A lot more organizations these days are implementing their digital transformations and are utilizing the flexibility, scalability, and cost savings presented by public cloud spaces. Nevertheless, the protection of public clouds could present a major challenge.
One of the prime concerns that has inhibited organizations from utilizing the public cloud is security. Security groups often think that protecting an on-site data center is much simpler than protecting data in public clouds, although many are beginning to see it is also easy to protect public clouds.
Public cloud vendors nowadays provide various security tools that can assist businesses secure their cloud spaces. Though these tools could absolutely make cloud security more clear-cut, companies should still make certain that their cloud solutions are set up appropriately, identities and access rights are managed in the right way, and they have a complete understanding of all their cloud workloads.
Cloud security provider Ermetic lately mandated IDC to carry out a study of CISOs to take a look at the problems linked with cloud protection and see how businesses were performing at safeguarding their public clouds. Around 300 CISOs and IT decision-makers participated in the survey.
79% of participants reported they had suffered a cloud data breach during the past 18 months. 43% of respondents mentioned they had at least 10 cloud data breaches at that time frame, clearly showing they are facing difficulty protecting their public cloud spaces.
When questioned concerning the greatest security challenges, here are the outcomes:
- 67% answered they were troubled about security misconfigurations
- 64% answered insufficient visibility into access controls and activities was a critical component that contributes to cloud data breaches
- 61% answered access management and permission issues were a serious breach risk
The sophistication of public cloud settings makes security difficult. The versatility of the cloud signifies it is straightforward to promptly have more assets on-demand, but what generally transpires is cloud deployments end up becoming a maze of interconnected gadgets, users, apps, services, and databases. If businesses don’t have full visibility into their public cloud environments, it is very difficult to make sure of the right permissions and the principle of minimum privilege is appropriately applied.
Setting up and dealing with access policies is a primary concern. Access policies should be tweaked constantly, yet 80% of participants mentioned they cannot correctly control too much data access for IaaS and PaaS. Sizeable permissions are often exploited by cybercriminals, who employ them for different malicious activities for instance data deletion, data theft, and installing ransomware or malware.
Ermetic stated that the majority of high-profile cybersecurity breaches in the past few years were because of the failure of users to appropriately set up their cloud environments, or allowing substantial or wrong access permissions to cloud services, and not the cloud provider’ failure to carry out its obligations.
Concerning queries on the main cloud security goals, the survey outcome is the following:
- 78% of participants mentioned compliance tracking
- 75% stated authorization and permission control
- 73% answered security configuration control
71% of survey participants mentioned one of the greatest problems was the identification of excessive permissions, nonetheless, just 20% of participants stated they could determine scenarios when employees were granted excessive permissions.
The survey affirmed that excessive permissions are a chief concern in healthcare. 31.25% of healthcare providers claimed they had discovered a situation where workers were granted excessive permissions.
There were numerous situations where security misconfigurations resulted in the compromise of sensitive information, with misconfigured Elasticsearch instances and AWS S3 buckets a usual cause for data breaches, nevertheless, it is at the same time crucial to make certain that identities and permissions are appropriately handled.
Making certain that users, programs, and services obtain access only to the cloud data files and cloud resources that are needed for their purposes was specified as the major cloud data security obstacle by the survey participants.
