Ruslan Rakhmetov, Security Vision
Cloud services have become an important part of modern man's digital life. Not only do they provide storage and convenient access to personal data from any device, but also file sharing and collaborative editing, infrastructure management and cloud computing for 60-85% of organisations worldwide. Like any other technology, cloud services have their own risks and cyber threats, so in this article we will focus on data security in the cloud.
Data security is ensured by providers in the classic and discussed in our blog in the ways and means of protection. The security of cloud services is a complex process that includes both the actions of users themselves and the tasks of providers, such as: physical security of data centres, network security and security of the data itself, access control and application security.
Data centre infrastructure protection consists of strict access control to the territory, the use of biometric data and round-the-clock monitoring of all areas of the data centre by video surveillance systems. Data security within the framework of business continuity management is supported by control of optimal temperature and humidity conditions to protect equipment and protection from natural disasters and other catastrophes. Classic uninterruptible power supplies and other redundant power sources will protect data from loss due to physical impact on servers and other equipment.
On the other hand, security is provided at the network level (protection against unauthorised access from external networks through firewalls, secure connections between users and the cloud, and intrusion detection and prevention systems to detect and block attacks). A special place in traffic protection is occupied by solutions for protection against distributed denial of service attacks (DDoS, Denial of Service) and protection of web applications from various vulnerabilities (SQL injection, cross-site scripting XSS, etc.).
And the security of the data itself starts with quality encryption of data both at rest and regular backup of data for recovery in case of loss (or extortion using encryption crackers). Maintaining detailed logs of user actions to analyse and investigate incidents complements the security features and allows, albeit not active action, for quality and rapid investigation of incidents that occur.
Cloud service providers are constantly improving their defences and developing new methods to prevent threats, but in any current state, part of the data protection function depends on the users themselves. If you approach the task of choosing a reliable service thoroughly, you should start by looking at reviews and ratings and reading the provider's security policies. Don't hesitate to ask your loved ones or profile communities for advice, but here are some expert tips and key actions you can perform yourself:
- don't use obscure, poorly researched and unproven by time and user reviews;
- use strong passwords (complex, using letters of different cases and special characters);
- create unique passwords for different services (if you lose one of them, you will not lose all your data);
- remember that passwords should be updated periodically, set a reminder on your smartphone for this purpose;
- enable two-factor authentication for all your accounts related to personal and work data;
- select multiple services to use simultaneously to keep data safe and/or create local backups.
- Encrypt data end-to-end or additionally password-protect archives with sensitive data before uploading to storage;
Attackers may try to trick you into accessing your data in the cloud, but by following the recommendations above you will build strong echelons of defence. Attackers can also target the provider's employees, to manage this risk companies provide training for employees in addition to implementing the various defences described in part one of this article. Attackers can also use side channels to gain information, for example by analysing transaction times or resource consumption, this kind of analysis for future breaches can be detected by applying machine learning to find anomalies in network traffic. Providers are also motivated by regulators issuing various security standards such as ISO 27001, GDPR, 152-FZ, PCI DSS and HIPAA for different types of data.
The particular way of organising the storage uses decentralisation. Blockchain technologies in 2024 are not only being implemented in the areas of torrents, NFTs and digital currencies, there are developments for decentralised storage and transaction transparency for clouds as well. Only in this case, developers will have to pay more attention to data encryption and privacy issues.
The last part of this article is devoted to a review of permissions and granted access, a fundamental principle of security in cloud environments. It consists of systematically reviewing and reassessing user access to data and resources. The purpose of this review is to minimise the risks of unauthorised access and prevent data leaks.
When we talk about the use of clouds for companies, it is worth remembering that employees' responsibilities and projects may change, and so do the permissions they need. Over time, unused or redundant permissions may appear and become a potential threat.
We recommend following a few principles for similar cases:
- each user should only have the permissions they need to perform their tasks;
- Permissions that are no longer needed by the user should be monitored and removed in a timely manner;
- you should check whether a user's current permissions match their current responsibilities.
Use tools to automate the process of collecting permissions data and detect anomalies, implement asset management processes for accounts and their accesses, implement tools with AI to analyse big data, or manually manage employee accesses as part of job changes and employee terminations. Permissions granted to external users (e.g. contractors, outstaff and outsourcers) are also worth monitoring.
If we focus on personal use of cloud services, regular review of permissions would also be a useful habit. Examine your cloud storage and remove old access links, enable notifications when new users connect to a shared photo album or folder, and periodically update your passwords. Don't trust everyone when granting access to your data and remember that cloud security is a shared responsibility between the provider and the user. Following these tips will greatly reduce the risk of your data being lost or compromised, even if you trust your provider.
