It is no secret that once the knowledge workers of the world stepped into their new home offices in 2020, the attack plane for cyber-attacks grew exponentially – with ample opportunity for exploitation, to the dismay of businesses everywhere.
The digital landscape is constantly evolving for businesses, which need to be aware of the overall landscape of shifting sands as well as any potential cracks. A fully evolved approach is required for CISOs to enact a holistic cybersecurity strategy which takes the overall threat landscape into account – and cloud apps are the newest frontier and need to be accommodated.
Jérôme Robert is the CMO and MD of North America at Alsid.
The largest enterprises now have over 7,000 cloud apps, according to Netskope’s latest Cloud Report. An average medium-sized enterprise has 863 and an average large organization has 1,148, a staggering number. As the pandemic took hold and the needs of a newly remote workforce shifted, the use of collaboration apps rocketed by 80%. This alone is worthy of a pause for reflection. The sheer scale of attack surface this represents is almost bewildering. But taking a deeper dive will unveil the full extent of interconnections like permissions, data exchange and APIs that run between all of these apps in any corporate environment.
Double-edged sword: understanding the risks
The question most companies will struggle to answer right now though is: what happens if someone compromises an end point or account of someone who has access to your CRM system, for example? Can that intruder use this access to jump to other apps which are integrated with it? Well, the short answer is yes. A hacker can slide through cloud environments using APIs and integrations to move laterally between apps. Annoyingly, it seems that the things designed to make lives easier and more productive for businesses, also make it easier for hackers to get access to what they want.
As the complexity and scale of these environments grow, it’s time to stop thinking of apps simply as “secure” or “insecure” – which is overly simplistic. What is more helpful is to ask specifically how your many cloud apps are connected, and how that might negatively impact your exposure to security risk? It’s time to start thinking holistically about enterprise cloud applications in order to keep up with the evolving complexities of cyber risks. As businesses look to reinforce resilience and pave the way for more enterprise innovation, getting this right will be critical. In 2020 alone, 63% of malware was delivered over cloud applications - a four-point increase from the end of 2019.
There are a few things security teams should consider when looking at the bigger picture. They need to understand how apps manage rights and access, how they are linked, and the depth of permissions for starters – as well as detecting actual attacks. While the creation of these apps and security functions falls on developers, it is up to security teams within enterprises to stay on top of apps and the interconnected web of access and permissions between them – and work together with developers and the wider business. While there’s no convenient way to do this yet, thinking about cloud app security in a new way at the enterprise level is vital to helping companies improve their cloud app exposure and their overall security stance as a result.
Getting to grips with cloud app security
Identity and access management (IAM) is coded directly into applications and should take into account a business’s overall security and technology strategy. When done right, this is more than just security, but a business driver too. For example, once IAM capabilities are matured, not only do the costs to manage it decrease, but the ability to support business innovation with greater agility is realized.
IAM can be applied to a number of core areas – identity management services, access management services, identity governance services and authentication services – depending on an app’s or business’s requirements. Ensuring these are aligned is integral to the success of any strategy. But a best practice approach also means integrating cloud-based identity management solutions consistently with enterprise security, across the full portfolio of cloud apps.
Understanding encryption is also vital when managing the fast growth of enterprise applications. Knowing the nuances of your data at rest, in flight and in use is key to getting encryption right – and will do more than just enhance security since it can boost business performance too. Balancing security and business needs is essential here. For example, encrypting data while it’s in flight is often when it is most vulnerable, but can also slow down the movement of data and hamper performance – so the risk needs to be considered and weighed appropriately.
Collaboration, creativity and innovation
Getting to grips with the basics when it comes to managing security within a business’s cloud app ecosystem will benefit security teams in the near future as the landscape becomes more complex with additional applications coming on stream. Ensuring industry-standard regulation and compliance is adhered to by design will help to define approaches to encryption, while putting the identity governance system within IAM into action. Moreover, a holistic view on cloud security as collaborative apps boom is critical to keeping an eye on performance, impacting productivity – and at times adherence to security policies.
In the digital era it is clear that security cannot be left to one team alone. From developers to security teams, the C-suite and sales – everyone needs to be onboard. Not simply from an implementation point of view, but from a business performance, value and needs point of view. Multiple stakeholders must share this holistic view to ensure that the groundwork is set for the whole ecosystem – with a consistent security strategy setting it up to succeed as a thriving hub of high-performance interactivity. Cloud apps may be the new frontier for cyber risk, but with a little out of the box thinking and collaboration, the road will be paved for future innovation.
- We've featured the best business VPN.
