A report from the Ponemon Institute found that after a breach, companies experience a five percent drop in their average stock price the day a breach is announced, as well as a seven percent loss in customers, and another 31 percent of consumers who discontinue their relationship.
A survey of 757 Citrix customers by ESG found that 69 percent of customers feel that using cloud-based business applications and services is at least somewhat important to employees’ productivity/efficiency. But it’s also important for the security of business operations.
How the cloud helps prevent attacks, or reduces the cost of a clean up
By keeping company apps and data in the cloud, they’re always available. The goal of a ransomware attack is to steal or encrypt data until the ransom is paid, and then maybe handing over the encryption keys once it’s paid.
By hosting data in the cloud, businesses can dramatically reduce that risk. If a device is infected with ransomware, its access permissions to the cloud and company network can be wiped and the device decommissioned remotely — thereby removing the threat and potential spread across the system.
Using data analytics to make your cloud smarter and more secure
Businesses gather data every day about who has access to what data, on which device(s), from various locations. All this data can make our systems smarter and help us move away from the traditional password model, which has proven itself to be easily compromised. Passwords are easily stolen and hard to remember.
Instead, however, by teaching our systems, through machine learning and artificial intelligence, to rely on the context of access requests to our clouds, we can finally move away from passwords and toward a more secure model of identity and access management based on the context of requests and typical patterns of behavior.
Data analytics can also help give us better insight into our own organizations. Smart security policies that decommission access and devices when employees are terminated or when contracts run out will help further lock down data and apps stored in the cloud.
Instead of allowing it to be stored on their devices, if third parties and employees are only given access to information in the cloud, that simple policy can eliminate the risk of a malicious insider or data being downloaded or shared via insecure means like unsanctioned apps (shadow IT) or USB drives.
By creating identity and access models that revolve around known and unknown behaviors, the security industry and those it serves can finally move beyond passwords to embrace identity-based security which will give us significantly more confidence in and visibility into the security of our infrastructures — be they legacy or cloud. It’s a lot easier to steal a password of a cat name, than it is to actually assume the identity of another person.
The burden of proof: data analytics can help find threats faster and allocate resources where they’ll be most effective
The burden of proof always falls to the security organization. What are the knowns and unknowns, how can a business prove they’re more secure, show the board that incidents are trending down, risk is being reduced and productivity is trending up? The security operations center is how.
More devices mean more data and access requests. The complexity from the volume of devices on business networks means we need better tools to automate the collection and distillation process to filter out the noise and keep the business running efficiently and securely. The security industry is facing a massive shortage of talent, so our limited resources need to be put where they’ll be most effective in stopping or preventing an attack.
Automation tools can help cut down on the sheer volume of data from across an organization and bring it all into a single, consolidated view, which gives security and IT teams the power to focus their attention on threat prevention, rather than remediation.
Simple steps to security
- Increase visibility. Implement a contextual model of access to give IT greater visibility with a single pane of glass to reduce complexity and find threats faster.
- Devise a breach response plan. It will happen, if it hasn’t already. Being prepared can make sure company or customer downtime remains at a minimum and that remediation costs don’t skyrocket out of control.
- Trust in the cloud. Ask the right questions of cloud providers, take the necessary steps to ensure your cloud infrastructure is secure. Take advantage of the scale and infrastructure of established cloud providers. Let them spend the money on infrastructure, and learn from their best practices for securely storing data in the cloud.
- Make your data work. Use the vast amounts of data collected within your organization to your advantage with automation tools to find what’s most useful to prevent attacks and where resources should be devoted.
- Always patch. Make sure access permissions and patches are up-to-date. Simple solutions can be the most effective ones in threat prevention.
Taking these simple first steps can help allocate limited resources where they need to go, reduce costs, and help business move closer to a proactive approach to security.
The time has come to stop focusing on fear and doubt, and to move forward with conviction. Allocate resources where they will be the most effective at protecting sensitive company apps and data.
Use cloud resources where they make the most sense. When an established public cloud vendor has greater scale and more reliable infrastructure than your organization can match, take advantage of it and focus your resources where they make more sense. Make the best use of automation tools and advanced analytics to reinforce and improve security and operations.
Storing applications and data in the cloud, and using resources more intelligently can give organizations the peace of mind needed to keep business running more efficiently and securely, and better positioned for long-term success.