’ve focused hard on these risks and developed tools that we hope help mitigate them to a great extent.
Of all the risks, weak human behavior is perhaps the greatest. Much of our recent focus has been on using machine learning to monitor users and keep them on the “safe and narrow” path. If that’s not possible, we aim to notify the organization’s administrators when they start to drift off.
Machine learning (or AI) is becoming a powerful tool in the security resource kit. For example, it can be used to track who the user is at all times. Such active verification is becoming a key component of cloud security.
Phishing is a pernicious threat, and again AI can be used here with great effect. APIs report volumes of useful intelligence on user activity, indications of compromise and anomalous behavior. Having the right tools to surface these anomalies is essential to security awareness.
The move to the cloud is relentless. Many of the old risks are the exact same as they have always been, such as the “user” element, but there are concerning new risks on the scene too. The good news is that we are living and operating in an innovative era, and we have the robust tools to help mitigate against them.