Cloud security: Five things you need to get right

Image: Getty

The popularity of cloud applications and software has risen significantly in recent years. But while using cloud services can be beneficial for businesses and employees, it also carries new cybersecurity risks.

Special Feature

Securing the Cloud

Cloud computing is now a business essential, but keeping your data and applications secure is vital. Find out more about cloud security in this ZDNet special report.

Read now

The ability to log in from anywhere using cloud applications is convenient for employees, but it's also a potential new opportunity for cyber criminals, who, with a set of stolen passwords, could gain access to sensitive information. There's even the prospect of hackers abusing cloud services to launch ransomware attacks and other malware campaigns. 

2. Don't give every user the keys to the kingdom

Cloud applications and services are convenient, providing users with a variety of tools they need to be productive, all in one place. But different users have different needs and most users don't need high-level privileges – particularly when that access could easily be abused by an unauthorized user who has hacked or otherwise taken control of an account with admin rights.  

Security

• 8 habits of highly secure remote workers
• How to find and remove spyware from your phone
• The best VPN services: How do the top 5 compare?
• How to find out if you are involved in a data breach -- and what to do next

It is, therefore, imperative for IT and information security teams to ensure that administrator privileges are only available for those who really need them – and that any account with administrator privileges is properly secured, so attackers are unable to gain access and abuse high-level accounts -- to create additional accounts they could use to secretly go about their business, for example. It's also important that regular users don't have the power to escalate their own privileges or create new accounts. 

In the worst-case scenario, a misconfigured cloud application facing the open internet may not require login details at all, meaning anyone can gain access. It's vital that organisations are aware of how their cloud services interact with the open web and that only those who need these services can access them. 

4. Don't ignore security updates and patches – cloud software needs them, too

One of the most important things you can do to improve the cybersecurity of your network is to apply security updates and patches as soon as possible. Cyber criminals regularly look to exploit known vulnerabilities in applications to breach networks and lay the foundation for cyberattacks. 

Cloud

• ​What is digital transformation? Everything you need to know
• The best cloud providers compared: AWS, Azure, Google Cloud, and more
• The top 6 cheap web hosting services: Find an affordable option
• What is cloud computing? Here's everything you need to know

Cloud software is no different. Vulnerabilities can be uncovered and they will receive security patches, which need to be applied.

IT departments that run large, cloud-based networks might think that security is taken care of by the cloud service or application provider they use, but that's not always the case – cloud software and applications need patching too, and it's vital that this work is done promptly to ensure the network is resistant to cyber criminals trying to exploit vulnerabilities.

5. Don't rely purely on cloud for storing data – keep offline backups in case of emergency  

One of the key benefits of cloud software is that, in many cases, it's available at the touch of a button – users can access data stored in the cloud, from wherever they are and from whatever device they're using.  

Show Comments