Are you enthusiastic about cloud applications and services due to their numerous advantages or are you primarily concerned about data leaks and other issues? In the latest State of Cloud report, 70% of the companies surveyed stated that more than half of their IT infrastructure is already operated in the cloud. At the same time, according to another survey, 97% of cloud applications in companies are not approved at all because teams or individual employees are using online tools without knowledge or approval. In this context, the analysts at PwC call cloud attacks the “biggest cyber risk in 2024“. The number of companies that have recently suffered a data breach with damages of more than one million US dollars has risen from 27% to 36% compared to the previous year. Reason enough to focus on the topic of cloud platform security: You need to pay attention to this now to protect data, systems, reputation and employees in the best possible way.
Initial situation: The biggest threats to cloud services and data
To reliably secure cloud infrastructure, the challenges that can lead to data leaks, compliance problems and immense costs must first be highlighted. Three key trends can currently be identified: Cloud native malware, attacks on cloud-based AI platforms and software supply chain risks. Although public clouds can be found in almost all areas today, the security network and implementation often seem to suffer. IT teams are therefore called upon to rework hastily built or poorly designed cloud infrastructures to make them more efficient, reliable and cost-effective.
Risk 1: Beware of cloud native malware
With the increasing connectivity of cloud services and growing data transfer between different cloud platforms, the risk of being victimized by cloud-native malware is also increasing. Such malware specifically targets cloud environments and exploits vulnerabilities in cloud infrastructures and applications. Some are spread via cloud storage and collaboration tools.
But that’s not all: threats also lurk in new infrastructures, including edge systems for data-intensive use cases, non-x86 architectures for specialized workloads, serverless edge architectures and 5G mobile services.
Risk 2: The curse and blessing of AI – attacks on cloud-based AI platforms
Another field that is becoming increasingly important in terms of cloud security is – unsurprisingly – artificial intelligence. In a global survey by McKinsey, a third of all respondents stated that their companies already use generative AI on a regular basis, and the trend is rising. AI can be a valuable tool in the fight against security threats. On the other hand, attackers are also increasingly relying on AI to expand their arsenal of weapons and exploit the trust that developers place in automated systems. Experts predict that AI-driven attacks will increase in 2024, forcing rapid adjustments. This will require ever smarter AI-based security measures that can not only identify threats in real time, but also predict and prevent them.
Risk 3: Software Supply Chain Risks
But that’s not all, because attacks on the supply chain have also become increasingly important in recent years. Imagine a single line of code, hidden in a framework, bringing your entire digital world to a standstill: this is what software supply chain security is all about. As with any supply chain, the security of your software is only as strong as the weakest part of the system. More and more companies are falling victim to software supply chain attacks. If users and assets are distributed all over the place, this additionally increases the risk of attacks. Hackers can either exploit supply chains to gain important insights or they can cause damage within supply chains. Cyber criminals are increasingly focusing on exploiting vulnerabilities in third-party services, such as software or code that are critical to production or Continuous Integration (CI), Continuous Delivery or Continuous Deployment (CD).
The good news: Gartner analysts predict that global spending on security and risk management will amount to 215 billion US dollars in 2024, an increase of 14.3 percent compared to 2023. Companies therefore appear to be aware of the threat.
The bad news: Experts from the international Cloud Security Alliance criticize insufficient cloud security expertise. According to the latest study, 77 percent of respondents do not feel adequately prepared for security threats.
It is clear that the cloud is a completely different environment to an on-premise application. Therefore, cyber security teams that copy and paste security policies into the cloud will quickly realize that this approach won’t work. Since the cloud is predisposed to automation and speed, native cloud security tools are a key requirement. However, such tools require expertise, otherwise companies will soon be faced with environments that their teams are not equipped to protect. It’s about implementing tools that are optimized for cloud environments. Investment must also be made in cloud security training. This includes knowing current guidelines and requirements. We have compiled the most important ones.
These are the security guidelines and specifications you need to know
Compliance with security guidelines and legal requirements, for example within the EU, is essential for companies that use cloud services. This is the only way to ensure the confidentiality, integrity and availability of important data and avoid potential administrative fines and legal consequences.
- General Data Protection Regulation (GDPR): The GDPR, or General Data Protection Regulation, came into force in 2018 and applies to all companies that process personal data of EU citizens, regardless of where the company is based. The GDPR sets strict requirements for the security of personal data, including data processing in the cloud. Cloud service providers must implement appropriate security measures to meet the requirements of the GDPR.
- NIS Directive: The Network and Information Security Directive, or NIS for short, is an EU law that aims to strengthen the security of network and information systems throughout the European Union. It obliges operators of central services and providers of digital services to take appropriate security measures to ensure cyber security. This includes securing cloud infrastructures used to provide these service.
- ISO/IEC 27001: ISO/IEC 27001 is an international standard for information security management systems (ISMS). Although it is not a legal requirement, it is often used as a best practice guideline for securing information and data in companies. Many European companies using cloud services require their cloud service providers to be ISO/IEC 27001 certified to ensure that appropriate security controls are implemented.
- Cloud security certifications: There are also various cloud security certifications that have been developed by European authorities and organizations to assess and guarantee the security of cloud services. Examples include the Cloud Security Alliance (CSA) STAR certification program and the EuroCloud Star Audit. They help to select trustworthy cloud providers that meet high security standards.
- National laws and regulatory requirements: In addition to the EU-wide directives, certain European countries have specific national laws and regulatory requirements relating to the security of cloud services. You should be familiar with these specific regional regulations and ensure that your cloud infrastructures comply with the respective requirements. Examples for Germany: The Federal Data Protection Act (BDSG) regulates the handling of personal data in Germany. The IT Security Act 2.0 is an extension of the IT Security Act and aims to strengthen the security of critical infrastructures in Germany. The Technical Guideline BSI TR-02102 of the Federal Office for Information Security (BSI) provides recommendations for the secure use of cloud services in German federal authorities and organizations.
Conclusion Cloud Platform Security
Well-planned user management, policy compliance, accompanying security tools and cloud adoption strategies help to reliably control data and devices in the cloud in 2024 and beyond. To ensure that the cloud only provides advantages and does not mutate into a data-guzzling thundercloud, it is worth relying on profound expertise.
