Succeed with a robust posture and a simple approach

Your data is valuable to you and others

We all want to secure our most valuable digital business asset. Unfortunately, unwelcome parties also view your data as their business asset. Hackers and industrialized cybercrime syndicates constantly compete for your data. The rise of cybercrime is all around us, and one need not dwell on that. We will explore how to be better prepared and get around the fact that nearly 98% of companies experience a cloud data breach in about 18 months. ¹ How can we protect our data and reduce cyber threats that are no longer an IT problem but a business operational issue?

How did we get here?

Collectively, we own the cyber security problem. Gartner estimates that by 2025, 99% of cloud security failures will be customers’ fault due to human error. Ouch. The research firm also predicts that through 2025, 90% of organizations that fail to control public cloud use will inappropriately share sensitive data. These are severe trends because about 89% of companies have a multi-cloud strategy. ² The bad news at the same time is that cybercriminals are interested in your credentials, personal and healthcare data, in that order. ³

Then there is the human factor. According to the National Security Agency (NSA) 2021 Mitigating Cloud Vulnerabilities report, cloud misconfigurations are the top vulnerability in cloud security environments. The NSA estimates that 99% of companies will have cloud misconfigurations that they don’t know about. So, that means everyone.

The distributed enterprise driven by remote work and distance learning has expanded the network parameter to the furthest mobile device on an employee. Most cyber threats contain human factors, and insider risks are a big part of that. In addition to outside risks, 96% of business leaders have cybersecurity concerns about protecting corporate data from insider risks. ⁴

One area that contributes to vulnerabilities is the cloud shared security model. Cloud Service Providers (CSPs) are responsible for securing their clouds. While this means you are not responsible for the cloud infrastructure and services themselves, you are responsible for everything you run on it, which is at least as complex as managing security in an owned and operated datacenter – albeit the cloud services have generally a more complete set of APIs to automate your security posture.

Another growing contributor to cyber threats is the rising edge and integration of IT and operation technology (OT), better known as OT/IT. Gartner estimates that by 2025, 25% of edge networks will be breached compared to just 1% in 2021. ⁵

Adopt an end-to-end security posture

The key to successful data security is a simple, robust security posture covering four critical areas and viewing them as a continuum. Data active lifecycle has four phases or stages. A security strategy must protect data in all states without exception or compromise.

Access control. Adopt and strictly enforce modern and robust access controls for every user. The guiding principle here is to provide access to company resources to authorized users who can be verified beyond simple passwords. Enterprises need to rise to the level of threats and implement automated threat detection and response. It is no longer viable for any organization to manually sort out severe threats from other ones, especially with the shortage of skilled security practitioners. More modern rules for credentials beyond static multifactor authentication (MFA) are necessary for lowering risks. Access control and management must extend beyond detecting and stopping threats and actively responding to threats to demotivate bad actors.

Data security. Data protection must span all three states of data: when at rest (residing on storage devices), in transit (traversing the network), and in use by apps (in memory). All data must be encrypted with sensitive data subject to the most strict or strongest encryption algorithms and key management. Consider investing in Keep Your Own Keys (KYOK) supporting solutions to secure valuable and sensitive data. KYOK ensures that no third party can see your data even if your data is compromised. In other words, even if cybercriminals get their hands on your data, it will be of no value to them because they cannot see it. Reducing the investment value of criminal enterprises plays a role in demotivating them. It also draws down their resources lowering potential future threats.

Management and visibility. To effectively manage apps or data, you need to be able to see them and know where they are. While that may sound intuitive, consider these facts. About 95% of apps in enterprises are not monitored, and 44% of IT teams’ time is spent on manual tasks. According to recent industry research, a whopping 93% of CIOs think that AI assistance is critical to coping with increasing workloads. Also, about 70% of CIOs say monitoring containerized microservices in real-time is almost impossible. ⁶

Automation and orchestration. Automation can ensure a highly standardized deployment that adheres to all the best practices. It ensures timely patching and the ability to easily redeploy applications so you are never delayed implementing fixes. It can also set you up to recover and redeploy, if needed. Remember that many of your attackers are coming at you constantly with automated tools that are sweeping for vulnerable endpoints; you need to apply automation to your protection to have a chance to keep up.

Access control, data security, management, and automation are continuous, where all elements must be implemented for data security strategies to work. Keeping things simple and frequently updating your guidelines will go a long way towards keeping your data accessible to authorized users and out of the wrong hands.

Sources:

1. Ermetic, by IDC 2021. State of Cloud Security 2021.
2. Flexera 2022. “State of the Cloud Report.”
3. Verizon. 2021 Data Breach Instigations Report.
4. Code 42. Annual Data exposure report 2022.
5. Gartner. Predicts 2022: The Distributed Enterprise Drives Computing to the Edge.
6. Dynatrace 2021. “2020 Global CIO Report.”