Are you trying to keep up with the pandemic in terms of data security and privacy? You're not alone. Just over a year ago, Covid-19 threw countless businesses around the globe into a mad scramble to implement hybrid solutions to maintain some semblance of regular operations. We finally see the light at the end of the Covid-19 tunnel, but the way people work seems to have changed permanently as supporting remote work became necessary for many companies. While many have considered work/life flexibility and time-efficiency of not having to travel to work every day a blessing, there's more to such a shift than meets the eye.

The problem with hybrid work models facilitated by the cloud is that they need proactive and thoughtful implementation. It's essential to understand how security features in the cloud work and to implement them properly. One can't simply drop data into the public cloud storage and head for the hills. Without proper security measures and risk assessments, not to mention regular infrastructure maintenance, cyber threats pose a genuine risk to your company's and customers' data and employee credentials and privacy.

Regardless of whether your team works on-site or remotely and whether you handle primarily internal or customer data, the security considerations are the same. Key among these considerations is the fundamental division of responsibility in the public cloud, where the cloud provider is responsible for the security of the cloud, and the customer is responsible for security in the cloud.

Don't make the mistake of thinking that your cloud provider is responsible for ensuring your data is secure. Your cloud provider's security responsibility ends with ensuring that their data centres are secured from unauthorized access, that servers, storage, database and networking hardware are free from intrusion, and that any managed services they offer are patched and maintained. Beyond that, it's up to you as the cloud customer to ensure that you use the tools they provide correctly to keep your data and applications safe.

Let's work through some of the top cloud security measures a typical business should consider.

Identity and Access Management Tools

If you want to protect your data while making it accessible to your employees, try a siloed approach. In this model, identity and access management (IAM) user permissions and overall organizational account structure are managed based on job function. This segmentation leverages the principle of least privilege, where users have access only to the resources and actions they require to perform their job and nothing more. That way, if a bad actor infiltrates your infrastructure or credentials are compromised, the threat is contained to a limited scope.

Encryption and Firewalls

Encrypting your data in transit and at rest wherever possible will provide an additional layer of security for your data. You can achieve this with TLS/SSL encrypted communications and server-side encryption powered by a cloud-native tool like Key Management Service in AWS or by implementing client-side encryption.

Be sure to use firewall and network ACL features to control communications within your network and VPN connections to help remote workers access the company's resources securely, whether at home or on public WiFi.

Configuration Management

Use cloud configuration management tools to maintain and monitor the state of your configuration, notify you of changes, and facilitate restoring the state to what it should be.

Password Policies

Ensure you have robust password policies that require complex passwords that expire after a specific period and can't be reused. Require multi-factor authentication (MFA) so that an email address and compromised password aren't enough to access an employee account in the cloud.

Private and Hybrid Cloud

Suppose you have data that's too sensitive to store outside your premises, such as financial or health records. In that case, you can keep it in your on-premises "private cloud" infrastructure and enable encrypted communications between that data store and other cloud services you use. This kind of architecture is often referred to as "hybrid cloud."

Threat Detection, Monitoring, and Alerting

It's a good idea to invest in threat detection solutions. Suppose someone's trying to penetrate your digital defences, for instance, by attempting to brute force passwords or using old, compromised ones that you've already changed. In that case, you want to detect and respond to the threat as early as possible. AWS Guard Duty is a service that assists in this regard by continuously monitoring your environments for unusual activity and threats to your accounts.

Log Aggregation and Analysis

To assist with auditing and analyzing incidents, it's essential to store your application, network, and server logs in a central location that can't be tampered with by anyone in the organization and employ a tool like Sumo Logic to analyze the data.

Regular Patches and Maintenance

Of course, keeping up with patches to minimize the risk of emerging threats to server software is an imperative cloud security measure. The same goes for configuring automatic vulnerability scans. Work with your IT provider or in-house technicians to regularly perform comprehensive security and systemwide audits, which are handy for identifying any outdated processes, compromised passwords, and other security risks.

The Tip of the Iceberg

We've only just scraped the surface of what's required to keep your cloud infrastructure secure, but these tips are a great start. You'll find security whitepapers and other resources on the support websites for all the major cloud providers like Microsoft Azure, Google Cloud Platform, and Amazon Web Services. Arm key people in your organization with a clear understanding of where your responsibility for the security of your cloud environments begins and ends. You'll be positioned to face these risks head-on with a well-rounded, future-facing and proactive cloud security approach. You'll enjoy peace of mind, and so will your employees and customers.

Author: Nelson Ford, Founder and Principal Solutions Architect at Pilotcore.