Failing on Cloud Security

[AppDefects]

The tipping point for cloud security has arrived and very few organizations are ready reports Symantec. 

Key takeaways from the report include:

• 83% claimed they don’t have the right processes in place to effectively manage security incidents
• 93% said they are having trouble keeping track of workloads
• 73% said they’ve experienced an incident because their cloud security isn’t mature enough
• 65% of organizations failed to implement MFA in IaaS environments
• 80% don’t use encryption

I really wonder whether the CSP shared responsibility model is the problem? Certainly, its not the solution since the survey says security professionals are not architecting security into their cloud deployments.

[JaimeBurgos]

So what do you think could be the solution. The one problem that I can highlight is that low quality cloud architect and not enough resources to manage iaas cloud infrastructure. Management of cloud securirty could be a very tricky task and to counter it you need a dedicated team for cloud architects which could cost you a lot. So, most organization don't pay much attention in this department and thus faces the consequences.

[Wayne_Evans]

I think the model is fine currently, my thoughts are a lot of this comes down directly to training or lack of sufficient or appropriate training for all people/stakeholders: Cloud Architects, Application Developers and the management of IT teams. If managers had appropriate awareness and training, they could adopt and implement appropriate processes to handle cloud.

I also see Shadow IT is the biggest cause of the above issues. in such a fast, agile cloud-native, SaaS world, managers and departments are frequently bypassing the safeguards and slow and monolithic change controls of IT. Which again comes to due to lack of appropriate processes and control. 

As it drilled into us, Security is driven from the top down.

[rslade]

Please.

Remember: "cloud" is not new. "Cloud" is not magic. "Cloud" isn't really even a thing. It just means "somebody else's computer." You need to know how much (and what type) of protection they do, what protection you need, and how to patch any gaps.

[CraginS]

---

@rslade wrote:

Please.

Remember: "cloud" is not new. "Cloud" is not magic. "Cloud" isn't really even a thing. It just means "somebody else's computer." You need to know how much (and what type) of protection they do, what protection you need, and how to patch any gaps.

---

Essentially, CLOUD is simply "off-premises, and usually someone else's, computer." 

Not really much different from the old IBM 360 Time Sharing days.