Information Security in Cloud Technology and Potential Problems

Today technology is developing at a dizzying pace and advancing rapidly. As a natural consequence, the systems and technologies used by organisations are changing quickly. According to Flexera’s 2021 survey, 92% of organisations have a multi-cloud strategy and 80% a hybrid-cloud strategy. Multi-cloud computing means using more than one cloud service provider, while hybrid cloud computing means combining private and public clouds.

The biggest disadvantage of this kind of use is the problems and difficulties in ensuring compatibility and coordination between the services involved. The point to focus on here is holistic security management. This approach offers organisations advantages beyond traditional enterprise solutions.

In the light of the explanations and assessments above, the importance of data and data security in cloud technologies is clear. To ensure data security, systems are expected to meet the basic requirements of information security known in the industry as the CIA Triad: confidentiality, integrity and availability.

         –      Confidentiality: Prevents unauthorised persons from accessing data and provides protection to that end.

         –      Integrity: Prevents data from being altered or manipulated by unauthorised persons.

         –      Availability: Makes it possible to access data when it is needed.

These are principles that must be met and ensured whichever cloud model (public, private or hybrid) or category (infrastructure as a service (IaaS), platform as a service (PaaS), software as a service (SaaS)) is used. Otherwise serious vulnerabilities and a risk of breaches arise. As these service and deployment models are not the subject of this article, they are not discussed here.

Data integrity in particular is of great importance in cloud technologies. Security breaches in this area have various causes, which can be summarised as follows:

• Human error
• Insider threats
• Malicious attackers
• Configuration errors
• Transfer errors
• Compromised hardware

The most sensitive of these risk areas is risks and threats from within organisations (insider threats). These are people who are authorised to access the organisation’s data and systems, or whose access has not been revoked in time: current employees, former employees whose access was not closed, partner organisations or contractors. The threats caused by this group can be divided into two main groups: intentional and unintentional.

• Unintentional
• Failing to protect credentials
• Falling victim to phishing or social engineering
• Missing security updates and security patches
• Sharing sensitive data with unauthorised persons
• Inadequate enforcement of security policies
• Intentional
• Espionage
• Seeking personal gain
• Revenge

According to a 2020 Ponemon Institute study, 62% of insider incidents were caused by negligent employees, and the number of such incidents had risen by 47% compared with 2018. It is therefore very important that organisations take serious measures in this area. A stable and reliable security strategy (security strategy and policy) should be established in this area and its strict implementation monitored. Measures that can be taken include:

• Data should be classified according to its value and sensitivity.
• Access rights should be restricted and kept under control.
• Personal and business accounts should be kept separate.
• User activity should be observed and monitored (user activity monitoring). This monitoring should be applied across the entire network.

Although cloud providers are responsible for securing the infrastructure, organisations have to fulfil certain duties of their own. First of all, organisations send a large share of their sensitive information to a third party, that is, a cloud computing service provider. This transfer carries serious risks.  For this reason,  if encryption and secure communication protocols are not used when sending data to the cloud, corporate information may be captured by hackers.

It is very important that organisations strengthen their IT infrastructure and increase their ability to monitor users, applications and the security perimeter. In addition, cloud security is a responsibility shared between the provider and the organisation using the service (the shared responsibility model). The division of responsibilities varies with the service model (IaaS, PaaS, SaaS), which also affects the security risk of the functions companies entrust to the cloud.

When moving on-premise systems and IT infrastructure to the cloud (migration to the cloud), organisations should obtain professional support and consultancy and also build a competent in-house team able to carry out and maintain these operations. A weakness in this area could put organisations in a difficult position in terms of information security and could also harm their market value.

In the light of the data and assessments above, the security problems or challenges that may arise when using cloud technologies can be stated as follows:

• Lack of visibility
• Inadequate isolation in multi-tenant environments (multitenancy)
• Access management and shadow IT
• Misconfigurations

What organisations must always bear in mind is that the party primarily responsible for data privacy and security is the organisation itself. Using cloud technologies does not mean that organisations transfer this responsibility to third parties that provide cloud technology (cloud providers). Cloud security solutions that can be adopted against such security problems will be discussed later in the light of changing security dimensions.