Cloud security breaches appear with some consistency in the news. However,
the stories of these events are often disseminated with rather vague
explanations, based on facts such as a "misconfigured database" or
mismanagement by an unidentified "third party".
The ambiguity surrounding cloud computing can show company safety as an
overwhelming issue. This has led some CIOs to limit the organizational use of
public cloud services. However, according to Gartner, the renowned technology-leading
brand, the challenge of cloud implementation is not so much in the security of
the cloud itself, but in the policies and technologies for technology security
and control.
In almost all cases, it is the user, not the cloud provider, who does not
properly manage the controls used to protect your organization\'s data. "CIOs
need to make sure their security teams aren\'t holding back cloud initiatives
with unfounded cloud security concerns," says Jay Heiser, Gartner\'s vice
president-analyst. "Exaggerated fears can result in lost opportunities and
inappropriate expenses."
CIOs should go from asking "Is the cloud safe?" to "Are we
using the cloud safely?" Gartner then lists recommendations for developing
a successful cloud strategy, as well as predictions for the future of cloud
security to find the right answers to this question.
Consensus and a good enterprise cloud strategy
The first thing is to get the consensus of the leading team. All members
must agree that cloud usage has become indispensable and should be ruled by
planning and policies. This is the most important step in ensuring the right
levels of cloud security.
Organizations that make explicit executive decisions about their cloud
strategy provide much more business and IT guidance, and enable better
requirements analysis, more sophisticated architectural planning, and more
flexible risk acceptance processes.
Your business strategy should describe your organization\'s expectations for
the shape, importance, and control of the cloud. It should also include
guidance on what data can be placed in which cloud and under what
circumstances.
Apply risk management practices to support cloud decisions
There is no perfect security. You need to accept some risk to take
advantage of the services offered by the public cloud, but ignoring the risks
can also be dangerous. When formulating a cloud strategy, organizations must
make calculated decisions about what they will do and what they will not do to
mitigate the risks of this technology on a budget-by-budget.
On the other hand, a risk treatment model can provide a transparent view of
cloud risk levels, helping IT leaders make appropriate decisions about their
use.
Act according to cloud predictions
- According to Gartner, until 2025, 90% of organizations that do not control cloud use will share sensitive data inappropriately
Cloud strategies generally go behind the actual usage of it; this leaves most companies with huge unauthorized and even unrecognized cloud usage, resulting in unnecessary risk exposure. CIOs must develop a comprehensive business strategy before the cloud is deployed or risk the consequences of an uncontrolled cloud.
- Until 2024, most companies will continue to struggle to adequately measure cloud security risks
While companies tended to overestimate the risk of the cloud in the past, there has been a recent change: many organizations now underestimate the risks of the cloud, creating more damage than before. A well-designed risk management strategy, aligned with a global cloud strategy, can help businesses determine where cloud usage makes sense and what actions can be taken to reduce risk exposure.
- Until 2025, 99% of cloud security flaws will be by the customer
CIOs can combat this by implementing policies on
cloud ownership, accountability, and risk acceptance. They must also ensure
that they follow a lifecycle approach to cloud governance and implement
centralized management and control plans to address the inherent complexity of
using multiple clouds.
