The cloud: Today’s security risk and answer all in one

The cyber breach headlines always grab the attention. Cybercrime is indeed rife in Australia. In the financial year to June 2020, the Australian Cyber Security Centre confirmed it had received 60,000 reports of attempted or successful cyber crimes. Forty percent of these were fraud - everything from shopping scams to sophisticated investment fraud.

Our recent webinar in association with global cyber security leaders Palo Alto Networks, Total Security for the Work from Anywhere Model, revealed that almost 80% of Australian business leaders are not confident in their security posture.

What the pandemic has demonstrated is that the cloud is hard to secure because it is so easy to deploy. And businesses of all sizes keep rapidly adding more services, with many adding between three to five new publicly addressable cloud services per day. It seems to me that we place great trust in the native cloud security offered from leading technology companies but are we becoming complacent?

Cloud misconception

Most businesses I speak with believe, rightly or wrongly, that the cloud providers and the hyperscalers of the world invest so much that, by default, their security should match their investment levels. Yet cloud footprints were responsible for 79% of the most critical security issues found in global enterprises, as a recent report from Palo Alto Networks found.

Remote work has resulted in an increase in the points of weakness in newly-distributed networks operating outside of traditional or legacy security perimeters.

I’m sure I don’t need to remind you that employees who are working at home using a $50 router their Internet Service Provider has supplied them with and adopting a password like [INSERT FAVOURITE SPORTS TEAM]+[INSERT CHILD'S FIRST NAME]+[INSERT BIRTH DATE] are easy targets for hackers.

At the same time, the cost of computing has become so inexpensive that an attacker need only spend about $10 to rent the cloud computing power required for an imprecise scan of the entire internet for vulnerabilities.

Layered on top of this is the surge in cloud services, hastily deployed to support the remote work trend which added another batch of vulnerabilities. When the Australian Governance Institute puts the average cost of a security breach in Australia at $4m, the risks are difficult to ignore, making the outlook feel pretty perilous.

In reality, Palo Alto Networks’ report is yet another reminder that the move to cloud can have its own security leaks and pressure points. But, as I tell my customers all the time - it's not something you have to do in one giant leap; smaller steps are possible if aligned to the right outcome.

The traditional approach

In the past, at the network level, security would involve encrypted traffic. There’d be firewalls located at corporate head offices and branch offices, so if you were working from home, you’d funnel through a virtual private network (VPN) into a physical data centre or to the corporate head office. From there, you'd be authenticated so you could then access the information that was behind the firewall.

That firewall may have been managed by the telco, the company's in-house IT team, or alternatively by an outsourced IT services provider, consulting firm, or security firm. Or some combination of all of these.

This VPN model sounds complicated because it is. Complex, sometimes inconsistent and inefficient, often inflexible, yet still not comprehensively addressing the potential risks of the company.

Rebuilding, and considering alternative security models from the ground up can feel like taking a big, daunting leap into new territory, so, in their haste to evolve their security posture without free-falling, companies resort to adding bundled solutions on top of this VPN model - essentially just “adding bigger, shinier boxes that had previously been deployed before”, as Ryan Crouch, CTO at Superloop puts it.

This can add security but at a cost of even greater complexity and more administrative upkeep.

Evolving the security model - one step at a time

This has benefits: changes are easier to manage, the cost is spread, benefits accrue earlier, and you can learn insights as you go, and improve.

As a starting point, a network evolution is required to start unpicking the complexities. Telcos like Superloop can offer infrastructure management solutions to address the network and cloud security, and advise on integrated solutions that involve small incremental changes, continuity, and zero downtime.

Cloud-orchestrated security designed to complement your network can then improve the efficiency, consistency of user experience, and security. It can do so wherever in the world your employees are and whichever device they choose to connect from - replacing the traditional approach that relied on upgrading multiple VPNs across the world.

Everybody inside the enterprise, whatever their location, should have their assets protected, including those of us now based at home, with consistent, high-quality security settings.

And this, of course, also protects the enterprise itself.

In making decisions about security, risk and investment, enterprises need to balance the returns on the investment they make and the risks they're prepared to take if they don't (or can't) make the investments to guarantee security. There’s no need to discard all the solutions from partners like Palo Alto Networks, as they too are seeing the need to secure the cloud, most likely from a cloud delivered security platform.

There are ultimately three questions to be answered:

1. Which organisations do enterprises trust with its security?

2. What roles do each of the "security ecosystem partners" - the telco network partners, the cloud services partner, the outsourced IT partners and the in-house technology teams, play?

3. What's the level of risk the enterprise is prepared to take?What investment is it prepared to make, and where is that investment made?

Considering affordable decisions that deliver an early return for the investment made, that can act as the starting point of a larger security strategy, is a valid approach to improving enterprise and network security.

Take stock. And start with small steps in the right direction.