Cloud usage drives cybersecurity spending, SANS 2020 report

The rapid migration to cloud-based technologies is the biggest disrupter worldwide of operations and a key driver when organisations plan their spending increases, according to the results of the latest SANS 2020 Cybersecurity Spending Survey.

“The SANS survey showed that rapid movement of corporate services and business applications to cloud-based technology is the biggest factor causing breakage in existing security architectures as well as driving most new security spending,” says John Pescatore, SANS Director of Emerging Security Trends. “Cloud monitoring and cloud security access controls were the top two spending areas, followed by spending to increase security staff skills to deal with new technologies, such as the cloud, and to keep up with changes in regulations as well as new threats.”

Slightly more than 50% of respondents ranked the increased use of public cloud infrastructure-as-a-service (IaaS) implementations as the biggest disrupter to security programs in the next 12 months. Based on that, 71% of respondents reported seeing a need to increase spending on cloud security monitoring, followed by cloud access security broker cloud-specific tools (53%), staff skills training (52%) and strong authentication (46%). 

Overall, 57% of respondents feel that out of people, process and technology, an increased investment in people would provide the biggest improvement to their overall security posture, followed distantly by process (19%) and technology (18%). 

“Managers see increased and refreshed skills in their existing staff as being significantly more critical than simply increasing headcount,” according to Barbara Filkins, SANS Analyst Program Research Director and author of the report. “The fact that respondents prioritise increasing staff skills significantly over increasing headcount to deal with ‘disruptive technologies,’ especially when faced with escalating privacy regulations—and fines—worldwide, is not surprising. Business use of IaaS and hybrid cloud requires re-architecting security controls and integrating with CI/CD methodologies.”

In a series of follow-up interviews with selected survey respondents, security managers recognise the need for “upskilling” to increase retention rates, which improves both effectiveness and efficiency. Increased skills around new technologies and new security techniques is also required to enable any use of security automation technologies, which were not highly cited for spending increases in 2020.

Strong authentication, the fourth most highly cited area of planned new spending, points to the recognition that the majority of damage from breaches and ransomware attacks in the past year were enabled by the use of reusable passwords that were easily captured via phishing attacks. CEOs and boards of directors are backing security teams in overcoming obstacles to implementing multifactor authentication.

The report can be downloaded from the SANS website

www.sans.org

[Column] Harish Chib: Seven best practices for securing the public cloud

The simplicity and cost-effectiveness of the public cloud have led more and more organizations to take advantage of Amazon Web Services (AWS), Microsoft Azure, and Google Cloud Platform (GCP). You can spin up a new instance in minutes, scale resources up and down whenever you need while only paying for what you use, and avoid high upfront hardware costs. 

While the public cloud solves many traditional IT resourcing challenges, it does introduce new headaches. The rapid growth of cloud usage has resulted in a fractured distribution of data, with workloads spread across disparate instances and, for some organizations, platforms. As a result, keeping track of the data, workloads, and architecture changes in those environments to keep everything secure is often a highly challenging task.

Public cloud providers are responsible for the security of the cloud (the physical datacenters, and the separation of customer environments and data). However, the responsibility for securing the workloads and data placed in the cloud lies firmly with the customer. Just as organisations need to secure the data stored in their on-premises networks, so they need to secure their cloud environment. Misunderstandings around this distribution of ownership is widespread and the resulting security gaps have made cloud-based workloads the new pot of gold for today’s savvy hackers. 

Seven Steps to Securing the Public Cloud

The secret to effective cybersecurity in the cloud is improving your overall security posture: ensuring your architecture is secure and configured correctly, that you have the necessary visibility into your architecture, and importantly, into who is accessing it.

Step 1: Learn your responsibilities

This may sound obvious, but security is handled a little differently in the cloud. Public cloud providers such as Amazon Web Services, Microsoft Azure, and Google Cloud Platform run a shared responsibility model – meaning they ensure the security of the cloud, while you are responsible for anything you place in the cloud.

Step 2: Plan for multi-cloud

Multi-cloud is no longer a nice-to-have strategy.  Rather, it’s become a must have strategy. There are many reasons why you may want to use multiple clouds, such as availability, improved agility, or functionality. When planning your security strategy start with the assumption that you’ll run multi-cloud – if not now, at some point in the future. In this way you can future-proof your approach.

Step 3: See everything

If you can’t see it, you can’t secure it. That’s why one of the biggest requirements to getting your security posture right is getting accurate visibility of all your cloud-based infrastructure, configuration settings, API calls, and user access.

Step 4: Integrate compliance into daily processes

The dynamic nature of the public cloud means that continuous monitoring is the only way to ensure compliance with many regulations. The best way to achieve this is to integrate compliance into daily activities, with real-time snapshots of your network topology and real-time alerts to any changes.

Step 5: Automate your security controls

Cybercriminals increasingly take advantage of automation in their attacks. Stay ahead of the hackers by automating your defenses, including remediation of vulnerabilities and anomaly reporting.

Step 6: Secure ALL your environments (including dev and QA)

You need a solution that can secure your all environments (production, development, and QA) both reactively and proactively

Step 7: Apply your on-premises security learnings

On-premises security is the result of decades of experience and research. Use firewalls and server protection to secure your cloud assets against infection and data loss, and keep your endpoint and email security up to date on your devices to prevent unauthorized access to cloud accounts.

Moving from traditional to cloud-based workloads offers huge opportunities for organizations of all sizes. Yet securing the public cloud is imperative if you are to protect your infrastructure and organization from cyberattacks. By following the seven steps you can maximize the security of your public clouds, while also simplifying management and compliance reporting.

Harish Chib is the Vice President, Middle East & Africa of Sophos.