Top 8 Security Risks for Cloud Applications

How much money have you spent on cloud application security?  Zero? Almost zero? Everything is moving to the cloud.  Can companies continue to ignore the fact that when your applications move to the cloud, your data moves to the cloud too? Your data is more exposed than ever. Easier to access and harder to control.

Remember the shared responsibility model used in public clouds? You are responsible for your own data. Cloud application providers can offer you their apps-as-a-service, but don’t know how you are going to use it, if it is a corporate approved app, or what kind of controls you need. They offer it up and protect their environment as best they can.

Let’s separate public/private cloud data centers from cloud-based SaaS applications. See this recent article on the risks and solutions related to public/private cloud data center infrastructures.

“Cloud application growth has been enormous … silently creating a new growing threat.”

The Top 8 Cloud Application Security Risks

1. Lack of visibility as to what applications your employees are using

1. 1. 1. Do you even know what applications are in use?
      2. Are they using authorized applications?
      3. Do you have app usage visibility when users are inside and outside your network?
      4. Do you know how the applications are being used with your data?

2. Unauthorized access to your application and data

1. 1. 1. Can you control user access in an easy to administer way?

3. Lack of control of which applications your employees are using

1. 1. 1. Are the “currently in use” applications classified as sanctioned or non-sanctioned?
      2. Can you control which applications can be used?

4. Can you control application & data usage when users are on-premises and off-premises?

1. 1. 1. Control regardless of where the user is onsite or in the field

5. Lack of control of how your corporate data is being used

1. 1. 1. Does it need to be read only?
      2. Can it be removed and shared?
      3. Are users allowed to modify the data?
      4. Can you define who needs what level of access to each application?

6. Hard time proving compliance when you don’t control the application or data?

1. 1. 1. Can you prove compliance?
      2. Do you have any controls in place?

7. Can you provide data loss protection for your important data in cloud applications?

1. 1. 1. Is the data encrypted when not in use?
      2. Can you prevent key data (SS#, CCDs etc) from being exported?

8. Can you guaranty that your data is backed up and available?

What to Do about Cloud Application Security Threats?

Once you have recognized that the migration of applications to the cloud presents a new serious threat. There is also a realization that you need cloud application security as much as anti-malware, access control or gateway security.

The solution is a multi-step process.

Step 1: Assess the level of application sprawl and the associated risk.

Step 2: Define a Cloud Application Security Broker (CASB) solution that matches your organizations needs

Step 3: Implement, monitor and adjust to comply with your company’s policies

A Cloud Application Security Broker (CASB) provides multiple layers of security providing everything in the above list of needs except backup of your data.

Why not be as serious about cloud application security as you are about gateway or endpoint security and look into a CASB solution today!

We can help!

Contact us – Let us help you with your security planning and budget.

We can also discuss how we can help you with your information security management process including risk assessments, planning, security products and projects.