Challenges of cloud adoption: Moving to the cloud does not mean all risks are eliminated

Cloud environments face security vulnerabilities on several counts, from the failure to maintain proper security hygiene to system vulnerabilities at the end-user level. (Representative image)

By Nilesh Jain

The fog has lifted to reveal photos of cities around the world with clearer skies – an unexpected silver lining in this pandemic. The next time you look skyward, may I suggest that you take a closer look at the clouds dotting the sky too? We often miss not only the beauty of the atmosphere’s omnipresent cloud but also cloud interfaces integrated all around our homes, offices and public spaces.

While the lockdown has definitely slowed down economic activity, certain kinds of businesses have experienced tremendous growth. Take Netflix, for example. Owing to social distancing and stay-at-home orders, it is but obvious that people are keeping themselves entertained through multimedia streaming apps. For the first quarter of 2020, new Netflix subscriptions reached 15.8 million surpassing the earlier prediction of 8.8 million.

This brings us to the question of how Netflix could cope with such a massive surge in usage. The answer is the public cloud. Apart from the almost instant scalability it brings, the cloud-based business model used by companies such as Netflix allows them to not just scale when required, but also handle shifts in traffic patterns—all the while remaining reliable to their customers.

It is clear that the pandemic will accelerate cloud adoption. However, moving to the cloud does not mean all risks are eliminated. Cloud environments face security vulnerabilities on several counts, from the failure to maintain proper security hygiene to system vulnerabilities at the end-user level.

Biggest among these threats are misconfigurations. According to a study conducted by Trend Micro, on an average 165 million misconfigurations take place on the cloud every day. The same study also pointed that four out of ten— 40%—of cloud related incidents can be traced back to misconfiguration in the cloud environment.

It is necessary to understand why misconfiguration is such a big threat. First, when an organisation migrates its workloads to a cloud platform, security needs to be configured. Another reason for the rise in cloud misconfigurations can be attributed to the lack of visibility and rapid public cloud adoption. Without adequate visibility, security teams are unable to secure cloud environments. Furthermore, as the percentage of adoption grows, the volume of activity proportionally increases, leading to additional misconfigurations such as a lack of awareness of cloud security and policies, lapse in supervision, lack or insufficient control and negligent internal activities. Add to this the number of services being provided by public cloud providers and we understand why misconfigurations occur. AWS, for example, between 2007 and 2017, has added 100 services to its portfolio. This number spiked in the last two years, with its portfolio of services adding over 75 offerings.

On top of configuration visibility issues, container which has emerged as a solution for complicated micro service based cloud native applications (through the flexibility it provides) causes security teams to have very less visibility. This can be primarily attributed to the shared responsibility shift in DevOps, which then results in forgotten systems and undeleted logs which can turn out to be a hidden vulnerability.

Thus, the need of the hour is for security teams to deploy a single security tool that offers equal amount of visibility and security for both on-premise applications and new generation container and serverless based micro services applications.

The writer is vice-president, Southeast Asia and India, Trend Micro