Cloud computing has been around for two decades now, with its introduction being traced back to the creations of Amazon Web Services in 2002. Throughout those years, cloud computing has grown immensely to become an integral part of our internet infrastructure. The sheer utility of cloud computing in reducing costs, increased computing power and other endless capabilities are an indicator that the use of the cloud will continue to grow exponentially. Even Covid19 contributed to further adoption of cloud technologies because more organizations concentrated their operations on cloud systems that allowed their employees to work remotely amidst lockdowns and trade restrictions.  

However, despite cloud computing being so useful today, there are several threats to cloud data and systems that organizations need to mitigate. Cloud security needs to be an integral part of all cloud computing activities and processes. Most cloud security professionals concur that businesses can benefit from the security features built into the cloud, but they also caution against enterprises making serious mistakes that could expose sensitive data and systems. Some of the most common cloud security risks include unauthorized access through improper access controls and the misuse of employee credentials 

The CRA Business Intelligence Cloud Security Survey of September 2022 addressed the complexities of organizations of varying sizes to handle cloud security. The research was done online and across 216 security and IT leaders within the United States. Most of these respondents were top executives and administrators in large organizations spanning several industries in America. CRA Business Intelligence’s September 2022 Cloud Security Survey reveals that there is a resounding consensus among respondents that there are several risks and vulnerabilities in cloud computing. The ability to prevent, manage and mitigate these vulnerabilities has proven a difficult task for the companies these respondents represent.  

The biggest concerns on public cloud deployments highlighted in the research are misconfigurations of cloud security settings, lack of oversight, lack of visibility, and cyberattack vulnerability. Misconfiguration in cloud security settings result in data breach. This happens because several organizations have insufficient cloud security posture management strategies.  Cloud-based data and systems are not within the confines of an organization’s physical space. Therefore, this data is accessible by people or groups without authorization. The lack of visibility means that it is difficult to monitor and protect cloud-based resources, as they are not within the corporate network. Organizations also remain susceptible to cybercrime as the entire infrastructure remains accessible from the public internet. However, several other cloud security issues and threats evolve by the day and the respondents feel that they are more and more susceptible to attacks due to their reputation and high profile.  

Users of public cloud platforms have highlighted cloud misconfiguration issues in Microsoft Cloud/Azure, Amazon Web Services (AWS), and Google Cloud Services (GCS). The report also shows that the confusing nature of the Shared Responsibility Framework has brought about a lot of misunderstanding. CSPs monitor and respond to security threats connected to the cloud and cloud infrastructure, but the client is responsible for protecting data and other assets stored in the cloud. 

This paradigm can be complicated and is often misinterpreted because security ownership duties vary depending on whether the model is SaaS, PaaS, or IaaS. Some respondents disclosed that they or their IT departments did not fully comprehend how security worked in the public cloud environments of their firms and believed that they needed to better understand the security and controls to meet their needs under this model. However, most organizations are taking action towards improving cloud security. Cloud security leaders mostly consist of reputable IT firms and departments (mostly in tech), and are well known for their investment, research and innovation in cloud security strategies and several technology solutions. They often incorporate several cloud security solutions such as application programming interface (API) security, container security, static analysis, dynamic application security testing, and software composition analysis. 

Improved security and reduced operational expenses are significant factors encouraging cloud adoption. The promise of enhanced security is among the several advantages that entice enterprises to migrate to the cloud. Nearly two-thirds of survey respondents list enhanced security as one of their top priorities for existing and future cloud deployments and migrations. Compliance and lower operating expenses are two other main cloud deployment motivations.  

In explaining issues associated with cloud misconfigurations, respondents acknowledged the possibility of unintended access by an individual or group that should not have access, as well as the affiliated risk of disclosure or compromise of their organizations’ data, which in some cases included regulated data. Identity and Access Management (IAM) and privileges were viewed as areas of vulnerability that were commonly mishandled and easily ignored, with survey participants unable to determine who exactly has access to a specific resource and how this is a major problem for them. 

The capabilities for cloud security champions in their attempts to safeguard their cloud activities and processes mostly depends on the resources at their disposal. Therefore, the size of an enterprise and its corresponding IT teams are integral in determining the success of their cloud security environment. Cloud Security Champions are essentially big firms with at least 1,000 employees (82% of the research population), and at least one in three have IT teams that surpass 20 staff members. Furthermore, almost a quarter of the organizations are in tech. 

Cloud computing is growing and will continue to grow at a steady pace. Criminals and ill-motivated individuals and groups are not ignorant of this fact. In fact, these elements purposely seek to attack cloud systems with eagerness because it is there that data and systems are found. The research shows that inasmuch as these supposed security leaders appear insufficiently equipped to handle these risks and attacks, they are actively doing something about it. Several enterprises and agencies are revamping their security defenses through heavy investments. It appears that there is plenty of training and learning to occur before cloud security champions achieve effective security protocols against malicious and unintentional vulnerabilities.  

Admittedly, most organizations are ill prepared for risks to the cloud environment, and more so public cloud platforms. These organizations need to adopt reliable and secure systems and locate the talent they require to create to incorporate the appropriate procedures and technologies. The adoption of the cloud and its use requires that organizations also adopt a foolproof cloud security strategy that can prevent and protect against the constant, numerous threats.  

Let’s revolutionize cloud security together. Emgage provides premade and customizable workflows for assessments, audits, remediations, and more! If you are an MSSP and are not using Emgage yet, you are in for a treat! Check out Emgage.com or contact us here directly to start saving time and money by making your audit and remediation processes a whole lot more efficient.