This article is part of our State of Cloud Security 2021 Series which interviews a diverse mix of cloud security experts, design-makers, and practitioners with a goal of better understanding their perspectives on the current state of and future of cloud security.
The following is an interview OpsCompass CTO, John Grange recently had with Amit Gupta, CEO of Rapyder.
JG: What is the state of cloud security today?
AG: Thanks to multiple recent incidents, data privacy and security were compromised, and its after-effects exalted cloud security amongst all segments of the business world. And more worryingly, the data leaks that happened over the years were getting massive attention from public media, including celebrity image leaks, enterprise data leaks, etc.
All these incidents drew attention which together culminated in propelling security as a necessity rather than an option. To draw a picture, around 67% of our current clients have faced cloud-related DDoS, SQL injection, or other forms of intrusion attempts within the past four years.
JG: What are the most common challenges organizations face when it comes to cloud security today?
AG: I would have to say security misconfiguration holds the first spot in my mind. It is not just your adopted services; the way you layout that security structure also matters more than a layman can comprehend. Placing appropriate services with controls such as IAM plays a vital role in securing any network, contributing to the second point.
Businesses usually start their cloud consultation with an architecture analysis, which should be done without fail as such analysis reveals many loopholes in terms of security, cost and performance. Many businesses I know end up spending less on infrastructure while enjoying better performance, reliability, and agility with the adoption of the cloud.
The third point, most infrastructures are built with either performance or cost optimization in mind. They seldom give preference to security configuration- primarily by availing a security product/ service that barely protects them from advanced-level attacks.
We suggest specialist security products such as Checkpoint, F5, Palo Alto, TrendMicro, and many more to enhance the security of existing cloud architecture, not to mention other aspects of data security such as disaster recovery.
JG: What lessons can be learned from the most significant cloud-related breaches of 2020?
AG: The topic could be a whole another level discussion, but to mention a few considering the pandemic situation at hand,
· More and more companies are adopting cloud infrastructure, and the number of cyber-attacks is also growing proportionally.
· The workforce and end-users shall be aware of what could be lurking and luring them into a stalemate or checkmate.
· Cyber-attacks against MSPs are on the rise.
· Luckily, A.I. and ML-based threat detection systems against zero-day attacks are improving day by day.
· Everyone is taking notice of data-related compliances and their importance.
· Monitoring infrastructure regularly is the key to thwart many unwanted situations.
· All systems are vulnerable to attacks unless they are protected and cared for regularly.
JG: What are 3-5 pieces of advice for organizations looking to improve their cloud security in 2021?
AG: My advice would be to Adopt, Adapt, and Repeat.
To directly put, perform an analysis on the existing architecture, understand the flaws and improvements that can be brought with the help of a specialist while adopting cloud. Adapt to the environment with lesser lags and enjoy the better of cloud.
Please repeat the analysis at certain intervals, as suggested by the specialists, and make amendments to the services and structure.
And finally, the cloud and its supplemental services are getting cheaper as the day goes. The trend extends to firewalls, malware detection systems, data storage, and other aspects related to security.
JG: What’s the future of cloud security?
AG: The best part I am keenly observing is how Artificial Intelligence (A.I.) and machine Language (M.L.) have evolved to provide excellent threat detection and reporting mechanisms. And the story doesn’t end there- many of our clients have stories of how security nightmares were avoided and averted just because of the A.I. – ML combination introduced to the security battleground. And the best part is the automation processes which can learn and push out attacks in a more meaningful, timely, and accurate manner.
Another advantage is that AI-ML security solutions can take considerable pressure off I.T. Heads and Administrators by automating many parts of manual detection of malware samples.
Also, cloud security has started to adopt biometrics-based authentications, which paves the way to the demise of passwords contributing to numerous data leaks or at least making it difficult to crack by introducing a multi-factor authentication.
Overall, I feel that cloud security is an evolving entity from something a business wants to something a business needs that transforms lives. Cloud still has a long way to go, and I am sure it will evolve into something in 10 years which we don’t envision today.
