Introduction

Cloud computing is steadily being adopted by more and more companies, but the tradeoff that comes with the adoption of cloud computing services is the requirement for high levels of cloud security. Despite rapid levels of cloud adoption and consequent cloud security improvement, the state of cloud security may not have necessarily improved. According to a 2019 survey by SANS, “unauthorized access of cloud environments or assets by attackers has significantly increased.” This survey found that reported incidents increased to 31% vs 19% in 2017.

What exactly is the state of cloud security and its future? To determine that, areas undergoing improvement and areas of concern need to be analyzed in how they need to be addressed, and overall trends that outline the current trajectory for cloud security must be evaluated.

Areas actively seeing improvement

Cloud security has grown immensely within organizations following the growth of the cloud computing services industry. Cloud service providers have ensured that security tools will act as cybersecurity for business processes, allowing for significant growth in the cloud environment.

Growth of Cloud Security

Security groups are gaining better experience on how to protect cloud environments from cyberattacks as businesses shift from on-premises technology to future technologies like cloud computing.

Over the past few years, the previous lack of cloud security sophistication is being corrected with on-the-job experience from security incidents and the widespread availability of certifications and training for cloud users and cloud providers. As security teams become better acquainted with cloud services from the growth of cloud computing, they can apply different tools and configurations with more ease and finesse.

There has also been a growth in organizations focused on the security oversight of cloud technologies in a bid to ensure confidential computing. Some examples of such groups include the Cloud Security Alliance (CSA) and the OWASP Cloud Security Project. These groups aim to provide best practices for securing cloud computing technologies and help identify areas of growth.

Adoption of DevSecOps

Many companies in the technology industry are adopting DevOps and DevSecOps practices in their attempts at digital transformation.

These practices shift security to the beginning of developmental processes rather than trying to fix everything at the end. By focusing on security earlier in projects, firms can reduce vulnerabilities during software development and deployments and prevent the need for more human intervention in the future. This decrease increases overall security for cloud customers, especially in their network security of public cloud services.

The automation that typically arrives alongside DevOps practices has also increased security. Using automation when configuring services, users, etc., ensures companies continue to maintain consistency across systems and reduces the risk of misconfiguration.

Tooling and function improvements

The increased centralization of security data has made it easier for most businesses and their security teams to monitor incidents and respond accordingly. Solutions that provide centralization to companies are especially important in hybrid systems and expanding cloud computing deployments, one of them is SIEM – Security information and event management which helps to detect, analyze and respond to security threats before they deal harm to business.

Two particularly useful tools for companies desiring centralization and consistency in the cloud are Security Orchestration, Automation, and Response (SOAR) solutions and Cloud Access Security Brokers (CASB).

• According to KBV Research, “though SOAR technology has only been around a few years, the space is already expected to surpass $2 billion by 2025, expanding at 16% CAGR during the period.” The industry is lucrative because SOAR solutions enable teams to consistently implement security controls, policies, and responses across all systems. By introducing a measure of consistency, teams can increase security by reducing the weak links present within their systems. SOAR solutions also limit the vulnerabilities that can be brought about by poor monitoring or insufficient response.
  
  
• CASB are tools or services that interface on-premise and cloud infrastructure. These tools enable the extension of on-premise security tools and policies to necessary cloud technologies, making it easier to secure and monitor traffic in the public cloud environment between on-premise devices and cloud services.

Areas for concern

While there are numerous improvements being made to cloud security, there are still ongoing concerns regarding cloud migration, data privacy and regulatory compliance, and cloud system complexity.

In the technology world, data privacy is one of the largest concerns to organizations, regulatory agencies, and, most importantly, consumers. As seen in the chart below, 66% of consumers in the United States would like to see more laws like the General Data Protection Regulation (GDPR), which is enforced within the European Union, come into effect. Therefore, the number and specifications of compliance regulations are constantly expanding with in-depth requirements and oftentimes harsh consequences.

Issues related to migration

A major issue that organizations face is the lack of an effective cloud migration strategy. Therefore, their data is subject to the careless transfer of data, a misunderstanding of shared security responsibilities, and misconfiguration.

1. Careless transfer of data

On public clouds and during cloud migration, data that is unprotected and unencrypted can be stolen in transit or even corrupted during transfer. As cloud infrastructures grow and become more complex, the potential for security breaches expands. Therefore, organizations must take the proper steps to ensure that their data is protected while stored in the cloud and during cloud migration. These steps include encrypting data at rest and in transit, implementing strong and effective authentication measures, and applying comprehensive access control measures.

2. Misunderstanding of shared security responsibilities

A benefit of the public cloud is that it allows for collaboration among entities. With the increase in remote work throughout the business world, shared resources have become a commodity for many companies.

While the collaborative ability of the cloud is useful, it can also prove harmful to a business. Users misunderstand their responsibilities when it comes to what aspects of shared security are theirs. Therefore, it is vital to understand the cloud security provider that an organization chooses to use.

On this point, it is worth mentioning about additional need of backup. Some users treat cloud as a perfect solution, forgetting about backups. Of course, well-designed cloud should be able to back up data stored on it, but a few of the incidents from past prove, that customers should think about doing the backup of data stored on cloud. Of course, we can do it on premise or on cloud (keeping in mind rules of well maintained backup – different localization, security in-transit and frequency).

3. Misconfiguration

It is imperative to establish comprehensive access control measures when migrating resources to the cloud. Otherwise, storage services can be left unknowingly open to the public, or users can be provided with more permissions than needed. Hence, the misconfiguration of permissions and access controls is a problem that should be mitigated early on in the cloud migration process.

4. Lack of governance

Freedom of cloud creates a lot of hidden dangers like shadow IT, lax security approach, lack of access control. To address those example issues, there is an increased need for a set of rules, specific policies and/or principles for cloud computing services. The aim is to deliver operation efficiently, provide it securely and also to improve financial aspect of Cloud Environments.

Data Privacy and Regulatory Compliance

As seen in the graph below, data security and regulations are among the most prominent challenges with the cloud and cloud security.

Currently, cloud providers meet most regulations. However, there is a gap that leaves organizations responsible for filling by making sure all regulations are followed. Therefore, companies need to integrate policies and utilize effective tools to fill this need. One problem is that complying with various regulations can be costly and even require custom configuration.

An alternative to complying with every single regulation is using a hybrid environment to retain regulated on-premise data. Therefore, a business can have full control over regulated data while still benefiting from cloud services for lower-priority workloads.

System Complexity

Another problem with cloud security is that cloud systems can be particularly complex to secure. While hybrid systems can be used as an effective way to maintain security, the hybrid cloud is the most complex.

1. Insecure APIs or Interfaces

Insecure APIs or interfaces allow hackers to use external applications and services to access data. Furthermore, malfeasants can learn about system architecture and settings from these weaknesses.

2. Limited Visibility

In large organizations, there is often a lack of communication between the IT department and employees. Poor communication is a problem when cloud services are used without permission or users abuse their access. Additionally, companies should keep cloud system access away from third-parties.

3. Skill gap

As cloud technology constantly change, there is a problem with skilled engineers, that could operate with cloud operation. There is a well-known problem in IT world, related to talent acquisition and retention – cloud deployments and its security is no exception.

4. Cost of experienced employees

Even if organization find perfect employee for cloud-related task, cost of employment can be very high, due to the need of employee to be on expert level with cloud technology and security.

Data loss/leakage

Similar to the careless transfer of data, the collaborative power of the cloud paves way for data loss and leakage. According to Check Point, a cloud services company, 69% of organizations view data loss and leakage as their greatest cloud security concern.

In order to ensure no data is lost or leaked, businesses should be cautious when sharing public links or setting up a cloud-based repository to public. Furthermore, there are tools that can specifically search the internet for unsecured cloud deployments that cause a majority of data losses and leakages across organizations.

Accidental exposure of private documents and credentials

With the growth of cloud-based email and document-sharing services, employees have become accustomed to clicking on links in their emails. However, this occurrence has paved the way for countless phishing attacks. With a successful phishing attack, a hacker could gain access to an employee’s credentials for cloud services.

According to Check Point, 44% of organizations view accidental exposure of cloud credentials as a major concern. After all, malfeasants can compromise the security of cloud-based data and the other resources the organization has.

It is also crucial to verify confidential vs shared data settings on cloud. Simple misconfiguration of visibility can expose private data to the Internet.

Incident response

Even though many businesses have methods in place for responding to cybersecurity incidents, there is a concern that cloud infrastructure brings to incident response. A company has limited visibility and ownership of its infrastructure in a cloud-based environment. Therefore, traditional incident response methods are ineffective. Overall, incident response in the cloud is tough and should be considered before migrating a company’s resources to the cloud.

With connection to centralization of data it also increases the chances for security related incidents which is why the Security Operations Center (SOC) came to be – to include people, processes and technologies responsible for organization’s information security. This function, due to required skill set and tooling comes with hefty price, in many cases it’s more efficient to look for a service provider instead omitting it at all.

General trends in Cloud Security

Various general trends surrounding cloud security define the industry and are critical to understanding the protection of sensitive data. Being aware of these cloud computing trends can help businesses decide where to best allocate their cloud resources and what new security tools are available, among many other benefits.

Cybersecurity mesh

Cybersecurity mesh refers to a network of interconnected systems that work together to protect data and infrastructure from cyber threats. Unlike more traditional approaches to cybersecurity, mesh networks take a distributed approach. This means that rather than trying to protect network infrastructure from a single point of entry, mesh networks distribute the responsibility for securing information across multiple nodes.

By using mesh networking principles, organizations can ensure that no single point of failure can compromise their entire system, decreasing the risk of security breaches considerably. Additionally, mesh network topologies allow for robust encryption schemes and decentralized monitoring and analysis capabilities, further increasing the overall resilience of this cloud technology.

Penetration Testing as a Service

Penetration testing solutions is a well-known product. However, utilization of penetration testers as a service is a hyping technology in recent years. Utilization of SaaS platforms with combination of DevOps techniques, real pentesters, automation and integration with API provide real-time platform for scheduling, execution and visibility of security tests.

Exposure management

Using scanning, controls and organization risk for identification of exposure companies have is not enough. The amount of data started to create prioritization problems – what to focus on in the first place. Exposure Management is a process allowing companies to evaluate its internal and external risk and with help of automation, data management and AI focus on the biggest threat (one with the highest attack surface/likelihood of exploitation/biggest risk).

SASE Framework

The Secure Access Service Edge (SASE) framework combines a wide range of security measures and technologies, including anti-malware detection and deployment, network segmentation and isolation, multi-vector authentication, certificate-based encryption key management systems, and much more. Thanks to its extensive suite of features and capabilities, the SASE framework is able to provide strong protections in the most challenging cyber environments. And as more businesses turn to cloud solutions to power their operations in an era based around digital transformation, this framework will become increasingly vital for keeping sensitive data secure from threat actors.

The incorporation of software as a service, artificial intelligence/machine learning, and other cloud-native capabilities into cloud security through SASE has left a major impact on cloud computing trends. In fact, one of the core capabilities of SASE, zero trust, is becoming an essential security trend in and of itself for businesses conducting cloud adoption.

Zero Trust Network Access

A zero trust network model is a modern approach to data protection that focuses on preventing unauthorized access to sensitive information. This method of network security proactively identifies and manages security risks and threats, drawing on advanced analytics and cloud architecture to create a more secure environment. Furthermore, it has become an integral part of the future of cloud security.

By dynamically regulating trust levels in real-time, zero trust helps to ensure that only authorized users can gain access to sensitive data. With this added layer of security, organizations can better protect their critical data from cyber threats and prevent costly breaches. Whether businesses are implementing this model for the first time or seeking to enhance their existing strategy further, zero trust is an important tool for protecting your organization against malicious threats.

As cloud computing continues to develop, future trends will become more and more significant and important for businesses undertaking the cloud adoption process to be educated on. Every day, more future trends like quantum computing, multi-cloud approach, and various advanced SaaS solutions are already becoming a reality. To stay on the cutting edge of cloud computing development, firms must remain aware of the state of the industry and have the ability to learn and grow based on where the future of cloud is heading.

Conclusion

Cloud security has risen in importance to business operations over the last half-decade, but true faith in its ability to protect foreign access to the cloud environments of organizations will only come when cloud security providers address the areas of concern and continue in areas of improvement.

However, the top cloud security trends seem to demonstrate a growing level of competence distributed throughout the industry, which will only lead to an increase in the adoption of cloud computing services by organizations, allowing for large improvements in company budgeting, security, and profit.