Mapping the Cloud Security Landscape: A Smooth Path or Full of Hurdles?

Terms of use

Terms of Use

The use of this site and the content contained therein is governed by the Terms of Use. When you use this site you acknowledge that you have read the Terms of Use and that you accept and will be bound by the terms hereof and such terms as may be modified from time to time.

All text, graphics, audio, design and other works on the site are the copyrighted works of nasscom unless otherwise indicated. All rights reserved.
Content on the site is for personal use only and may be downloaded provided the material is kept intact and there is no violation of the copyrights, trademarks, and other proprietary rights. Any alteration of the material or use of the material contained in the site for any other purpose is a violation of the copyright of nasscom and / or its affiliates or associates or of its third-party information providers. This material cannot be copied, reproduced, republished, uploaded, posted, transmitted or distributed in any way for non-personal use without obtaining the prior permission from nasscom.
The nasscom Members login is for the reference of only registered nasscom Member Companies.
nasscom reserves the right to modify the terms of use of any service without any liability. nasscom reserves the right to take all measures necessary to prevent access to any service or termination of service if the terms of use are not complied with or are contravened or there is any violation of copyright, trademark or other proprietary right.
From time to time nasscom may supplement these terms of use with additional terms pertaining to specific content (additional terms). Such additional terms are hereby incorporated by reference into these Terms of Use.

Disclaimer

The Company information provided on the nasscom web site is as per data collected by companies. nasscom is not liable on the authenticity of such data.
nasscom has exercised due diligence in checking the correctness and authenticity of the information contained in the site, but nasscom or any of its affiliates or associates or employees shall not be in any way responsible for any loss or damage that may arise to any person from any inadvertent error in the information contained in this site. The information from or through this site is provided "as is" and all warranties express or implied of any kind, regarding any matter pertaining to any service or channel, including without limitation the implied warranties of merchantability, fitness for a particular purpose, and non-infringement are disclaimed. nasscom and its affiliates and associates shall not be liable, at any time, for any failure of performance, error, omission, interruption, deletion, defect, delay in operation or transmission, computer virus, communications line failure, theft or destruction or unauthorised access to, alteration of, or use of information contained on the site. No representations, warranties or guarantees whatsoever are made as to the accuracy, adequacy, reliability, completeness, suitability or applicability of the information to a particular situation.
nasscom or its affiliates or associates or its employees do not provide any judgments or warranty in respect of the authenticity or correctness of the content of other services or sites to which links are provided. A link to another service or site is not an endorsement of any products or services on such site or the site.
The content provided is for information purposes alone and does not substitute for specific advice whether investment, legal, taxation or otherwise. nasscom disclaims all liability for damages caused by use of content on the site.
All responsibility and liability for any damages caused by downloading of any data is disclaimed.
nasscom reserves the right to modify, suspend / cancel, or discontinue any or all sections, or service at any time without notice.

For any grievances under the Information Technology Act 2000, please get in touch with Grievance Officer, Mr. Anirban Mandal at data-query@nasscom.in.

New

See all

No notification found.

Mapping the Cloud Security Landscape: A Smooth Path or Full of Hurdles?

Xoriant

@xoriant

June 7, 2023

Cloud Computing

357

According to Gartner, by 2025, approximately 95% of new digital workloads are projected to be implemented on the cloud. However, this doesn't mean that businesses are confident about transitioning their vital infrastructure to cloud computing.

Even in the present day, security setbacks related to cloud services continue to make headlines. Prominent cybersecurity breaches, such as the misuse of Microsoft's Azure DevOps server credentials or the misconfiguration of Pegasus Airline's AWS S3 bucket, are consistently exposed, highlighting the risks involved in 100% cloud adoption.

Determining whether the adoption of cloud infrastructure in enterprises will be a smooth path or full of hurdles largely hinges on how clear an organization is about considering certain factors while deploying cloud resources for their operations.

In this blog post, we will explore several crucial aspects that facilitate the seamless execution of digital operations using cloud infrastructure services.

Six Critical Factors Enabling Digital Operations with the Cloud: Xoriant's Insights

Expanding Remote Network Access

It is highly unlikely that all organizations will fully revert to a 100% in-office work environment. Consequently, facilitating the adoption of digital infrastructure for flexibility and accessibility is crucial.

Enterprises must ensure business application security for seamless operations. When deployed in a cloud environment, this entails focusing on eliminating any vulnerabilities in the cloud that could create unauthorized access points to the enterprise network. This has prompted many organizations to employ an enterprise digital asset management (DAM system) to streamline their data access, which is a third-party service SaaS (software as a service).

This once again underscores the importance of ensuring that vendors have robust security frameworks in place that align with the overall enterprise security policies. Clearly defined service level agreements (SLAs) must outline the responsibilities for protecting various components, fostering long-term partnerships based on accountability.

Putting Asset Security on Top

With the embrace of remote work flexibility in the corporate world, the Bring Your Own Device (BYOD) trend is gaining momentum. Studies reveal that over 67% of employees utilize their personal devices for work-related tasks, highlighting the need for an enhanced security posture for enterprise digital assets.

From a cloud infrastructure perspective, enterprises must proactively monitor all entry points in the cloud, allowing access control to only authorized devices with a zero-trust security approach, regardless of the team using them.

In addition to proactive monitoring, organizations may need to evaluate existing data policies and governance models and their usage of digital asset management software (DAM) for load balancing. This ensures proper control over the flow of information from various business systems managed in the cloud and accessed by employee devices worldwide. It is crucial for organizations to manage endpoints (owned or BYOD) according to their security standards and best practices.

Defining Cloud Responsibilities

In addition to these considerations, organizations must possess a clear and transparent understanding of the cloud security assurances provided by their vendors. Many enterprises mistakenly assume that their vendors will handle all aspects of cloud infrastructure security required for the successful operation of their applications.

There should be a well-defined boundary that distinguishes where the provider's security controls and responsibilities end and where the organization's own security measures must be implemented. In areas where shared responsibility exists, it is essential to establish a clear understanding of each party's responsibilities and how they can seamlessly integrate individual security measures with vendor offerings. Ultimately, the goal is to ensure a secure experience for end users.

Enforcing Legal and Regulatory Compliance

In recent years, the increasing prevalence of digital channels has prompted regulatory bodies to tighten their oversight on protecting data from misuse. Privacy frameworks, like GDPR, are being implemented by more countries to govern the usage of citizens' data in digital channels. Organizations are also seeking control over the geographical location of their data stored and processed in the cloud, aiming for defined and agreed-upon boundaries. Compliance with these regulations becomes a critical consideration for businesses embracing cloud transformations. Data protection measures must cover not only data at rest but also data in transit within the same cloud environment or across multi-cloud environments.

Addressing Cloud Misconfigurations

Misconfigurations of enterprise digital assets in the cloud can have severe consequences. The Estee Lauder data leak in 2020 serves as a notable example, where over 440 million customer records were exposed due to an unprotected database. With tightening privacy laws and regulations, organizations cannot afford vulnerable configurations in their cloud systems. Such misconfigurations pose a significant threat to cloud infrastructure security and should be a major concern for leaders.

Establishing a Robust Cloud Security Strategy

As businesses expand, they add more cloud infrastructure systems, which increases the number of potential attack points and vulnerabilities to monitor and protect. A well-defined cloud security strategy is essential to effectively address vulnerabilities and implement proper governance and risk management practices. In the short term, the strategy should focus on creating a framework that considers cloud securing a critical pillar, adopting a zero-trust approach to data management and digital applications. This approach entails caution and best practices within the organization, avoiding reliance on external entities for security credentials. Regular training, cybersecurity awareness sessions, and programs to promote the secure operation of digital systems by all team members are necessary. Over time, this strategy will lead to a mature and secure digital infrastructure for the organization.

Wrapping It Up: Embracing the Enterprise Cloud Journey Challenge

Overall, moving or maintaining enterprise workloads in the cloud is an imperative that businesses cannot ignore. Cloud adoption enables flexibility, innovation, and the ability to cater to digitally savvy consumers, leading to market dominance. Considerations play a vital role in determining the ease or difficulty of securely achieving success in the cloud journey. Leveraging the expertise of a knowledgeable partner, such as Xoriant, can significantly enhance the chances of success.

#cloud #cloudcomputing #SaaS #Securityframework

Disclaimer

That the contents of third-party articles/blogs published here on the website, and the interpretation of all information in the article/blogs such as data, maps, numbers, opinions etc. displayed in the article/blogs and views or the opinions expressed within the content are solely of the author's; and do not reflect the opinions and beliefs of NASSCOM or its affiliates in any manner. NASSCOM does not take any liability w.r.t. content in any manner and will not be liable in any manner whatsoever for any kind of liability arising out of any act, error or omission. The contents of third-party article/blogs published, are provided solely as convenience; and the presence of these articles/blogs should not, under any circumstances, be considered as an endorsement of the contents by NASSCOM in any manner; and if you chose to access these articles/blogs , you do so at your own risk.

Xoriant

Xoriant is a Silicon Valley-headquartered digital product engineering, software development, and technology services firm with offices in the USA,UK, Ireland, Mexico, Canada and Asia. From startups to the Fortune 100, we deliver innovative solutions, accelerating time to market and ensuring our clients' competitiveness in industries like BFSI, High Tech, Healthcare, Manufacturing and Retail. Across all our technology focus areas-digital product engineering, DevOps, cloud, infrastructure, and security, big data and analytics, data engineering, management and governance -every solution we develop benefits from our product engineering pedigree. It also includes successful methodologies, framework components, and accelerators for rapidly solving important client challenges. For 30 years and counting, we have taken great pride in our long-lasting, deep relationships with our clients.

Cloud Collaboration: How Media Team...

dilipguddappa