Cloud adoption continues to rise across every industry, with one estimate predicting that 90% of enterprises in 2022 will utilize cloud systems at least in some form, and 70% of organizations reporting that they plan to increase their budget for cloud services in the future. It’s no surprise — the cloud allows organizations to increase their technology capabilities and flexibility, often with a better pricing structure.
However, it can also introduce new risks. Cloud computing services have shown vulnerability to cyberattacks, as their use can expand the attack surface across multiple new environments. In fact, in the last 18 months, 79% of companies reported experiencing at least one cloud data breach, and 43 percent reported at least 10 breaches.
The good news is that there is something organizations can do about it. By implementing the right security protections and understanding the areas of risk that need to be mitigated, organizations can take significant steps towards limiting their risk. Managed services providers (MSPs) can play an essential role in helping organizations reach this place by serving as trusted advisors in the cloud and IT security fields, as well as implementing the technologies and ongoing monitoring that can help limit risk.
Being able to offer these capabilities is also an important way for an MSP to grow their business in an area that customers need and want, especially as they expand their environments and look to tap into the potential of the cloud. The result for MSPs is twofold. First, they’re serving important customer needs and meeting their demands for new technology. Second, they’re also helping realize new streams of revenue for their own business around cloud technologies, as well as new cybersecurity services to protect, manage and monitor those systems.
The first step to realizing the opportunity of the cloud, in addition to limiting the associated risks, is understanding the factors at play that may impact customer organizations as they build out their cloud environments across different areas. Here are five security concerns that MSPs should consider and ensure that their customers are aware of in relation to the cloud, as well as technologies and services that MSPs can consider offering around each as they continue to work in the best interest of their clients:
Malware
While the cloud is a different type of environment from on-premises systems, it’s still vulnerable with regard to many of the same challenges – for one, malware. There are several types of malware that can commonly infect cloud data or systems, including DoS attacks, hyperjacking, ransomware, and other types of malware.
Further reading Types of Malware Attacks MSPs Should Protect Clients From
Unfortunately, without the right protections, malware can spread quickly throughout cloud environments before it can be detected to prevent serious damage. MSPs can work with customers to counteract some of these risks by implementing a “zero trust” model, where all users and devices are assumed risky by default and least-privilege principles are used to limit risk. MSPs can also help implement network segmentation and threat detection solutions to help limit the spread of malware across cloud systems.
Misconfigured Cloud Services
One of the most common headlines we see around cloud usage is the misconfiguration of cloud services, which can lead to the exposure of sensitive data to unwanted parties. As just one example from many, security firm Check Point revealed research that cloud misconfiguration caused the leaking of sensitive user data for 2,113 mobile applications, with tens of millions of downloads. Cloud misconfiguration often happens because of simple human error, with an admin or user not setting up the security settings properly.
There are several things an MSP can do to help counteract this particular cloud security risk for clients. First, they can carefully ensure that all cloud instances are correctly configured for their customers. Second, they can deploy tools such as multi-factor authentication or a cloud-based SIEM to limit the risk of an attack and pinpoint any signs of an issue. Additionally, they should ensure that they are using remote desktop protocol (RDP) best practices, including leveraging authentication, least-privilege principles and VPN technology.
Data Sharing and Data Loss
One of the major benefits of cloud technology is that it makes it easier to share data. But this can also introduce new risks if users are able to share data with parties that they are not supposed to, or if that data is not frequently backed up appropriately or as frequently as needed. Recovering this data can be time-consuming and require a lot of resources — if it’s even possible at all. Also, certain types of security attacks, such as ransomware, take advantage of the easy flow and sharing of data to encrypt systems and demand a ransom.
MSPs can play an important role in helping their customers implement cloud-friendly backup best practices, including leveraging a cloud-backup solution. They can also help customers test their solutions on a regular basis to ensure they are working correctly, as well as monitor the networks, leveraging a tool such as a cloud-based SIEM to pinpoint potentially nefarious activity.
API Vulnerabilities
The connective tissue between many cloud applications that allows them to communicate quickly and efficiently is application programming interfaces (APIs). Just like any other piece of software or code, these APIs can also be vulnerable. However, companies rarely think of securing them properly when they are building or using them, for example, failing to include adequate authentication or accidentally including security vulnerabilities. In fact, this risk is so great that Gartner has identified APIs as one of the most targeted attack vectors for 2022. To help secure against this attack vector, MSPs can ensure that they are carefully reviewing the APIs that their customers use, as well as monitoring for signs of attack.
Appropriate Access
When it comes to limiting cyber threats and inappropriate use of data, one of the most important factors is ensuring that identity and access control are in place. This ensures that only the right people have the right access to the right data and systems at the right time. However, migration to the cloud can often cause insufficient identity and access management to be put in place if not done correctly. An MSP can help ensure that their customers are implementing identity and access management best practices during migration, as well as that these practices are maintained on an ongoing basis. Such practices can include leveraging multi-factor authentication, strong password policies, detection and response tools, and other factors. Additionally, MSPs can help with regular access audits to ensure policies are up to date.
Further reading Identity and Access Management in the Cloud
While there are potentially increased risks involved with the use of cloud services, the good news is that there are many things an MSP can do to help their clients mitigate these risks. By ensuring that they have a good understanding of the cloud-specific risks that may face their clients, as well as the mitigation steps that they can help implement, an MSP can play an important role in helping their clients not only limit the risk of the cloud but also realize its full opportunity potential.
Simple. Reliable.
About the author
Kurt Abrahams is the Vice President of Marketing at MSP360 with expertise in technology marketing, cybersecurity and AI based technology.