Four Questions to Ask About Your Cloud Security Posture

Originally published by Lookout.

Written by David Richardson, Vice President, Product, Lookout.

For most organizations, the decision to adopt cloud technologies is a simple one. Cloud apps streamline operations and costs while enabling users to access resources from anywhere and on any device.

But migrating to the cloud has also introduced some complexity, which comes with new risks. Instead of everything residing neatly within your corporate perimeter, your data now resides within countless apps and are being handled by users and endpoints that operate outside of your sphere of influence.

As your organization transforms its digital infrastructure, cybersecurity needs to go through the same transformation. To get you started, I have four questions that will help you pin down whether your move to the cloud is secure.

How much visibility and control do you have?

With many of your corporate resources now located in the cloud, your legacy security tools won't cut it.

The risk levels of your users and endpoints are constantly changing as they connect from environments located outside of your perimeter. To protect your data, you need to be able to identify the difference between normal, risky or malicious behaviors, and you should also be able to identify the risk level of an endpoint, such as whether it has been compromised by phishing or malware.

In addition to users and endpoints, it’s also critical to understand where your software management responsibilities begin and end. While you don’t own the infrastructure of cloud apps, you still need a way to protect identities, apps and data. With the sheer number of apps organizations have to manage, your ability to identify and remediate misconfigurations is critical.

Do you know how your data is being handled?

Sharing information is easy in the cloud, but that also means that if you don’t have the proper safeguards in place, data can easily fall into wrong hands. To keep your sensitive data secure, even as it travels over unsupervised networks and interacts with unmanaged devices, you need to know exactly how your data is being handled. This visibility should extend into multi-cloud environments owned by third parties or your employees.

The second part of this is the ability to enforce data protection policies regardless of where your data resides, even if it gets downloaded by unauthorized users and passed around offline. This should include both allow-and-deny decisions as well as softer restrictions such as redacting keywords and applying watermarks.

Do you have a handle on access, configurations and patching?

Threats move quickly now, as they take advantage of the same interconnectivity that is making remote work easier. Misconfigurations, unpatched vulnerabilities, overly permissive identities and human error are frequently exploited by attacks that are amplified by the cloud.

An attack could start on premises, but your network could also be breached by a compromised cloud app or endpoint. To counter these emerging threats, you need the ability to quickly detect and respond to these threats, something that would require big data and artificial intelligence.

Would you know if you’re out of compliance?

Many organizations must comply with a host of data privacy mandates such as GDPR, HIPAA and CCPA. The consequences for noncompliance can be steep, so you need to be sure that compliance policies are enforced when data moves between the endpoints and the cloud.

As you rapidly adopt new services, you may end up with apps that weren't built with compliance in mind. To make sure you protect regulated data, you need the ability to enforce consistent data protection policies across your entire organization, including unmanaged endpoints and unsanctioned apps.

Modernize as you migrate

To keep your organization's data secure as you migrate to the cloud, you need to put your security through the same digital transformation process that the rest of your business has experienced. The questions I posed in this blog will help you figure out areas that a cloud-delivered security platform should be able to handle.

Legacy security strategies were adequate when everything sat inside corporate perimeters. But with apps and data in the cloud, and users and endpoints connecting from anywhere, you lost the visibility and control you once had.

A unified, cloud-delivered security platform is the answer you’re looking for. With all your security controls in the same place, you’ll have comprehensive protection with fewer complications. Automation driven by machine intelligence will zero in on potential problems and implement dynamic security controls — all without hindering productivity.