Many security professionals realize their organizations are becoming increasingly vulnerable to cyberattacks as they expand their cloud IT infrastructures, but they feel powerless to do anything about it.
That’s one of the key takeaways of a recent survey Illumio commissioned research firm Vanson Bourne to conduct to assess the state of cloud security worldwide. While 98 percent of the 1,600 IT security decision-makers polled said their organizations store and manage sensitive data in the cloud, over half believe their cloud security postures are weak. This fear stems from their reliance on traditional security tools designed to protect on-premises IT systems that have proven ineffective at securing cloud-based resources.
Fortunately, the study also identifies steps any organization can take to harden its cloud security posture and mitigate the damage of the inevitable data breach.
Along with storing sensitive data such as financial, business, and customer or employee personally identifiable information (PII) in the cloud, most organizations (89 percent) also run their highest-value applications in the cloud. Unsurprisingly, cybercriminals have set their sights on these valuable resources.
The research identifies the three main cloud-based weaknesses that attackers exploit:
In 2023, 47 percent of all data breaches in respondents' organizations originated in the cloud, causing significant damage. The average cost of a cloud-based data breach is more than $4 million (USD). Thirty-five percent of respondents lost more than $1 million. Those figures do not account for the impact of long-term damage to brand reputation and the loss of customer trust. Additionally, 48 percent said their business operations ground to a halt because they couldn’t access their most critical cloud-based services.
The report reflects a sense of helplessness among the respondents. It’s understandable: They’re trying to defend their organizations against cybercriminals skilled in bypassing traditional security measures. But in the cloud, organizations are one misconfiguration away from having their critical services and data exposed to the internet.
Organizations, therefore, need real-time visibility across their cloud IT infrastructures to fully understand the connections happening and prevent attackers from causing serious damage. Yet, a significant majority (95 percent) of respondents lack that visibility.
If you're concerned about your organization’s cloud security posture, avoid setting unrealistic goals like stopping all attacks or entirely preventing cloud data breaches. Instead, embrace a Zero Trust approach that will allow you to proactively prevent inevitable attacks from moving across your cloud environment. This approach contains attackers and keeps them from causing serious damage or losses.
Rather than making assumptions about the underlying environment of where a resource is running, Zero Trust Segmentation (a.k.a. microsegmentation) grants access to resources based on who needs access, what the resource is, and where the resource is at any given time. This limited, least-privileged access between resources serves to contain attacks, prevent lateral movement, and boost cloud resilience.
Embracing a Zero Trust strategy is not just a theoretical concept but a practical response to the cloud's borderless nature. This approach, rooted in the understanding that security incidents are inevitable, offers a more dynamic defense mechanism. Zero Trust Segmentation, specifically focusing on least-privileged access, is instrumental in containing breaches and enhancing resilience. This shift in strategy resonates with the need for real-time visibility, a gap 95 percent of respondents identified as a significant hurdle in their current cloud security posture.
However, security isn't a solitary endeavor. The survey reveals a pressing need for closer collaboration between security teams and developers, a sentiment 47 percent of respondents echoed. This collaboration is crucial in cloud environments where developers work every day, and the risk of creating unintentional vulnerabilities is high. Bridging this gap isn't just about improved security measures; it's about fostering a culture where security is a shared responsibility, similar to the partnership organizations have with their cloud providers.
The convergence of a Zero Trust framework with enhanced collaboration between security and development teams is foundational to a robust cloud security posture. This dual approach directly addresses the vulnerabilities and fears the survey findings highlighted. By implementing these strategies, organizations can significantly narrow the security gaps in their cloud infrastructures and mitigate the risks and costs associated with cloud-based data breaches.
Raghu Nandakumara is the Head of Industry Solutions at Illumio.
Related articles:
With many enterprises new to NaaS, service providers can differentiate themselves from competitors by prioritizing superior customer service and experiences.
Unlocking the full potential of telecom in the SaaS era relies on comprehensive strategies and a constant commitment to evolving security practices.
Eliminating complexity by standardizing with a platform approach is the way to put the brakes on the complexity cycle.
