Cloud Services: ticking the boxes

Many organisations have moved their office systems onto Cloud-based arrangements, deeming it both cheaper and safer to hold their precious data rather than maintaining an in-house server facility of their own. Since most Cloud service providers are large multi-national businesses, it is reasonable to assume their systems are secure. However, it is worth noting the majority of recent cyber break-ins have occurred on Cloud-based services.

In the early days of the covid-19, pandemic, firms sent staff home to work. Personal computers belonging to employees lacked the rigor of ‘office IT’ and their firewalls caused havoc with cyber and data security. Home-working security is improving but still remains vulnerable to attack with firms having to keep a close eye on their defences to maintain a watertight seal on this data.

Nearly a quarter of firms experienced some Cloud server incident in 2022, such as a misconfiguration, malware or ransom demand. Some of this is down to firms having more than one Cloud server; while seemingly the trend these days, it seems to make misconfigurations more likely. And while this has ushered in more flexible software systems, most have found running on multiple severs more complicated.

Data protection

Cloud providers with all the right credentials like ISO 27001 and ISO 9001 certifications and Cyber Essentials Plus, CREST Certified or members of the PCI Security Standards Council ought to have everything covered. Nevertheless, it is worth asking.

Most vendors already have a good understanding of the various services currently on offer with which to select one that meets the needs of their firms and its management. However, contracting out your firm’s most precious data records and systems to a third party warrants a close eye on where and how it is being managed, if only for General Data Protection Regulation (GDPR) compliance reasons.

Your vendor should have scrutinised the wording of their Cloud providers terms and conditions, set-up all the necessary security measures, including multi-factor authentication and allowed for the in-house use of other subsidiary Cloud services like Dropbox and WeTransfer, often referred to as Shadow IT, to bring everything under one robust security regime for the entire organisation. Again, it is worth asking your vendor if this is actually the case.

The security of data and systems being held on your Cloud server must remain in focus though and not left to this or that assumption made about Cloud services in general. These are arranged on the basis of data storage needs only, with security coming later so it is vital to ensure all your storage and security needs are met. Nearly all the recent Cloud Service break-ins were suffered by firms who had not applied multi-factor authentication. In fact, there are so many firms who have not selected this extra layer of security that cyber criminals were falling over themselves to break-in! It is just too easy for them.

Moving systems and data to the Cloud, where most services are held on ‘shared’ servers, where there may be data belonging to several businesses on the same server, presents a far larger target for cyber criminals, allowing them to pick and choose who to go after, including many without multi-factor authentication turned on!