Is Your Company Secure On The Cloud? 5 Must-Knows To Manage Risks.

February 24th, 2021 Tim Mercer Leave a comment

Cybersecurity breaches have become all too common, putting public health, individuals’ private information, and companies in jeopardy.

With cloud computing prevalent in business as a way to store and share data, workloads and software, a greater amount of sensitive material is potentially at risk. Therefore, company leaders need to prioritize cloud security and know how to manage the risks, says Tim Mercer (www.timtmercer.com), ForbesBooks author of Bootstrapped Millionaire: Defying the Odds of Business.

“Cloud adoption is a business model that provides convenience, cost savings, and near-permanent uptimes compared to on-premises infrastructure,” Mercer says. “But cyberattacks continue to plague organizations of every size, and moving your IT infrastructure and services to cloud environments requires a different approach to traditional deployments.

“A private cloud keeps all infrastructure and systems under the company’s control, while a public cloud hands over the responsibility to a third-party company. In hybrid deployments, which most organizations adopt, some services are in the public cloud infrastructure while others remain in the company’s data center. Regardless of which cloud deployment you choose, you should know the cloud security basics or consult with cybersecurity experts before migrating to the new environment.”

Mercer offers five points company leaders need to know about cloud security to help manage their risks:

Shared resources for multi-tenancy cloud customers. “Multi-tenancy refers to the shared resources your cloud service provider will allocate to your information,” Mercer says. “The way the cloud and virtualization works is, instead of physical infrastructure dedicated to a single organization or application, virtual servers sit on the same box and share resources between containers.” A container is a standard unit of software that packages code and helps the application run reliably from one computing environment to another. “You should ensure that your cloud service provider secures your containers and prevents other entities from accessing your information,” Mercer says.

Data encryption during transmission and at rest. Accessing data from a remote location requires that a company’s service provider encrypt all the business’ information – whether at rest in the virtual environment or when being transmitted via the internet. “Even when the service provider’s applications access your information,” Mercer says, “it should not be readable by anyone else except your company’s resources. To protect your information, ask your service provider about what encryption they use to secure your data.”

Centralized visibility of your cloud infrastructure. Mercer says it’s not enough to trust service providers; you’ll also want to verify that your data remains secure in their host environments. “Cloud workload protection tools provide centralized visibility of all your information so you can get adequate oversight of the environment,” Mercer says. “Ask your cloud company if they can provide you with security tools such as network traffic analysis and inspection of cloud environments for malicious content.”

An integrated and secure access control model. Access control models remain a major risk in cloud environments. “Your provider should have cloud-based security that includes a management solution to control user roles and maintain access privileges,” Mercer says.

Vendor sprawl management with threat intelligence. “In complex cloud deployments,” Mercer says, “you may end up using different vendors, each with its own cybersecurity framework. Threat intelligence solutions can provide you with clear insight into all your vendors and the latest global threats that could put your business systems at risk. A threat intelligence tool will gather and curate information from a variety of cybersecurity research firms and alert you to any vulnerabilities in your vendor’s system.”

“For any organization that’s considering a complete cloud migration, understanding the entire threat landscape is essential,” Mercer says. “A team of cybersecurity experts can assist with the planning and oversight of your cloud migration to mitigate risks and establish the necessary controls.”

______________________________________________________________

Tim Mercer (www.timtmercer.com) is the founder of IBOXG, a company that provides technology services and solutions to government agencies and Fortune 500 corporations. He also is the ForbesBooks author of Bootstrapped Millionaire: Defying the Odds of Business. Mercer was inspired to pursue a career in IT as a consultant after he became a telecom operator while in the U.S. Army. After growing up in difficult economic circumstances in the rural South, Mercer achieved success as an entrepreneur, then recovered from the financial crisis of 2007-2008 after starting IBOXG. The company has accrued over $60 million in revenues since its inception in 2008.

Archives, Global Trade Daily, Software, Special Reports

How Can Organizations Ensure Data Security

September 16th, 2020 Dea Muriç Leave a comment

The cyber-security scene is advancing at a fast-paced rate and concurrently, advances in technologies are progressively becoming better at aiding cyber-criminals and hackers to take advantage of data security loopholes. The continuously growing scale of breaches and cyber-security attacks should be a major concern for all organizations. An example of such attacks is the WannaCry, a massive malware attack that affected over 150 countries, including the UK, Germany, India, and Japan. Considering all the sensitive data that organizations store online, including financial documents and customers’ private details, it’s evident that one breach could have a huge negative impact on their businesses. Here are a few measures organizations can take to ensure data security.

1. Protect the IT Infrastructure

Organizations need a secure and established IT framework to build a solid foundation for a healthy data security plan. As such, they should keep an eye on every component, including devices and systems. They should ensure all the computers and smart devices are adequately protected against advanced cyber-attacks and malicious hacks.

The IT team must ensure all systems are updated with the most recent operating systems and reliable anti-virus solutions. They must also put a configured firewall in place to ward off external attacks and unauthorized access on the network. NordVPN can be a great data protection tool, especially when browsing the Internet. By encrypting data, this VPN establishes an additional layer of security that keeps your browsing activity, financial information, and emails invisible to hackers.

2. Perform Comprehensive and Regular Audits

Data security measures can never be complete without thorough and regular audits. A regular audit is a practical approach that enables businesses to identify vulnerabilities in the existing security plan. Auditing data collected in the post-attack offers an organization a perfect understanding of the blunders that can result in similar breaches in the future.

This information can be instrumental in the creation of a more powerful data security strategy coupled with more reliable data security policies. So, businesses must perform comprehensive and regular audits to enhance compliance and get rid of potential risks.

3. Limit Data Access

Most companies give a few employees privileged access to their most valuable data. Consider who in the company has access to important customer information. Do you know everyone’s access rights? Knowing the details of every staff that has privilege access to data and reasons for accessing it can help you prevent data hacking, theft, and loss.

Organizations must limit data access. They should determine the kind of data that a staff member needs to access to carry out their work obligations effectively and make sure they have access to just what they require. In addition to safeguarding sensitive information from theft or loss, limiting access could ensure more efficient data management.

4. Remove Stale Information and Put Secure Backups in Place

Many companies in the healthcare, education, and finance sector handle sensitive data as an important part of their businesses. Having the right data disposal strategies in place can prevent redundant data from being stashed away and lifted at a later date.

Regular data backup is a fundamental part of a complete IT security strategy. Organizations should have robust backups in place to ensure they still have access to their sensitive information even after accidental file removal or a full ransomware lockdown. They should store their backup data in a safe, remote location far from their main places of business.

5. Change Your Mindset

Many organizations don’t give data security the seriousness it deserves. They have poor passwords, unencrypted sensitive files, and misconfigured AWS servers. Due to this sloppy attitude, it’s estimated that more than 4 billion data records with valuable information were breached within the first six months of last year.

Companies must change their attitude. They must view data security as their top priority. Everyone in the company must understand the value of data security, not just the top executives. They should embrace security best practices such as authenticating digital identities of all employees and customers as well as using up to date VPNs like the NordVPN.

The Parting Note

With cyber-security threats increasing rapidly in today’s world, it has become important to be armed with the right security tools and privacy improvements that are required to protect the organization’s most valuable asset, that is, the data. Data security should be given utmost priority and all staff members trained accordingly.

Archives, Commentary, Global Trade Daily

Why the Keys to Maintaining Data Security in a Remote Environment are Control and Visibility

May 14th, 2020 Piyush Pandey, CEO at Appsian Leave a comment

Remote workforces are nothing new to most organizations. According to Buffer’s 2019 State of Remote Work report, 44% of respondents noted that at least part of their team was “full-time remote,” and 31% said that everyone on the team works remotely. Further, at the time of the report, 30% of respondents said that their entire company worked remotely. However, the COVID-19 pandemic accelerated the work-from-home model. By March 31, 2020, the percent of users working remotely had increased 15 percentage points since the start of the COVID-19 outbreak. With that in mind, organizations are assessing how they can maintain granular levels of control and visibility when business data is being accessed remotely.

Adopting Contextual Controls to Protect Data

Most organizations already leverage role-based access controls. These controls, which align data access privileges and job function resources, provide a baseline for data governance. However, they often lead to excessive levels of data access and, in turn, produce additional risks. Contextual controls enable an organization to dynamically control access to data during varying contexts of access, often aligning to least privilege best practices. Migrations to cloud applications are largely due to contextual controls being a business requirement, simply because the interconnected applications required a more dynamic approach.

With the move to a remote workforce, organizations need to create more detailed and more dynamic access controls. With attribute-based access controls (ABAC), a company can incorporate additional context such as geolocation, time of day, and IP address to both ensure the appropriate user is accessing the resources and prevent users from having more access than they need. For example, if the organization knows that an employee should be working from Connecticut, ABAC can prevent access to resources if the user’s location is suddenly California – or a foreign country.

Contextual controls provide both the prevention of access policy violations, along with alignment between business requirements and security protocols. Because the organization can limit access according to the principle of least privilege, it reduces the risk of data leakage and financial fraud. Meanwhile, by creating more granular, data-centric access privileges, an organization can ensure that users do not get too much or not enough access – limiting the potential negative effects of restricting access excessively.

User Activity Monitoring for Security and Managing Productivity

Monitoring user access to resources and tracking how users interact with data provides an additional benefit for many organizations as their workforces move towards a remote model. Most organizations recognize the benefit of monitoring user access – but not just instances of logging in and logging out of applications. Understanding data access and usage is now a key requirement when maintaining visibility over business data. Organizations are turning to analytics platforms that both include granular access details, along with a visualization element (for example, SIEM). Data is only as useful as the insights it provides, and rapid aggregation and visualization of user access data is a crucial requirement for data security.

Using “Virtual” Work Hours

Looking at a common security use case, many organizations leverage “virtual” work hours to detect anomalies. For example, an employee usually works between the hours of 8 AM and 6 PM but monitoring and alerting to activity around sensitive data at 3 AM, for instance, can be indicative of unauthorized behavior. This uncharacteristic behavior may be an anomaly, but the organization needs to monitor the user activity more closely. If the user denies accessing the information at 3 AM, then the organization needs to focus its monitoring and have the employee change their password. If the organization detects additional unusual activity, then it may need to review the employee’s activities or investigate a potential data breach.

Monitoring User Productivity

From a workforce management perspective, organizations can leverage these insights to review employee productivity. Two use cases present themselves. First, many organizations have contracts that stipulate late payments incur a late fee. If the organization knows that employees should be processing payments ten days prior to the payment date, then they can leverage these reports to ensure that employees meet their timelines, even from a remote location. Additionally, by tracking resource usage data, organizations can monitor whether workforce members are appropriately prioritizing their workdays. If the employees are only accessing a business application at the end of the month, then they are likely waiting until the last minute to input payment information. Preventing these potential revenue losses or rush projects in other areas by speaking with the employee enables the organization to stay on top of its financials.

Enabling Visibility for Business Applications Has Never Been More Critical

Creating trust within and across distributed workforces ensures productivity. However, continued status update meetings across multiple time zones decrease workforce member efficiency. Organizations already monitor user access to their systems, networks, and applications. As part of a robust security posture, organizations should apply protections at the new perimeter – user identity. Rather than micromanaging employees via emails or chats, managers can gain valuable insight into how users are accessing resources and prioritizing work schedules by reviewing data and resource usage.

In an unprecedented time, companies need to find ways to enable their levels of control and visibility over business data. Whether a business application is on-premise or in the cloud, enhancing these solutions should be a mission-critical objective.

Risks against an organization are prevalent in a remote environment, whether those risks are security-related or employee-related by fraud, theft, and error. The keys to maintaining data security ultimately lie in your ability to provide oversight for your data, and the time to act is now.

_______________________________________________________________

Piyush Pandey, CEO at Appsian (www.appsian.com ) is a technology executive with 18 years of global experience in strategy, sales, mergers & acquisitions, and operations within software companies. Over the last 10 years, he has worked with enterprise software companies including Oracle, Epicor, Concur, Citrix and Microsoft on various transactions. He has held various leadership positions at Procera, Deutsche Bank, Stifel, Wipro Technologies and a wireless startup.